Bybit wins Dubai VARA licence for spot crypto trading

Bybit has added Dubai to its regulated map, and the paperwork matters more than the press release suggests. The exchange said on October 22 that Dubai's virtual-asset watchdog, VARA, granted its local company, Bybit Fintech FZE, a permit to run a spot exchange. Spot trading means buying and selling crypto directly at current market prices, with no leverage and no contracts wagering on future moves. That boundary is the whole story here, because the permit stops at spot. Derivatives — the leveraged products that drive much of Bybit's global volume — are not included, and winning permission for them will mean a separate application and a separate decision. Bybit moved its international base to Dubai in 2022, four years before this permit arrived, and the company puts its worldwide user count at more than 80 million. Treat that figure as a company claim, not an audited number: it says nothing about how many of those users will actually be served under the Dubai permission.

Spot only. That is the line to remember.

Why it matters

Read the scope, not the headline, because a permit for one activity does not authorize the rest of the menu. VARA's writ runs across most of Dubai but stops at the DIFC — the emirate's financial free zone — which answers to its own regulator — so even the geography of this approval has edges. Bybit's chief legal and compliance officer, Peter Loo, said the firm hopes to add derivatives to its Dubai permissions later, pending further sign-off. Until that happens, the Dubai entity is a spot business, and anyone assuming the full Bybit product suite sits under this permit is misreading it. The distinction also cuts the other way for traders: a spot-only licence is still a regulated on-ramp, with custody, surveillance and reporting duties that an unlicensed offshore venue never carries.

The competitive backdrop sharpens the point. Kraken's parent Payward won full VARA approval on October 12, clearing it to launch dirham-denominated trading, staking and tokenized equities in the UAE. Bybit's approval lands ten days later and covers less ground. Dubai is becoming a crowded, regulated arena where the edge is no longer who shows up first but whose permit covers the most products.

Six approvals in one calendar year is a deliberate strategy, not a coincidence. The five earlier approvals, cited by chief executive Ben Zhou in his October keynote, span four continents, and Dubai makes six. Counted together, they describe a company buying regulatory standing market by market rather than waiting for a single global regime that will never arrive. The cost of that approach is visible too: each permit brings its own reporting, surveillance and product limits, and a spot-only permit in Dubai means the derivatives engine behind Bybit's global volumes still sits outside the emirate's regulated perimeter.