ESMA Finds Prediction Markets Rife With Inside Trading and Unauthorised in EU

The EU securities regulator's risk report finds the biggest platforms hold no EU authorisation, that binary-option rules bar retail sale where contracts are derivatives, and that platform surveillance arrives only after the profits are banked.

• The European Securities and Markets Authority (ESMA) devotes an in-depth chapter of its second 2026 Trends, Risks and Vulnerabilities report, published 10 September, to prediction markets
• It says "a growing number of incidents illustrates that prediction markets are rife with inside trading", citing $1.2 million of profits on newly created wallets before the February strikes on Iran, a US soldier charged over bets on the Maduro operation, and tampered weather sensors in France
• Marketing and sale of event contracts in the EU generally requires an authorisation "which the largest prediction market platforms currently do not hold", and where contracts are derivatives they fall under national bans on binary options for retail investors
• Quarterly volumes reached about $8.8 billion on Kalshi and $12 billion on Polymarket by the fourth quarter of 2025, with sports 73% of Kalshi's identified activity
• ESMA says the sector remains "relatively limited" in the EU but warrants continued monitoring, four days before a KPMG employee was reported to face insider trading charges over Polymarket earnings bets

The EU's Markets Regulator Has Written Down Its Position

The European Securities and Markets Authority has set out in its flagship risk report how it sees prediction markets from a securities-law perspective, and the assessment is unsparing on market integrity while carefully hedged on scale.

The analysis appears as an in-depth section of the TRV Risk Monitor No. 2, 2026, published on 10 September. ESMA describes platforms where participants trade contracts linked to future events, names Polymarket and Kalshi as the major operators alongside PredictIt, Robinhood, DraftKings and FanDuel, and notes that all are based outside the European Union. Using data from the two largest platforms' APIs, it records quarterly trading volumes of approximately $8.8 billion on Kalshi and $12 billion on Polymarket by the fourth quarter of 2025, with strong growth continuing into 2026. Sports account for 73% of Kalshi's identified activity; Polymarket is more diversified, with politics at 29%, sports 19% and crypto 15%.

The report also charts the sector's integration with traditional finance: Intercontinental Exchange's commitment of up to $2 billion to Polymarket and its role as exclusive distributor of Polymarket data, CBOE's launch in June of prediction-style products on the S&P 500, Nasdaq's approval for prediction market options on the Nasdaq-100, CME's event contracts and Galaxy's institutional over-the-counter trading in instruments referencing Kalshi and Polymarket contracts.

Authorisation, Binary Options and the VPN Problem

On the legal position, ESMA is direct. Depending on their characteristics, event contracts may be financial instruments under MiFID II, fall within MiCA where they are built on distributed ledger technology and are not financial instruments, or be gambling products under national law. As a result, "the marketing and sale of event contracts in the EU generally requires an EU authorisation, which the largest prediction market platforms currently do not hold". Where contracts qualify as financial instruments they would generally be classified as derivatives and fall within national product intervention measures on binary options, under which their marketing, distribution and sale to retail investors are prohibited.

Both Polymarket and Kalshi state that users in some, but not all, EU countries are barred from placing orders. "It is unclear why all EU Member States are not included in the list of restricted jurisdictions," the report says, and in any case geographic restrictions do not stop EU users reaching the platforms through VPNs. Malta is noted as the first member state to publicly explore a dedicated framework, having described the sector in March as an area of rapid global momentum.

On integrity, the report says market manipulation and insider trading risks "reach new levels" on DLT-based platforms such as Polymarket, which operate with limited identity verification and "where the platform itself may not know who is behind a given wager". It cites newly created wallets that reportedly made $1.2 million shortly before the February 2026 US and Israeli strikes on Iran became public, the US soldier criminally charged in April for allegedly using classified information to bet on the capture of Nicolás Maduro, and the suspected tampering with weather sensors used to settle Polymarket weather contracts that led Météo-France to file a police complaint. Platform monitoring, it concludes, is "largely reactive, as investigations are often initiated only after the event has occurred and the profits have already been realised". The Market Abuse Regulation may help, "but only where prediction market contracts fall within the financial regulatory perimeter". It also cites a Wall Street Journal analysis finding 67% of Polymarket profits accrued to 0.1% of accounts, and a Bloomberg analysis that most users lose money.

The Report Answers the Question the Platforms Wanted Left Open

Prediction market operators have spent 2026 arguing in the United States that their contracts are federally regulated derivatives beyond the reach of state gambling law, and in Europe that they are something novel awaiting a bespoke framework. ESMA's chapter closes the second door. Its reading is that the existing perimeter already captures event contracts, either as MiFID II instruments, MiCA crypto-assets or national gambling products, and that on each path the largest platforms lack the authorisation they need. The binary-options point is the sharpest: where a contract is a derivative, EU product intervention bans its retail sale outright, so the "we are a financial product" argument that helps in Washington is the argument that prohibits retail access in Brussels. Spain and Italy have already blocked the platforms on gambling grounds; a securities regulator saying the same contracts fail on the financial side too leaves little room for a European launch that does not begin with a licence application.

Reactive Surveillance Is Named as the Structural Flaw, Not a Bug

The insider-trading passage lands the same week that federal prosecutors were reported to be preparing charges against a KPMG employee over Polymarket earnings bets, and that Polymarket pointed to its referrals of dozens of traders to the Justice Department as evidence of self-policing. ESMA's description of that model, monitoring that starts after the event has resolved and the winnings are paid, is a description of a system that catches the trade but never prevents it, and on a pseudonymous chain it may not identify the trader either. The report's counterpart is the Market Abuse Regulation, which imposes pre-trade obligations on venues and insiders but reaches only instruments inside the regulatory perimeter. That is the EU's implicit offer: come inside and be subject to MAR, or stay outside and be treated as an unauthorised gambling product. Neither is the light-touch regime the sector has been describing to investors.

ESMA calls the EU market small and says so twice. What it has also said is that the small market is unauthorised, and that the platforms' own surveillance is not a defence. Both statements will be quoted back at the operators.