A Dubai company name did not make Shelbit a licensed Dubai crypto exchange. VARA says Shelbit General Trading L.L.C. continued providing virtual-asset services in or from Dubai without a valid regulatory licence, even after a January 2025 cease-and-desist action.
Now the case has moved beyond local licensing. On August 7, the United States sanctioned Shelbit, alleging that the exchange processed millions of dollars in crypto for Iran’s Islamic Revolutionary Guard Corps and other Iran-linked entities. Reuters reported the designation after its own July investigation into a much larger sanctions-evasion network. Shelbit has rejected allegations that it knowingly participated in money laundering, terrorist financing, illegal gambling, sanctions evasion or activity for sanctioned or governmental organizations.
VARA had already taken enforcement action against Shelbit for unlicensed virtual-asset activity before the US sanctions designation.
UAE crypto users, OTC clients, businesses accepting digital assets, compliance teams and anyone checking whether an exchange is safe to fund.
Sanctions and regulatory enforcement are serious, but they are not the same as a court finding that every customer transaction was fraudulent.
Verify the exact legal entity on VARA or the relevant UAE regulator, then separately check current sanctions and enforcement notices before sending funds.
The useful UAE lesson is not to turn every enforcement action into the word scam. It is to understand that a company registration, a crypto license and a sanctions or AML screen are three different checks. A platform can look local and still fail the one license check that actually covers the activity it is selling.
A Trade Company Is Not a Crypto Licence
VARA is the authority responsible for regulating virtual-asset activity across Dubai, excluding the DIFC. Its July 24 notice names Shelbit General Trading L.L.C., commercially operating as Shelbit or Shelbit Exchange, and says the action followed a cease-and-desist notice issued on January 2, 2025.
The regulator says Shelbit continued to provide virtual-asset services to customers in or from Dubai without a valid regulatory license. VARA also says the entity onboarded users without mandatory know-your-customer controls and marketed virtual-asset services in Dubai without authorization.
This is why our five-minute UAE trading and exchange check starts with the regulator’s own register. A company document, office address or general-trading license cannot substitute for permission to provide the financial or virtual-asset activity being sold.
VARA Had Already Escalated the Case
VARA did not frame the issue as a paperwork mistake. Its July notice says the exposure went beyond consumer protection to cross-border transactions that could affect the integrity of the UAE financial system. The regulator imposed financial penalties and directed Shelbit to cease unlicensed virtual-asset activities immediately.
That matters because it gives UAE users a clean timeline. Local enforcement was already public before the US designation. The foreign sanctions action did not create the Dubai licensing problem. It added another enforcement layer to a problem VARA had already identified.
What the US Sanctions Change
Reuters reported on August 7 that the US Treasury sanctioned Shelbit, its founder Siavash Kayvanpour and other entities. The US alleged that Shelbit processed millions of dollars in crypto for the IRGC and other Iran-linked actors. The designation followed a Reuters investigation that identified Shelbit as a hub in an alleged multi-billion-dollar sanctions-evasion network.
Shelbit has pushed back. In a statement cited by Reuters, the company said it categorically rejects suggestions that it knowingly participated in money laundering, terrorist financing, illegal gambling, sanctions evasion or activity on behalf of sanctioned, military or governmental organizations. It also said it had ceased operations in January 2026.
Those denials belong in the record. So does the distinction between allegations, sanctions and criminal findings. A sanctions designation can have immediate practical consequences for financial institutions and counterparties without being the same thing as a criminal conviction.
Two Checks, Not One
A UAE resident evaluating a crypto platform now has at least two separate questions to ask. First: is the exact legal entity licensed for the exact activity being offered in the UAE jurisdiction where I am using it? Second: is that entity, its owners or its counterparties subject to sanctions, enforcement actions or public warnings that change the risk of dealing with it?
| Check | What it answers | Where to look |
|---|---|---|
| UAE licence | Is this exact entity authorized for this activity here? | VARA, CMA, FSRA or DFSA, depending on jurisdiction and activity |
| Enforcement history | Has the regulator fined, restricted or warned the entity? | Regulator enforcement and warning notices |
| Sanctions | Are the entity or named persons restricted by sanctions authorities? | Official sanctions lists and notices |
| Account chain | Who actually receives or holds the money or crypto? | Current customer agreement, deposit instructions and custody disclosures |
The distinction is similar to the jurisdiction problem in our Bybit UAE licence review. A licence can be real and still not answer every question about where or how a service may be offered.
What UAE Users Should Do Now
Do not send new funds to an entity after discovering that the relevant regulator has ordered it to stop the activity you want to use. If you already have money or crypto tied to a platform under enforcement or sanctions, preserve transaction records, wallet addresses, account statements and correspondence before taking further action.
Do not pay a new fee, tax, unlock charge or verification payment simply because someone claims it is required to release existing funds. Use the regulator’s official contact route, your bank or regulated exchange, and qualified legal advice where the situation is material. Sanctions questions can also create legal obligations that are not safely solved through a support chat.
For a useful contrast, our BitOasis UAE review shows why the enforcement history itself matters even when a platform later holds a valid UAE license. The point is not to erase history. It is to map it accurately.
The Robius Read
The Shelbit case is a reminder that “Dubai-based” and “Dubai-regulated” are not interchangeable. The same is true for every fast-moving financial product in the UAE.
The safest habit is boring: identify the exact entity, verify the exact permission, read the enforcement history, then run a separate sanctions and counterparty check. When those layers disagree with the marketing, trust the official record first.
Sources
- VARA: Notice of Fines – Shelbit General Trading L.L.C. – Primary Dubai regulatory enforcement notice dated July 24, 2026.
- Reuters: US sanctions Dubai crypto exchange for aiding Iran’s IRGC – Reporting on the August 7 US designation, Treasury allegations and Shelbit response.
- US Treasury OFAC Sanctions List Search – Official sanctions-list search tool for final publication-day checks.
This is not financial advice.
Robius.news — Dubai, UAE — 2026 | Built to be first. Built to be trusted.
