Deribit’s governance disclosures identify named leaders, a VARA-regulated Dubai entity, several custody arrangements, and reported security certifications. They do not, by themselves, prove that controls work as intended. The central questions for a client or counterparty are which Deribit entity serves the account, who holds the assets and keys, what reserve evidence is available now, and how the applicable terms allocate withdrawal and loss risks.
This review reflects Deribit’s published materials as of 7 October 2026. Company descriptions establish what Deribit reports about its governance, controls, and regulatory arrangements; they are not independent verification of operational effectiveness. The conclusions below concern the disclosed framework, not evidence of a particular incident.
As an Amazon Associate I earn from qualifying purchases.
Who is accountable, and what does the governance disclosure establish?
Deribit’s governance disclosure names Johan Spijksma as Chairman of the Board; Luuk Strijers as CEO and a board director; and Shaun Fernando as CRO and a board director. It identifies Willem Meijer and Dennis Dijkstra as non-executive directors, with governance and strategy remits respectively. The disclosure names Lana Arkoush as Head of Compliance and says Viola Gonsalves became MLRO of Deribit FZE effective 29 December 2025. These are company-published role descriptions reviewed on 7 October 2026, not an independent assessment of how the individuals perform those duties.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Conflict controls are described, but outcomes are not published
The same disclosure describes a conflicts register, periodic review, an annual board review—or more frequent review when a potential new conflict arises—employee declarations about personal account dealing and outside business interests, compliance pre-approval for outside interests, mandatory policy training, and whistleblowing routes. It says unresolved conflicts are disclosed to clients: “If a conflict cannot be adequately managed, Deribit will disclose the conflict to the client.” The reviewed material does not provide an incident count, case outcomes, or independent evidence that these procedures operated effectively.
#1 Best Overall
Which entity and regulatory perimeter applies to an account?
Deribit’s governance disclosure says Deribit FZE is authorized and regulated by Dubai’s Virtual Assets Regulatory Authority (VARA) for virtual-asset exchange and broker-dealer services under reference VL/23/12/002. The stated scope covers specified VA spot and exchange-traded derivative services for retail, qualified, and institutional investors, limited to VA-to-VA transactions, deposits, and withdrawals. The disclosure says the license does not cover fiat transactions, deposits, or withdrawals.
The FZE rulebook describes spot brokerage and derivatives including perpetuals, futures, options, and options on futures, as well as certain real-world-asset perpetual contracts. It also describes a different role when a member chooses a third-party custodian and delegates collateral management: Deribit may act as a limited agent for margining, liquidation, and settlement instructions, without private-key access or custody responsibility for that member-chosen custodian.
Access restrictions depend on the customer and serving entity
Deribit’s restricted-jurisdiction list, updated 6 October 2026, includes the United States and Canada, among other locations. It says UK retail clients are not allowed; UAE retail investors may trade spot products only; and Panama retail investors may trade spot products only. Access can also depend on residency, incorporation, client classification, and which entity serves the account. Deribit’s onboarding materials distinguish FZE and DRB Panama, so a general description of the platform should not be mistaken for the terms or permissions applicable to every account. Check the current restricted-jurisdiction list and identify the contracting entity before opening or using an account.
Who holds the assets and controls the keys?
Deribit’s custody options page, updated 14 July 2026, describes several custody models, including Deribit custody and institutional or off-exchange custody and settlement options. It names BitGo, Copper, Fireblocks, Komainu, Sygnum, and Zodia among the providers. The detailed arrangements vary by onboarding entity and setup; the provider list should not be read as confirmation that every provider or model is available to every customer.
For Deribit FZE, that page describes assets held in a combination of Coinbase custody or self-custody and cold self-custody, with under 10% in self-custody and under 1% with third-party custodians in the page’s dated snapshot. Separately, Deribit’s 27 August 2026 announcement says approximately 90% of client assets had migrated to Coinbase custody since Coinbase completed its acquisition in August 2025. These are company-reported figures from different disclosures, not independently confirmed measures or guarantees about an individual account’s asset location. The custody page’s allocations are a snapshot, not a permanent property of each account.
Deribit FZE’s membership terms, effective August 2026, say client assets in Deribit custody are segregated from Deribit’s own assets and may be held across hot, warm, and cold wallets, directly or through third-party custodians. Members do not directly know or access the private keys for assets held in Deribit custody. A client-selected third-party custodian is a distinct arrangement: the FZE rulebook says Deribit’s described limited agency in that case does not confer key access or custody responsibility.
What changed when daily Proof of Reserves ended?
In its 27 August 2026 announcement, Deribit said it would discontinue its public daily Proof of Reserves page from 1 September 2026 as wallet infrastructure changed during integration with Coinbase. Deribit described the former system as a privacy-preserving binary Merkle tree: client balances were hashed so aggregate liabilities could be compared with published wallet balances. The company characterized the daily publication as voluntary and said clients and counterparties may request audited financial statements and other due-diligence materials.
The same announcement says the VARA framework requires reserve assets of at least 100% of client liabilities, segregated client assets, an independent external Proof of Reserves audit at least annually, and an annual financial-statement audit. Deribit says its independent Proof of Reserves audits will continue twice a year. These are Deribit’s descriptions of the framework and its audit cadence; the announcement does not include the underlying audit reports or independently confirm the reported reserve position.
Best Value
The practical change is about the frequency and public availability of evidence: a twice-yearly independent audit is not the same as a daily public check. If daily visibility matters to a risk decision, ask what current evidence is available, what period and assets an audit covers, and whether liabilities are included in the method. Deribit says those materials may be requested, but does not make them public in the announcement.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What security assurance does Deribit report?
Deribit’s certifications page summarizes assurance milestones and a penetration test. The page is Deribit-authored; the underlying certificate scopes, reports, and assessment materials are not included on the reviewed page.
| Reported item | What Deribit says | What the reviewed page does not establish |
|---|---|---|
| ISO 27001 | Certification in October 2023 and annual recertification in July 2024. | The certificate scope or current validity details. |
| SOC 2 | Type I in February 2024 and Type II in November 2024. | The report, covered systems, examination period, or any exceptions. |
| CCSS | CCSS Level III certification. | The complete assessment or its scope and date. |
| Penetration test | Deribit says Secura performed its 2024 annual test, found no critical, high, or medium-risk flaws, and that minor issues were addressed. | The complete report, test scope, methodology, or evidence about security after that test. Deribit says clients may request a copy. |
These reported signals are useful starting points for due diligence, not a substitute for examining their scope and dates. In particular, the reported penetration-test result applies to the stated test and period; it should not be generalized into a claim that no vulnerabilities exist now.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →What withdrawal and loss risks appear in the FZE terms?
Deribit FZE’s membership terms describe whitelisted withdrawals and say that an instruction may be delayed by up to 24 hours when assets must be moved from cold storage to complete it. The same terms disclaim liability for certain losses, subject to stated exceptions, and say losses from theft, hacking, or another cyberattack affecting assets custodied with Deribit may be allocated proportionally among affected members. These are contractual provisions, not a prediction that a loss will occur. The precise effect depends on the applicable terms, custody arrangement, and any supplemental agreement.
What should a client or counterparty verify before relying on the disclosures?
- Contracting entity and eligibility: Confirm whether the account is with Deribit FZE, DRB Panama, or another entity, and check the current jurisdiction and client-classification restrictions.
- Custody and collateral: Identify the custodian, who controls keys, how collateral is held and managed, and whether Deribit has only the limited agency role described for a client-selected custodian.
- Reserve and financial evidence: Ask for the latest available Proof of Reserves audit, audited financial statements, and an explanation of the assets, liabilities, and period covered. Deribit says counterparties may request due-diligence materials; the public announcement does not provide those reports.
- Assurance scope: Request current certificate details and the relevant SOC, CCSS, or penetration-test materials, then check the systems covered, examination or test period, exceptions, and validity dates.
- Operational and contractual terms: Read the applicable withdrawal, delay, liability, loss-allocation, and supplemental custody or account-control provisions rather than relying on a general platform description.
Deribit’s published governance materials make the main dependencies visible, but they leave important questions for account-specific verification. The decisive evidence is the current contract and custody setup for the relevant entity, together with the scope and date of the audits and security materials available for review.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
