Bybit Crypto Exchange

Bybit Crypto Exchange Licenses: A Clear 2026 Guide

The Bybit crypto exchange is a young platform with a fast-moving license record. For its first five years it grew as a lightly regulated derivatives venue. Then, from 2023, it began applying for licenses market by market, pulled out of the places where it could not get one in time, and in 2025 collected its two most important approvals, in Austria and the UAE, in the same year it suffered the largest theft in crypto history. This guide puts that record in date order.

The scope is deliberate: history and licensing only. You will not find a fee table, a rating or a recommendation here.

For project teams defining jurisdiction and service requirements, read Sigma’s guide to blockchain consulting services. Business planning should be supported by qualified legal advice on licensing.

What the Bybit crypto exchange is

Bybit is a centralized exchange best known for derivatives trading, with spot trading, a wallet and institutional services added over time. The group is headquartered in Dubai and operates through jurisdiction-specific entities. Its official Bybit website provides platform information; the contracting entity must be checked separately.

Item	Detail
Founded	2018
Founder and CEO	Ben Zhou
Headquarters	Dubai (moved from Singapore)
EU license entity	Bybit EU GmbH (Vienna)
EU platform	bybit.eu
UAE federal license	SCA Virtual Asset Platform Operator License (2025)
Kazakhstan	AIFC entity, AFSA-regulated

Like other large exchanges, the group runs through several legal entities. The brand is the same everywhere, but the company that holds a customer’s account, and the regulator above it, depend on where the customer lives. In Europe that is now a separate platform with its own domain.

For another example of entity-specific licensing, read our guide to the Coinbase crypto exchange and its regulatory history.

2018 to 2022: an offshore derivatives venue

Ben Zhou founded the company in 2018, and it later moved its headquarters from Singapore to Dubai. In its early years the Bybit crypto exchange focused on perpetual contracts and other derivatives, sold to a global audience with few local licenses behind it. That was common among offshore exchanges of the period, and it set up the problem the company would spend 2023 to 2025 solving.

2023: the first licenses, and the first exits

2023 is the year the Bybit crypto exchange started to choose between licensing a market and leaving it.

Japan: a warning

On 31 March 2023 Japan’s Financial Services Agency sent warning letters to several exchanges, including this one, saying they were operating in the country without a license. In May the exchange introduced mandatory identity verification for all users.

Kazakhstan: the first license

Kazakhstan came next. On 29 May 2023 the company announced in-principle approval from the Astana Financial Services Authority (AFSA), the regulator of the Astana International Financial Centre (AIFC). The approval covered operating a Digital Asset Trading Facility and providing custody services, subject to conditions. On 7 June 2023 Zhou announced that the trading facility and custody license had been granted.

The framework then changed under it. AFSA restructured its rules for digital asset trading facilities, and Binance crypto exchange and Bybit later moved into the full regulatory regime. AFSA’s 2024 review confirms that both transitioned from its FinTech Lab sandbox to full regulatory status. The Bybit crypto exchange serves Kazakhstan through a local platform at bybit.kz.

Canada and the UK: two exits

In the same months, the exchange walked away from two markets. In June 2023 the company said it would leave Canada, citing regulatory changes. On 22 September 2023 it announced it would stop serving the UK, pausing new accounts from 1 October and new deposits and positions from 8 October. The trigger was the UK’s new financial promotion rules, which require crypto promotions to follow a permitted legal route; FCA registration is not the only route. The exchange was not registered with the FCA.

These exits matter in any honest license history. A table of approvals shows where a firm got permission. It does not show where the firm decided permission was out of reach for now.

For teams communicating regulatory changes, read our crypto PR guide for the communication and media-planning process.

2024: Dubai’s provisional approval

The VARA register entry for Bybit Fintech FZE records an In-Principle Approval dated 21 August 2024, announced by the company in September. It is an application-stage approval for exchange services. Non-operational means exactly that: it could not yet serve customers under the license. VARA itself made this point in February 2025, stating that the exchange had not been granted a licence in Dubai and was still working through its licensing requirements.

2025: India, France, the hack and the UAE

India: a fine and a return

India’s Financial Intelligence Unit imposed a penalty of ₹92.7 million in January 2025 for anti-money-laundering compliance violations, as documented in the official FIU-IND penalty announcement. The exchange briefly suspended service. In February 2025 it registered with the Indian authorities and resumed services, and full trading operations returned in September.

France: off the blacklist

On 14 February 2025 French regulators confirmed that the exchange had been removed from the AMF’s blacklist, which opened the way for its MiCA application in the EU.

The UAE: in-principle approval

On 18 February 2025 the UAE’s Securities and Commodities Authority (SCA) granted the company in-principle approval for a Virtual Asset Platform Operator License. The SCA regulates crypto on the UAE mainland, a wider scope than VARA, which covers Dubai.

21 February 2025: the hack

Three days later, on 21 February 2025, attackers took control of an offline Ethereum wallet and moved out about 401,000 ETH, valued at roughly $1.5 billion at the time. The FBI’s public alert attributed the theft to North Korea and identified the activity as TraderTraitor. The company said client assets were backed one to one, kept withdrawals open, processed more than 350,000 withdrawal requests within 12 hours and reported that activity returned to pre-hack levels within 24 hours.

The hack is not a licensing event, but it shaped how regulators and readers judge the licenses that followed. VARA said it was actively monitoring the situation, and every approval after February 2025 was granted with that incident on the record.

Licensing and technical assurance answer different questions. Read more about crypto audit services and their role in project security assessment; an audit does not guarantee custody safety or eliminate operational risk.

Austria: the MiCA license

The FMA’s authorisation notice dates the licensing decision to 28 May 2025. Bybit announced the approval and its Vienna headquarters on 29 May. The license is held by Bybit EU GmbH and lets the Bybit crypto exchange passport its services across the European Economic Area. One detail is easy to miss: Bybit EU serves the EEA except Malta, through the separate bybit.eu platform. The company formally introduced Bybit EU to the press in Vienna on 10 July 2025.

The UAE: the full SCA license

Bybit reported a full SCA Virtual Asset Platform Operator License in October 2025, following its February in-principle approval. Its December 2025 company statement also describes the full licence. This is a company source; confirm the current scope and status with the UAE authority. The company described it as the first license of this type issued by the SCA. It covers regulated trading, brokerage, custody and fiat conversion for retail and institutional clients across the UAE. Do not infer a separate operational VARA licence from the federal approval; the authorities’ records and conditions must be checked individually.

2026: a separate European payments licence

Austria’s FMA granted Bybit Payments GmbH an electronic money institution licence on 4 August 2026, according to its official payments-licence notice. This entity and permission are separate from Bybit EU GmbH’s MiCA authorisation; neither licence should be described as covering every Bybit product.

What each license actually permits

The approvals differ more than the headlines suggest, so it helps to set them side by side.

The Austrian MiCA authorisation covers custody and administration, crypto-to-fiat and crypto-to-crypto exchange, placing and transfer services. Cross-border provision relies on passporting notifications. The company’s EU launch guide excluded Malta at launch; check current eligibility rather than treating that launch restriction as permanent.

The SCA license in the UAE is broad. It covers regulated trading, brokerage, custody and fiat conversion, for both retail and institutional clients, across the UAE mainland.

The AFSA license in Kazakhstan is narrower and tied to a place. It covers a digital asset trading facility and custody inside the Astana International Financial Centre, a special zone with its own regulator and its own common-law courts.

The Indian registration is a different kind of approval again. Registration with the Financial Intelligence Unit is an anti-money-laundering requirement. It brings reporting duties, not a full conduct framework of the kind MiCA imposes.

Read more about the distinction between registrations and operating licences in our guide to the LBank crypto exchange.

The Dubai approval, for now, permits nothing operational. It records that the application has progressed.

Read together, the map shows a company that put Europe and the UAE first, kept a foothold in Central Asia through the AIFC, and announced withdrawals from Canada and the UK in 2023. The UK history also includes a December 2025 relaunch.

Bybit crypto exchange license timeline

Date	Jurisdiction	Regulator / authority	Event	Entity
2018	Global	n/a	Exchange founded	Bybit
Mar 2023	Japan	FSA	Warning letter over unlicensed activity	Bybit
May 2023	Kazakhstan	AFSA	In-principle approval	AIFC entity
Jun 2023	Kazakhstan	AFSA	Trading facility and custody license announced	AIFC entity
Jun 2023	Canada	n/a	Exit announced	Bybit
Oct 2023	UK	FCA rules	Services paused, exit	Bybit
Aug 2024 (announced Sep)	Dubai	VARA	Provisional, non-operational approval	Dubai entity
Jan 2025	India	FIU	Fine of about $1 million	Bybit
Feb 2025	France	AMF	Removed from blacklist	Bybit
Feb 2025	India	FIU	Registration, services resumed	Bybit
Feb 2025	UAE	SCA	In-principle approval	UAE entity
Feb 2025	Global	n/a	About $1.5bn ETH hack (Lazarus)	Bybit
May 2025	EU / EEA	FMA (Austria)	MiCA authorisation: decision 28 May, company announcement 29 May	Bybit EU GmbH
Oct 2025	UAE	SCA	Full VA Platform Operator License	UAE entity
Dec 2025	UK	Financial promotions framework	UK relaunch announced	UK offering; check current terms
Aug 2026	Austria	FMA	Electronic money institution licence	Bybit Payments GmbH

Entity names are shortened. Each regulator’s register shows the exact legal name.

Reading the Bybit crypto exchange licenses carefully

Provisional is not operational. The Dubai approval of 2024 did not allow the exchange to serve customers, and VARA said so publicly. Check the status field on the register, not only the regulator’s name.

Read more about approval stages and license conditions in our guide to the OKX crypto exchange.

Two UAE regulators exist. VARA covers Dubai, while the SCA covers the UAE mainland. The full UAE license comes from the SCA, so a statement about one does not automatically describe the other.

The EU license has its own platform. Bybit EU GmbH runs the official Bybit EU platform for eligible EEA customers. A European customer on the global site is not automatically inside the MiCA perimeter.

Exits and returns are part of the record. The UK suspension in 2023 must be read alongside the company’s 18 December 2025 UK launch announcement. That announcement does not establish that every global product is available to UK residents.

And no license removes market risk. Supervision governs how a firm behaves, not the result of a trade.

For teams explaining approvals to customers, our guide on how to build a crypto brand people trust and remember provides a related branding framework. Communicate the authorised entity and service scope precisely.

How to verify a Bybit crypto exchange license yourself

Check the official registers for the exact contracting entity: Austria’s FMA and ESMA for Bybit EU GmbH, the UAE federal authority for the local operator, VARA for Bybit Fintech FZE, AFSA for Bybit Limited and FIU-IND for the Indian reporting entity. Match the legal name, licence status, permitted activities, service restrictions and date; a brand name alone is insufficient.

Read more about presenting these distinctions in customer-facing materials in Sigma’s guide to crypto content marketing. Clear explanations should link back to the underlying regulatory evidence.

For project teams assessing exchange access, read Sigma’s guide to token listing services for application preparation and exchange due diligence. An exchange licence does not guarantee a token listing.

FAQ

Is the Bybit crypto exchange licensed?

Yes, in several jurisdictions. Its group holds an EU MiCA license from Austria, a full Virtual Asset Platform Operator License from the UAE’s SCA, an AFSA license in Kazakhstan’s AIFC and a registration with India’s FIU.

Which country issued the Bybit MiCA license?

Austria’s Financial Market Authority issued the authorisation by decision dated 28 May 2025. Bybit announced it on 29 May. The holder is Bybit EU GmbH.

Is Bybit licensed in Dubai?

VARA’s register records an In-Principle Approval dated 21 August 2024, rather than an operational VASP licence. Bybit separately reported a full federal SCA licence in October 2025. These are distinct permissions.

Is the Bybit crypto exchange available in the UK?

Bybit paused UK services in October 2023 and announced a UK relaunch on 18 December 2025. Check the current UK terms and product restrictions; a relaunch is not a licence for all global services.

What happened in the February 2025 hack?

On 21 February 2025 attackers linked to North Korea’s Lazarus Group stole about $1.5 billion in ETH from an offline wallet. The company kept withdrawals open and said client assets remained backed.

Does a license make trading on Bybit safe?

No. A license governs how the firm is supervised. Market, leverage and operational risk remain with the user.

Disclaimer: Financial markets, including crypto, forex, futures, derivatives and leveraged trading, involve risk. This content is for informational and strategic purposes only and does not constitute financial advice. Sigma does not manage user funds, trade on behalf of users, or guarantee profits, withdrawals, listings or financial outcomes. Sigma is not affiliated with Bybit. Sources linked in this article were reviewed on 3 October 2026. Licence status and product availability may change. Always confirm a license on the regulator’s official register.