Platforms · Software · Providers · Markets
Dubai authorisation remains spot-only
Bybit announced on 22 October 2026 that it had received full regulatory clearance in Dubai for spot trading. VARA's public register lists the licence as active for Bybit Fintech FZE, with an issue date of 20 June 2026. It covers services to institutional, retail and qualified investors.
The authorisation follows the in-principle approval Bybit received from the Virtual Assets Regulatory Authority in 2024. It does not extend to derivatives.
VARA requires an exchange's licence to specify that activity before the firm can offer those products. Peter Loo, Bybit's Chief Legal and Compliance Officer, said the company hopes to add derivatives later, subject to the necessary regulatory approvals.
The Dubai permission is separate from the federal Virtual Asset Platform Operator licence Bybit obtained from the UAE's Securities and Commodities Authority in 2025. VARA oversees virtual-asset activity across Dubai and its free zones, with the Dubai International Financial Centre outside its remit.
Bybit says it added five licences and regulatory permissions during 2026, spanning the European Union, El Salvador, Indonesia, the Cayman Islands and South Africa. The VARA register also shows derivatives permissions for OKX and Binance. Binance's permission covers institutional and qualified investors, but excludes retail clients, according to the register. The Dubai authorisation was first reported by Finance Magnates.
- Permitted activity: spot trading, not derivatives.
- Eligible client groups: institutional, retail and qualified investors.
- Separate UAE-level authorisation: the federal Virtual Asset Platform Operator licence.
Where this lands in the stack
For operators, the licence boundary makes product eligibility and client classification the immediate checks. Teams should verify that Dubai account settings, product catalogues and order-entry controls do not expose derivatives under this permission. They should also confirm that routing and risk rules distinguish the Dubai licence from Bybit's separate federal authorisation.
The public register establishes the permitted activity and investor groups, but the report does not specify how Bybit implements those limits across its systems. Operations and compliance teams should check which licence drives account onboarding, trade surveillance and regulatory reporting, and how any future derivatives permission would be reflected in those controls.
