Platforms · Software · Providers · Markets
Bybit's active authorisation from the Virtual Assets Regulatory Authority (VARA) in Dubai permits spot-market exchange services, but excludes crypto derivatives, the exchange's core business.
Dubai authorisation sets the boundary
VARA's register places Bybit Fintech FZE in its fully licensed tier, allowing it to serve retail, qualified and institutional investors. Bybit announced the approval on 22 October 2026, while the register records 20 June 2026 as the issue date. VARA first granted in-principle approval in 2024.
The Dubai status is separate from Bybit's federal Virtual Asset Platform Operator licence, granted by the UAE's Securities and Commodities Authority in 2025. VARA oversees virtual-asset activity across Dubai and its free zones, but the Dubai International Financial Centre falls outside its remit.
Under VARA rules, derivatives can be offered only if that activity is specified in an exchange's licence. Peter Loo, Bybit's Chief Legal and Compliance Officer, said: "In time, we also hope to expand our licensed activities to include derivatives, subject to the necessary regulatory approvals."
Other permissions show the gap
VARA's register also gives Binance and OKX permission to offer derivatives. Binance's authorisation covers qualified and institutional investors, while retail clients are excluded.
Bybit says it is adapting its operations to meet local rules in the markets where it does business. The company said it added five licences and regulatory permissions during 2026, with approvals in Indonesia, El Salvador, South Africa, the Cayman Islands and the European Union. The activation was first reported by Finance Magnates.
The integration question
For firms connecting to Bybit's Dubai service, the distinction between spot permissions and derivatives authorisation matters for product entitlements and client controls. Operators should establish which customer classes can access the service and whether Dubai activity needs separate reporting or reconciliation treatment.
The announcement and register do not specify API changes, a migration process or a rollout timetable. Firms integrating the service should ask whether their existing connection can identify Dubai-authorised activity, and how executions will be attributed to the relevant entity.
