VARA’s public register listed 52 fully licensed virtual asset service providers in Dubai when we read it on 28 July 2026, and only 14 of them hold Exchange Services. Several household names that market heavily to UAE residents, including Bybit, Kraken, Revolut and Rain, appear only on the In-Principle Approval list, and VARA states plainly that IPA holders are prohibited from conducting virtual asset activities or servicing clients until the full licence is issued.
That single distinction is the whole article. This guide reproduces what the regulator actually publishes, explains the licence category that determines what a platform may legally do for you, and sets out the two-layer check that became necessary on 1 January 2026 when virtual assets entered the federal regulatory perimeter. For the underlying legal framework, our guide to how to legally buy, hold and trade crypto in Dubai under VARA covers the rules; this page names the platforms.
What changed on 1 January 2026
Until the end of 2025, checking a Dubai platform meant checking VARA. There are now two layers.
Federal Decree-Law No. 32 of 2025 replaced the Securities and Commodities Authority with the Capital Market Authority, and Federal Decree-Law No. 33 of 2025 brought virtual assets into the scope of regulated financial products for the first time. Both took effect on 1 January 2026 with a transitional period reported at up to twelve months. Law firm analysis of the new framework notes that Article 2(1)(d) of Decree-Law 33/2025 extends the law to any person targeting clients inside the UAE even where the activity is conducted outside it, and that unlicensed financial activity carries imprisonment of at least one year plus fines reaching AED 250 million.
You can see the practical consequence on VARA’s register itself: every licensed VASP now carries a CMA registration number alongside its VARA licence reference. A platform operating lawfully for a Dubai retail customer should be able to show you both.
The four regulators, in one line each
| Regulator | Covers |
|---|---|
| VARA | Dubai mainland and all Dubai free zones except the DIFC. VARA describes itself as the sole authority across that area |
| CMA (formerly SCA) | Federal layer across the UAE outside the two financial free zones, from 1 January 2026 |
| FSRA | Abu Dhabi Global Market, which launched the Gulf’s first virtual asset regime in 2018 |
| DFSA | Dubai International Financial Centre, which sits outside VARA’s remit entirely |
The split between the two financial free zones and the rest of the country is explained in our comparison of DIFC and ADGM.
Licence category matters more than the brand
VARA licenses eight distinct virtual asset activities: Advisory, Broker-Dealer, Custody, Exchange, Lending and Borrowing, Management and Investment, Transfer and Settlement, and Category 1 VA Issuance. A firm is authorized only for the activities on its licence.
The practical effect is that “licensed by VARA” tells you almost nothing on its own. A platform with a Broker-Dealer licence may deal with you in virtual assets; it is not authorized to operate an exchange. One with Custody Services may hold assets and nothing else. Only the Exchange Services entry means the firm may run a trading venue, and only entries marked “including VA Derivatives Trading” cover derivatives.
The 14 firms licensed for Exchange Services in Dubai
These are the entries on VARA’s public register carrying Exchange Services, with full VASP licences and Active status, as read on 28 July 2026. Licence references and dates are as published.
| Licensed entity | Licensed activities | Licence issued |
|---|---|---|
| Binance FZE | Exchange (including VA Derivatives Trading), Broker-Dealer, Management and Investment, Lending and Borrowing | 2024/04/15 |
| Foris DAX Middle East FZE (Crypto.com) | Exchange (including VA Derivatives Trading), Broker-Dealer, Management and Investment, Lending and Borrowing | 2024/04/03 |
| OKX Middle East Fintech FZE | Exchange (including VA Derivatives Trading), Broker-Dealer, Management and Investment, Lending and Borrowing | 2024/09/17 |
| Deribit FZE | Exchange (including VA Derivatives Trading) | 2024/11/01 |
| Gate Technology FZE | Exchange | 2025/04/25 |
| Hashkey MENA FZE | Exchange, Broker-Dealer | 2025/04/14 |
| Trek Labs Ltd FZE (Backpack) | Exchange | 2023/10/30 |
| Flipster FZE | Exchange | 2026/07/14 |
| Mantra Finance FZE | Exchange, Broker-Dealer, Management and Investment | 2025/02/19 |
| OFZA Fintech Virtual Asset Exchange Services LLC | Exchange, Broker-Dealer, Management and Investment | 2024/12/30 |
| MBIO FZE (MB.IO) | Exchange, Broker-Dealer | 2024/07/18 |
| YHEGO Virtual Assets Exchange Service L.L.C | Exchange, Broker-Dealer | 2026/06/02 |
| Scintilla Network FZE | Exchange, Broker-Dealer | 2023/09/11 |
| LCT Global FZE | Exchange | 2025/12/26 |
The first eight are the ones a retail user in Dubai is realistically choosing between. The rest are licensed but operate at institutional or niche scale, and several are recent additions. Deribit is a derivatives venue rather than a general spot exchange, so it belongs in a different comparison to Binance or Crypto.com.
Fully licensed, but not as an exchange
Several familiar names hold full VASP licences for other activities. They are legitimate and regulated; they are simply authorized for something narrower than running a trading venue.
| Entity | Licensed for |
|---|---|
| BitOasis Technologies FZE | Broker-Dealer Services |
| CoinMENA FZE | Broker-Dealer Services |
| Fasset FZE | Broker-Dealer Services |
| Bitpanda Broker MENA FZCO | Broker-Dealer Services |
| Midchains FZE | Broker-Dealer Services |
| Komainu MEA FZE | Custody, including custodial staking and collateral wallet services |
| Hex Trust MENA FZE | Custody Services |
| BitGo Custody MENA FZE, Bitpanda Custody MENA FZCO, Ceffu Custody FZE | Custody, including custodial staking |
| Zand Bank P.J.S.C. | Custody Services, making it a licensed UAE bank on the virtual asset register |
Zand is worth a second look if you care about where assets sit rather than where they trade. It is a licensed bank taking a VARA custody licence, which is a different risk profile to an offshore exchange holding your coins. On how the UAE’s digital banks are structured and who holds the licence in each case, see our comparison of Wio, Liv and Mashreq Neo.
In-Principle Approval is not a licence
VARA maintains a second list, and this is where the marketing gap lives. An IPA is a conditional step in the licensing process. VARA’s own wording on the register is unambiguous: applicants holding an IPA are strictly prohibited from initiating operations, conducting any virtual asset activities, or servicing clients until they have obtained their full VASP licence.
There were 22 entries on the IPA list on 28 July 2026. The names on it are not small.
| Applicant | Applied for | IPA issued |
|---|---|---|
| Bybit Fintech FZE | Exchange Services | 2024/08/21 |
| Payward FZCO (Kraken) | Management and Investment, Broker-Dealer | 2026/05/13 |
| Revolut Digital Assets FZE | Broker-Dealer, Exchange, Management and Investment | 2026/06/05 |
| Rain MENA FZE | Exchange, Broker-Dealer | 2026/04/07 |
| Standard Chartered Bank | Broker-Dealer Services | 2026/05/01 |
| Web3Exchange DMCC | Broker-Dealer, Exchange | 2026/07/16 |
Two entries on the IPA list carry a Withdrawn status rather than Issued, which is a reminder that the register records exits as well as entries. Bybit’s IPA has been outstanding since August 2024, which is a long time to sit at the conditional stage and is worth weighing if you are choosing a Dubai venue.
What to do with this: if a platform’s marketing says “VARA approved,” “VARA regulated,” or “licensed in Dubai,” open the register and check which list it is on. Approval and licence are not the same word.
Outside Dubai: the federal route, and where Bybit actually sits
Bybit is the clearest example of why the two-layer check matters. In October 2025 it announced a Virtual Asset Platform Operator Licence from the Securities and Commodities Authority, reported as the first full licence of its kind at federal level, following an in-principle approval in February 2025. That licence operates at the UAE mainland layer now administered by the CMA, covering trading, brokerage, custody and fiat conversion.
So Bybit holds a full federal licence and, separately, only an IPA with VARA. Those two facts sit side by side and we are not going to pretend they resolve neatly. VARA describes itself as the sole authority for Dubai outside the DIFC, and VARA says IPA holders may not service clients. If you are a Dubai resident specifically, that is a question to put to the platform in writing before you deposit, and to check again on the register, because the position changes as licences are granted.
Abu Dhabi and the DIFC
ADGM’s FSRA has run a virtual asset regime since 2018, longer than any other UAE regulator. M2 holds an FSRA permission as a Multilateral Trading Facility and Custodian and onboards UAE residents, including AED trading pairs, which makes it the most retail-relevant ADGM venue. MidChains is the other established ADGM name, and it also appears on VARA’s register with a Broker-Dealer licence, so a single group can hold permissions in more than one jurisdiction.
The DIFC sits under the DFSA and outside VARA entirely. Reported FSRA guidance updates in March 2026 added licence categories and addressed tokenized securities and DeFi, so treat any Abu Dhabi checklist older than that as stale.
How to check a platform before you deposit
- Get the licensed legal entity name, not the brand. The register lists Foris DAX Middle East FZE, not Crypto.com, and Payward FZCO, not Kraken. If the platform cannot give you the entity name, stop there.
- Open VARA’s public register and search that entity. Confirm the record says VASP Licence and Active, not In-Principle Approval, and not Withdrawn.
- Read the licensed activities line. Exchange Services means it may run a trading venue. Broker-Dealer alone does not. Derivatives require the entry to say so explicitly.
- Check the CMA registration number is present on the register entry, which is the federal layer added in 2026.
- Match the entity to the app you are actually using. A global platform’s terms may place you with an offshore entity even when a UAE-licensed affiliate exists. The account you open is the one that matters, not the group.
- For ADGM or DIFC platforms, check the right register instead. ADGM firms appear on the FSRA public register and DIFC firms on the DFSA’s, not on VARA’s.
If a platform fails these checks, that is not a technicality. Decree-Law 33/2025 is reported to reach any person targeting clients in the UAE even from outside it, with criminal exposure attached to unlicensed activity, which is a strong signal about where enforcement is heading.
What to compare once licensing is settled
Licensing narrows the field. It does not pick for you. The variables that actually differ, in rough order of how much money they move:
- The AED on-ramp. Whether you can fund by local bank transfer from a UAE account rather than a card, and whether the platform gives you a dedicated AED wallet. Card funding is consistently the most expensive route.
- Total spread, not headline fee. A quoted 0.1 percent taker fee on a venue with a thin order book can cost more than a higher fee on a deep one. Compare the price you actually receive on a realistic order size.
- Withdrawal, both crypto and AED. Network fees and the AED payout route back to your bank are where the round trip gets priced.
- Custody arrangement. Whether assets sit with the exchange, with a separately licensed custodian, or in your own wallet. The custody licences listed above exist because this is a distinct regulated function.
- What is actually listed. Regulated venues in the UAE do not list everything a global venue lists.
Getting AED into and out of an exchange also runs through the ordinary banking compliance layer. UAE banks apply customer due diligence and purpose-of-transfer codes, and the practicalities are covered in our guides to receiving international transfers into a UAE account and moving large sums out of the UAE.
One thing crypto does not have
Money in a licensed UAE bank sits inside a bank-protection framework. Virtual assets on an exchange do not, whatever the licence says. A VARA licence regulates conduct, capital and custody standards; it is not a deposit guarantee and it does not make you whole if the asset price falls or the platform fails. The contrast with how bank deposits are treated is set out in our explainer on deposit safety and protection in the UAE.
Tax
The UAE levies no personal income tax and no capital gains tax on individuals, so an individual’s crypto gains are not taxed as personal income. Trading as a business is a different question: corporate tax applies at 9 percent above AED 375,000 of taxable income, and the natural-person threshold rules matter if you are operating at scale. The full position, including the VAT exemption on virtual asset transfers and conversions, is covered in our VARA and crypto guide. This is general information and not tax advice; take advice on your own circumstances.
Frequently asked questions
Which crypto exchanges are actually licensed in Dubai?
As read on 28 July 2026, VARA’s public register listed 52 fully licensed VASPs, of which 14 hold Exchange Services. The largest retail-facing ones are Binance FZE, Foris DAX Middle East FZE trading as Crypto.com, OKX Middle East Fintech FZE, Gate Technology FZE, Hashkey MENA FZE, Trek Labs trading as Backpack, Flipster FZE, and Deribit FZE for derivatives. The register is live and changes, so check it rather than relying on any list.
Is Bybit licensed in the UAE?
Bybit holds a Virtual Asset Platform Operator Licence at federal level, announced in October 2025 and reported as the first of its kind, which sits with the authority now called the CMA. In Dubai, Bybit Fintech FZE appears on VARA’s In-Principle Approval list with an IPA dated August 2024, not on the fully licensed list. VARA states that IPA holders may not conduct virtual asset activities or service clients until the full licence is issued, so Dubai residents should confirm their position with the platform directly.
What is the difference between a VARA licence and an In-Principle Approval?
A full VASP licence authorizes the firm to conduct the listed activities. An IPA is a conditional step in the process, and VARA’s register states that IPA holders are strictly prohibited from initiating operations, conducting any virtual asset activities, or servicing clients until the full licence is granted. Marketing language often blurs the two, so check which list the entity appears on.
How do I check if a crypto exchange is licensed in the UAE?
Get the licensed legal entity name rather than the brand, then search VARA’s public register for Dubai outside the DIFC. Confirm the status reads VASP Licence and Active, read the licensed activities line to see whether Exchange Services is included, and check that a CMA registration number is shown. ADGM firms appear on the FSRA register and DIFC firms on the DFSA register instead.
What changed for crypto regulation in the UAE in 2026?
Federal Decree-Law No. 32 of 2025 replaced the Securities and Commodities Authority with the Capital Market Authority, and Federal Decree-Law No. 33 of 2025 brought virtual assets into the scope of regulated financial products. Both took effect on 1 January 2026, with a transitional period reported at up to twelve months, and VARA-licensed firms now carry a CMA registration number alongside their VARA licence.
Why do some licensed platforms only have a Broker-Dealer licence?
Because VARA licenses eight separate activities and a firm is authorized only for the ones on its licence. Broker-Dealer means the firm may deal in virtual assets with you; it does not authorize operating a trading venue. BitOasis, CoinMENA, Fasset, Bitpanda Broker and Midchains all hold Broker-Dealer licences rather than Exchange Services.
Can I use a global exchange that is not licensed in the UAE?
Law firm analysis of Federal Decree-Law 33/2025 notes that Article 2(1)(d) applies the law to any person targeting clients in the UAE even where the activity is conducted outside it, with criminal exposure and fines up to AED 250 million attached to unlicensed financial activity. That obligation falls on the provider rather than the customer, but an unlicensed platform leaves you with no UAE regulator to escalate to if something goes wrong.
Are my crypto holdings protected like a bank deposit in the UAE?
No. A VARA licence regulates conduct, capital and custody standards. It is not a deposit guarantee, it does not protect you against price falls, and it is not the same protection framework that applies to money held in a licensed UAE bank.
Do I pay tax on crypto gains in the UAE?
Individuals pay no personal income tax or capital gains tax in the UAE, so personal crypto gains are not taxed as income. Trading as a business is different, with corporate tax at 9 percent above AED 375,000 of taxable income. This is general information, not tax advice.
Which crypto platform can I use in Abu Dhabi?
ADGM’s FSRA has regulated virtual assets since 2018. M2 holds an FSRA permission as a Multilateral Trading Facility and Custodian and onboards UAE residents including AED pairs, and MidChains is the other established ADGM venue. ADGM firms are checked on the FSRA public register, not VARA’s, and reported FSRA guidance updates in March 2026 changed the licence categories.
Official Sources
- VARA — Public Register of Licensed VASPs and In-Principle Approvals
- VARA — Licence Applications and Regulated Virtual Asset Activities
- VARA — Regulations and Guidelines
- Capital Market Authority (formerly the Securities and Commodities Authority)
- Abu Dhabi Global Market — FSRA Public Register
- Dubai Financial Services Authority — Public Register
- ADGM — M2 secures ADGM licence for regulated crypto services to UAE residents
Information current as of July 2026. Register entries, licence categories and approval statuses were read from VARA’s public register on 28 July 2026 and change frequently; always check the live register before depositing funds. Federal Decree-Law No. 32 of 2025 and No. 33 of 2025 details, including the extraterritorial provision and penalty amounts, are drawn from published law firm analysis rather than a directly fetched copy of the decree-laws, and the transitional period is as reported. Bybit’s federal licence is drawn from company and press announcements. This article is general information about licensing status only. It is not financial, investment, legal or tax advice, it is not a recommendation to buy, sell or hold any virtual asset, and no platform named here is endorsed. Virtual assets are volatile and you can lose the entire amount invested.
