Bybit Wins Full VARA Spot Trading Licence in Dubai
Bybit's Dubai entity has received a full virtual asset service provider licence from the Virtual Assets Regulatory Authority, authorising spot trading services for retail, qualified, and institutional investors. The licence is already listed as active on VARA's public register, but Bybit cannot serve customers yet: the exchange must still complete the regulator's operational launch requirements before going live. For accounting firms, auditors, and CFOs tracking the UAE's fast-moving regulatory landscape, this development reshapes the compliance baseline for any client with exposure to one of the region's largest exchanges. Selecting the right crypto accounting software to capture VARA-compliant transaction data will matter from day one of the exchange's launch.
From In-Principle Approval to Full VARA Licence
Bybit's Dubai entity, Bybit Fintech FZE, had previously held an in-principle approval from VARA. According to a Bybit spokesperson, that earlier status was entirely non-operational and did not permit the entity to onboard or serve customers in Dubai. The newly issued VASP licence for exchange services, which includes spot trading, changes that status materially.
What the VARA Register Now Shows
VARA's public register lists the licence as active, covering exchange services across three investor tiers: retail, qualified, and institutional. That three-tier coverage is significant. Under VARA's framework, each investor category carries distinct conduct-of-business obligations, from suitability assessments for retail clients through to enhanced due diligence thresholds for institutional counterparties. Firms whose clients interact with Bybit's Dubai entity will need to understand which tier applies, because the tier determines the KYC and AML documentation the exchange is obliged to collect and, by extension, the evidence trail available to auditors.
The Operational Launch Process Still Pending
Receiving a full licence and being operationally open for business are two distinct stages under VARA's regime. The exchange confirmed it must complete VARA's launch process and satisfy operational requirements before spot trading begins. No launch date was disclosed. This gap matters for planning purposes: firms should not assume that the licence date triggers any client transaction activity. The relevant date for accounting and AML purposes will be the date on which Bybit Fintech FZE actually opens its order books to customers.
The SCA Licence and Why Dubai Was Excluded
Bybit also holds a licence from the UAE's federal regulator, the Securities and Commodities Authority, granted in October 2025 to a separate legal entity, Bybit Virtual Asset Platform Operator LLC. That entity's service scope explicitly excluded Dubai. The SCA and VARA operate in parallel across the UAE: the SCA governs the federal layer, while VARA is Dubai's dedicated virtual asset regulator with its own rulebook, supervision model, and enforcement powers.
A Dual-Regulator Structure That Matters for Accounting
The coexistence of an SCA-licensed entity and a VARA-licensed entity within the same exchange group creates a structural complexity that accountants and auditors cannot ignore. Each entity is a separate legal person, with its own capital requirements, reporting obligations, and permissible activities. Any client whose transactions span both entities, or who migrates from one to the other as Bybit structures its UAE offering, will generate accounting events that need to be mapped against the correct regulatory wrapper. Treating the two entities as interchangeable in a ledger would be an error with real audit consequences.
Understanding how licensing milestones reshape crypto bookkeeping software requirements is increasingly essential as exchanges operate across multiple regulated entities in a single jurisdiction.
VARA's Regulatory Framework at a Glance
VARA sits within Dubai's broader financial free zone architecture and has issued its own comprehensive virtual asset rulebook, covering market conduct, AML and CFT obligations, custody standards, and technology governance. Exchanges holding a VASP licence for spot trading are subject to transaction monitoring requirements, suspicious transaction reporting to the UAE Financial Intelligence Unit, and periodic regulatory reporting to VARA itself.
AML and KYC Obligations Under a VARA Spot Licence
A full exchange licence under VARA carries the AML obligations set out in the UAE's Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering, as well as VARA's own AML and Sanctions Compliance Rulebook. In practice, that means Bybit Fintech FZE will be required to apply risk-based customer due diligence, screen against UAE Cabinet Decision No. 74 of 2020's targeted financial sanctions lists, and file suspicious transaction reports where thresholds or red flags are met.
For accounting firms and CFOs whose clients trade on the platform, this creates an indirect benefit: a VARA-licensed exchange is obliged to maintain a documented KYC and transaction audit trail. That trail, when accessible via data exports or API, becomes a primary input for any reconciliation or tax position prepared using digital asset accounting software. The quality of that data feed will directly affect the accuracy of financial statements and any tax filings that reference Bybit trades executed through the Dubai entity.
Custody and Segregation Standards
VARA's rulebook also imposes asset segregation and custody requirements on licensed exchanges. Client assets must be held separately from the exchange's own assets, and custody arrangements are subject to periodic review. For auditors signing off on client financial statements that include balances held at Bybit's Dubai entity, the custody framework provides a regulatory reference point when assessing whether those assets can be recognised and how they should be measured under IFRS.
Accounting and Tax Implications for UAE-Based Clients
The UAE introduced corporate tax at a standard rate of 9% for financial years beginning on or after 1 June 2023, administered by the Federal Tax Authority. Virtual asset transactions are not exempt from corporate tax simply because they occur on a regulated exchange. Firms advising UAE-incorporated clients need to ensure that spot trades executed through Bybit Fintech FZE are captured, dated, and valued consistently with the Federal Tax Authority's guidance on taxable income recognition.
What the Licensing Event Does Not Change
The VARA licence does not alter the tax treatment of any underlying transaction. A spot trade that generates a gain remains taxable; a disposal of a digital asset still triggers recognition under the relevant accounting policy the client has adopted. What the licence does change is the compliance environment surrounding those trades. A VARA-licensed exchange is subject to reporting and record-keeping obligations that give regulators, and by extension auditors, a cleaner basis on which to verify transaction histories. Firms should update their engagement letters and client onboarding questionnaires to capture whether clients are using VARA-licensed platforms, as this affects the assurance procedures applicable to exchange-held balances.
VAT Treatment of Exchange Services
The UAE's Federal Tax Authority has confirmed that the transfer and conversion of virtual currencies is treated as an exempt supply for VAT purposes, effective from January 2018 retrospectively. Exchange services provided by Bybit Fintech FZE to UAE-resident business clients should therefore not carry an output VAT charge on the trading spread or commission. However, advisory fees, custody fees, or other ancillary services provided by the entity may fall under a different VAT category, and firms should verify the nature of each charge against the FTA's classification.
What Accounting and Compliance Teams Should Do Now
The operational launch has not yet occurred, so there is a window for preparation. The following steps are practical and time-bound.
Client Exposure Mapping
Identify which clients currently use Bybit's non-Dubai entity and which may migrate to or additionally use Bybit Fintech FZE once it goes live. Each distinct legal entity represents a distinct counterparty for accounting and AML risk assessment purposes. Update your client risk assessments and, where relevant, your firm's own AML business-wide risk assessment to reflect the expanded regulated exchange landscape in Dubai.
Data Infrastructure and Crypto Accounting Software Readiness
Once Bybit Fintech FZE opens its order books, transactions will carry a new entity identifier. Confirm that the crypto accounting software your firm or clients use can distinguish between the SCA-licensed entity and the VARA-licensed entity and apply the correct jurisdictional and tax treatment to each. This is not a theoretical concern: misattributing trades to the wrong legal entity affects both the balance sheet and the corporate tax computation. Keeping AML and KYC licensing developments across global jurisdictions under active review ensures your firm's compliance processes do not lag the regulatory timeline.
Audit File Preparation
For audit engagements covering periods that include Bybit's Dubai launch, plan for the need to obtain confirmations or statements from Bybit Fintech FZE as a separately licensed custodian and trading venue. VARA's rulebook creates a regulatory record that auditors can reference, but direct confirmation procedures should still be applied in accordance with ISA 505 and your firm's methodology for digital asset engagements.
Frequently Asked Questions
What is the difference between the VARA licence and Bybit's earlier SCA approval?
The SCA licence covers the UAE at the federal level through a separate Bybit legal entity, and that entity's permissible services excluded Dubai. The VARA licence covers Dubai specifically, is issued to a different Bybit entity (Bybit Fintech FZE), and falls under VARA's own rulebook rather than the SCA's federal framework. The two regimes operate in parallel and impose distinct obligations.
Can Bybit's Dubai entity serve clients right now?
No. Although the licence is listed as active on VARA's public register, Bybit has confirmed that it must complete VARA's operational launch process and meet additional requirements before commencing spot trading. No launch date has been announced. Firms should monitor VARA's register and Bybit's official communications for the launch date, as that date determines when accounting and AML obligations begin to accrue for client activity on the platform.
How should auditors treat balances held at Bybit Fintech FZE?
Once the entity is operationally live, balances held there should be treated as held at a distinct regulated custodian and trading venue, separate from any balances at Bybit's SCA-licensed entity. Confirmation procedures under ISA 505 should be directed to Bybit Fintech FZE specifically. VARA's custody segregation requirements provide a regulatory reference point for the existence and ownership assertions, but they do not substitute for direct audit procedures.
Does the VARA licence change the UAE corporate tax treatment of spot trades?
No. The licence changes the regulatory environment, not the tax treatment. Gains from spot crypto trades executed through a VARA-licensed exchange remain subject to the UAE's 9% corporate tax where the entity holding or trading the assets is a UAE-taxable person. Firms should apply the Federal Tax Authority's guidance on income recognition consistently, regardless of which regulated platform executes the trade.
What AML obligations apply to accounting firms with clients using VARA-licensed exchanges?
Accounting firms registered or operating in the UAE that fall within the scope of the UAE's AML framework are required to conduct risk-based client due diligence and to assess the risks posed by the platforms their clients use. A client using a VARA-licensed exchange is trading on a regulated platform subject to its own transaction monitoring and reporting obligations, which is a mitigating factor in the firm's risk assessment. However, this does not eliminate the firm's own CDD and record-keeping requirements under Federal Decree-Law No. 20 of 2018 and its implementing regulations.
Source: Cointelegraph