Dubai Just Became the First Regulator to Formally Ban XT.com

Most crypto exchange red flags accumulate quietly — a cluster of Trustpilot complaints here, a security audit that scores lower than it should there. XT.com’s 2026 problem was louder and more specific: Dubai’s Virtual Assets Regulatory Authority (VARA) formally flagged the exchange for operating without a license, making it the first regulator anywhere to take that kind of direct action against the platform. For an exchange that’s built real scale — over 1,000 listed coins, a user base spread across 100+ countries — that’s a genuinely notable moment worth unpacking rather than glossing past.

What XT.com Actually Is

Launched in 2018, XT.com has grown into a mid-tier global exchange offering spot trading, futures with leverage up to 125x, copy trading, and one of the broader altcoin catalogs in the industry — reported counts range from roughly 800 to over 1,000 tradable assets depending on the snapshot. It operates outside a short list of restricted markets, including the United States, Canada, mainland China, and several sanctioned countries, putting it in the same general restriction category as BloFin and MEXC rather than a platform chasing US regulatory approval the way Kraken or OKX have.

The No-KYC Limit That Stands Out From the Field

This is XT.com’s most distinctive feature, and the numbers genuinely are unusual. Verification is optional for most users, and unverified accounts can withdraw up to $200,000 per day in crypto without submitting any identity documents — a ceiling dramatically higher than BloFin’s $20,000 no-KYC threshold or Grovex’s $10,000 cumulative limit. Full KYC verification exists for users who want it, unlocking withdrawal limits reportedly as high as $100 million daily, but the exchange’s own structure makes clear that verification is a convenience upgrade for a small minority of users rather than a functional requirement for the platform to work.

That’s a genuinely appealing structure for traders prioritizing privacy and speed. It’s also precisely the kind of setup that tends to draw regulatory attention, since a six-figure daily withdrawal ceiling with no identity check attached is a meaningfully larger potential channel for the kind of activity anti-money-laundering frameworks are built to catch than the lower thresholds most competitors set.

What the VARA Action Actually Means

VARA, Dubai’s dedicated virtual-assets regulator, is one of the more actively enforced crypto regulatory bodies globally, having built a reputation for requiring exchanges operating in or marketing to the UAE to hold a proper license rather than serving the market informally. Being the first regulator to formally flag XT.com for unlicensed operations doesn’t necessarily mean XT.com did something uniquely egregious compared to other offshore exchanges — plenty of platforms covered in this series, including BloFin and Grovex, operate in a similar regulatory gray zone without yet facing a comparable formal action. It does mean XT.com became the test case, which carries its own weight: once one regulator moves, others reviewing similar unlicensed-exchange situations in their own jurisdictions tend to pay closer attention to precedent.

For users, the practical implication isn’t that XT.com has become unusable overnight — the platform continues operating normally in the markets where it’s accessible. It is a concrete signal that XT.com’s regulatory standing is actively under scrutiny rather than settled, and that status is worth factoring into how much of a balance anyone keeps parked there versus actively trading.

The Security Audit Score Worth Knowing

Independent security assessment firm CER.live has rated XT.com’s overall security posture at a CCC grade, translating to roughly a 51% composite score in its audit framework — a middling result that lands well below the ratings typically given to more established platforms like Kraken or OKX. XT.com does maintain the standard baseline protections — two-factor authentication, cold storage, anti-phishing codes, withdrawal whitelisting, and an annual security audit cycle — and has avoided any major disclosed breach or customer-fund loss to date, which is a genuine point in its favor. But a CCC rating paired with no deposit insurance and limited reserve transparency means the platform’s security foundation is adequate rather than exceptional, a gap that becomes more relevant the larger a balance someone is considering holding there.

Fees, for Context

XT.com’s pricing sits in a fairly ordinary range for a platform this size — not a standout bargain, not notably expensive either.

Market	Maker fee	Taker fee
Spot trading	0.02%–0.10%	0.20%
Futures trading	0.02%–0.04%	0.04%–0.06%

A native XT token provides fee discounts for holders, functioning similarly to BNB on Binance or MX on MEXC. Crypto deposits are free; fiat on-ramps route through third-party providers whose fees sit outside XT.com’s direct control.

Weighing a Real Feature Against a Real Warning

XT.com’s pitch is coherent on its own terms: broad altcoin access, a no-KYC ceiling that genuinely outpaces its direct competitors, and a feature set that’s kept pace with larger exchanges despite operating without major licensing. The VARA action doesn’t erase any of that, but it does change the calculation for anyone weighing how much trust to extend the platform right now, specifically. An exchange that’s just become the first target of a formal regulatory flag is, by definition, in a more uncertain position than it was a year ago — not necessarily heading toward collapse, but not a settled, known quantity either. Treating that uncertainty as a reason to keep balances modest and withdrawal-tested, rather than as background noise to ignore, is the more defensible read of where things actually stand.

Wes Ibarra covers exchange regulatory developments as they happen — this one’s still unfolding.