10-28-2026 
|
Getting your Trinity Audio player ready...
|
TL;DR: Bybit announced on October 22 that it secured a VARA license for exchange services in Dubai, dated June 20, though one report says the register still showed “Pending.” The approval ends a four-year process and follows its UAE federal license, as Bybit rebuilds trust after its $1.5 billion hack in 2025 and eyes derivatives next.
Key Takeaways:
- Bybit holds a VARA license for exchange services, including spot trading. It is dated June 20, 2026, and was announced on October 22.
- Approval took more than four years. Bybit’s first provisional VARA license came in March 2022.
- The push follows a record $1.5 billion hack in February 2025. The FBI attributed the attack to the Lazarus Group.
- Bybit plans to add derivatives in Dubai, subject to approval. VARA lists 60 licensed firms.
Dubai-based digital asset exchange Bybit announced on October 22 that it has secured a Virtual Asset Service Provider (VASP) license from Dubai’s digital asset regulator, the Virtual Assets Regulatory Authority (VARA), for exchange services, including spot trading.
According to the regulator’s official register, the license was granted to the company’s local entity, Bybit Fintech FZE, on June 20, 2026, with the firm apparently only now choosing to publicize it. However, digital currency news site Coinlaw claims to have reviewed the register on the day of the announcement and reported that the entry still listed the license’s status as “Pending,” which may explain the four-month delay.
Bybit, the world’s sixth-largest digital asset exchange by trading volume, established its international headquarters in Dubai in 2022. It previously held only provisional, non-operational approval from VARA, although it obtained a federal UAE license from the Securities and Commodities Authority (SCA) in October 2025.
“Dubai has made significant progress in building a regulatory environment for virtual assets, and we are pleased to take this next step in our journey here,” said Ben Zhou, Co-founder and CEO of Bybit. “We look forward to continuing our work in Dubai, supporting the local digital asset community and building our business in line with the standards set by VARA.”
In its October 22 announcement, Bybit claimed the license is part of its broader effort to build its business in each market in line with local requirements, saying “the company continues to invest in compliance, security and risk management as it develops products and services for users across different jurisdictions.”
The long road to approval
The approval caps a licensing process that has stretched over more than four years. Bybit received a provisional license from VARA in March 2022, followed by a Minimum Viable Product (MVP) Preparatory License in 2023, which still did not permit it to begin virtual asset operations in the emirate. In September 2024, it was granted Provisional (Non-Operational) Approval for exchange services, the stage at which VARA applicants complete the remaining requirements for a full VASP license.
In the meantime, Bybit secured approval at the federal level. Its SCA license, awarded eight months after the regulator granted in-principle approval in February 2025, covers regulated trading, brokerage, custody, and fiat conversion services for retail and institutional clients across all seven emirates. It also made the firm, in its own words, the first exchange to receive the full license.
VARA and the SCA announced a strategic partnership in August 2025 aimed at unifying digital asset regulation, including “licensing reciprocity,” under which a license approved by one authority could be recognized by the other. Nonetheless, Bybit continued to pursue a separate VARA license for its Dubai entity, which it has now obtained—although the exact date of its award remains unclear.
According to the firm, the license is yet another example of its “continued focus on working with regulators and securing the appropriate permissions.” A worthy cause, for which Bybit has been an emphatic and vocal champion in recent months, something which may or may not have anything to do with its reputation taking a substantial hit last year.
A hack for the ages may require some PR damage control
In February 2025, Bybit fell victim to a record-setting hack that resulted in the loss of nearly $1.5 billion worth of ETH and ETH-based tokens—the largest theft in the digital asset space, or any other.
The U.S. Federal Bureau of Investigation (FBI) attributed the attack to North Korea’s Lazarus Group. Bybit said the hackers had compromised a developer’s machine at SafeWallet, the provider hosting its cold wallet, allowing them to disguise a malicious transaction. In the days that followed, customers withdrew more than $4 billion in additional funds from the exchange.
Since the incident, Bybit has made some notable regulatory progress towards regaining trust. It obtained a license under the European Union’s Markets in Crypto-Assets (MiCA) Regulation in May 2025, followed by the SCA license that October.
In August, Bybit Payments GmbH was granted an electronic money institution license by Austria’s Financial Market Authority, while in Indonesia, Bybit acquired a majority stake in the operator of local exchange NOBI in April; the business was renamed Bybit Indonesia and began operating under the supervision of the country’s Financial Services Authority (OJK) in July.
Bybit targets derivatives next
On its most recent license, Bybit Chief Legal and Compliance Officer Peter Loo said: “Securing this license is a significant step forward for Bybit. We have great respect for VARA’s work in establishing a clear and robust framework for virtual assets. A healthy digital asset market needs strong oversight, sound risk management and a commitment to protecting users. We look forward to continuing our work with VARA as we grow our business in Dubai.”
He added that the firm hopes to expand its licensed activities to include derivatives in time, “subject to the necessary regulatory approvals.”
“Derivatives are a major part of Bybit’s global trading business, and we want to bring more of our offering to Dubai through the appropriate regulatory process,” said Loo.
Bybit is one of a growing number of firms to advance through Dubai’s licensing regime. Kraken’s parent company, Payward, received full Dubai approval earlier this month, while Flowdesk obtained broker-dealer authorization in August.
As of its current register, VARA lists 60 firms as licensed, with a further 24 under “in-principle approval.”
FAQs:
Did Bybit get a VARA license?
Yes. Bybit announced on October 22 that it secured a VARA license for exchange services, including spot trading, granted to Bybit Fintech FZE.
When was Bybit’s VARA license granted?
VARA’s register says June 20, 2026. Coinlaw reported the entry still read “Pending” on announcement day, so the exact date is unclear.
How long did Bybit take to get a VARA license?
More than four years, starting with a provisional license in March 2022 and Provisional (Non-Operational) Approval in September 2024.
Does Bybit have a UAE license?
Yes. It received a federal SCA license in October 2025 covering trading, brokerage, custody, and fiat conversion across all seven emirates.
What happened in the Bybit hack?
In February 2025, hackers stole nearly $1.5 billion in ETH and tokens. The FBI attributed it to North Korea’s Lazarus Group.
Will Bybit offer derivatives in Dubai?
Not yet. Bybit hopes to add derivatives in time, subject to the necessary regulatory approvals.
How many companies have a VARA license?
VARA lists 60 licensed firms and 24 with in-principle approval.
Watch: The Middle East’s Blockchain Race
