A Dubai company can hold a trade license and still have no permission to operate a crypto exchange. Shelbit is the kind of case that shows why the distinction matters.
On July 24, Dubai’s Virtual Assets Regulatory Authority published a notice of fines against Shelbit General Trading L.L.C., which it says operated commercially as Shelbit or Shelbit Exchange. VARA said the entity continued providing virtual-asset services without a valid regulatory license, onboarded users without mandatory KYC checks, and marketed in Dubai without authorization.
A Reuters investigation published July 31 then linked the exchange to a much larger Iran-related gambling and sanctions-evasion network. Those broader allegations remain reporting, not a Robius finding or a court judgment. The official Dubai enforcement record is already enough for a clear consumer decision.
| T H E R O B I U S V E R D I C T CAUTION: Unlicensed, fined, and directed to cease and desist. Do not deposit money or crypto with anyone presenting Shelbit as a Dubai-authorized exchange. VARA’s notice is direct and current. It says Shelbit continued unlicensed virtual-asset activity, failed mandatory KYC requirements, and marketed without authorization. The safest action is to stop, preserve evidence, and verify any claimed replacement entity independently. |
What the Dubai Regulator Confirmed
VARA identifies the exact legal entity as Shelbit General Trading L.L.C. and says it operated under the names Shelbit and Shelbit Exchange. This matters because a brand name is not the regulated entity. The legal name is what must appear on a public register or enforcement notice.
The July notice follows an earlier cease-and-desist action dated January 2, 2025. VARA said its market monitoring found that the entity continued to provide virtual-asset services to customers in and from Dubai without holding a valid regulatory license.
The regulator also said Shelbit onboarded users without mandatory Know-Your-Customer checks and marketed its services in Dubai without authorization. VARA imposed financial penalties and directed the entity to stop all unlicensed virtual-asset activity in or from Dubai immediately.
Why a General Trading License Is Not Enough
The name “Shelbit General Trading L.L.C.” may sound like a locally registered company. That does not make it a licensed virtual-asset service provider. A commercial registration can permit ordinary corporate activity, while a separate financial regulator decides whether the entity may hold, exchange, transfer, broker, or manage customer crypto.
For Dubai virtual assets outside the DIFC, the relevant authority is VARA. The Robius five-minute license check explains the core rule: search the exact legal entity, verify the activity category, and do not treat a regulator logo or company certificate as proof.
A legitimate exchange should be able to tell a customer which legal entity opens the account, which regulator supervises it, which activities are licensed, and where the record appears. If the answer changes depending on who asks, stop.
What Reuters Added
Reuters reported on July 31 that blockchain analysts and investigative firms had identified at least $4 billion in transactions moving through wallets linked to Shelbit since May 2024. The report connected those flows to Iranian gambling websites, sanctioned entities, and state-linked financial infrastructure.
Those are serious allegations, but precision matters. Reuters said it could not determine that the Islamic Revolutionary Guard Corps directly controlled Shelbit or establish the final destination of all funds. Robius is therefore not presenting the full $4 billion as proven criminal proceeds or claiming a court has found Shelbit guilty of every alleged link.
Reuters also reported that Shelbit had no identifiable public website at the time and described an office visit where occupants said they did not know the founder. Those details reinforce the transparency concern, but the Robius verdict does not depend on them. VARA’s official unlicensed-activity finding is sufficient.
Do Not Let a Familiar UAE Address Reassure You
Fraudulent and unlicensed operators often borrow credibility from Dubai. They may use a local address, an L.L.C. suffix, a serviced office, a UAE phone number, or a company registration document. None of those proves authorization to offer a regulated financial service.
The Bybit UAE licensing review shows the opposite side of the same issue. Even a well-known platform with a real UAE license must be checked for jurisdiction, entity, and customer eligibility. The brand alone never settles the question.
The BitOasis regulatory history also shows why license status can change. A platform that was once allowed to operate may face suspension, remediation, or new conditions. A live register check beats an old screenshot.
What to Do if Someone Approaches You
Do not send a test deposit. A small successful withdrawal is not proof that a platform is licensed or safe. It can be used to build trust before a larger transfer is requested.
Do not install remote-access software, share a wallet seed phrase, or approve a transaction because an “account manager” says it is required for verification. Legitimate KYC checks do not require control of your device or access to your private keys.
Save the website address, phone numbers, wallet addresses, payment receipts, chat logs, names used, and any claimed license document. Report the approach to VARA and, where money has moved or fraud is suspected, contact the relevant UAE police channel and your bank or exchange immediately.
If the person says Shelbit has moved to another company, treat that as a completely new claim. Search the new legal entity from the beginning. The Rain Gulf license review demonstrates what verifiable multi-jurisdiction licensing looks like when the entity names and categories can be checked.
Why the Verdict Is CAUTION, Not SCAM
Robius reserves SCAM for cases where the evidence supports that conclusion directly. Here, the regulator has confirmed serious unlicensed conduct and imposed enforcement measures. Reuters has reported extensive alleged links to illicit flows. But VARA’s notice is framed as an enforcement and consumer-information action, not a criminal conviction for every allegation in the investigation.
CAUTION is still a stop sign. It does not mean “probably fine.” It means the platform fails the basic authorization test and a consumer should not proceed. The Robius explanation of legal-but-risky verdicts explains why legality, licensing, conduct, and trust are separate questions.
The Bottom Line
Shelbit is not on the safe side of a technicality. Dubai’s virtual-asset regulator says the entity continued providing services without a valid license, onboarded users without required KYC, and marketed without authorization after earlier enforcement.
Do not deposit. Do not accept a claimed replacement company without a fresh register check. And do not confuse a Dubai company registration, address, or trading name with permission to operate an exchange.
Sources
- VARA: Official July 24, 2026 notice of fines against Shelbit General Trading L.L.C., including the unlicensed-activity, KYC, marketing, penalty, and cease-and-desist findings.
- Reuters: July 31 investigation into the alleged gambling, sanctions-evasion, and cryptocurrency network involving Shelbit-linked wallets.
- VARA Public Register: Live register used to distinguish licensed Dubai VASPs from companies that only claim local status.
This is not financial advice.
Robius.news — Dubai, UAE — 2026 | Built to be first. Built to be trusted.
