ESMA: Prediction Markets Polymarket and Kalshi Are Rife With Insider Trading

EU regulator ESMA has given prediction markets their own chapter in its latest risk monitor, calling the sector rife with insider trading. The report cites specific manipulation cases on Polymarket and Kalshi, including bets placed ahead of a strike on Iran and the capture of Venezuela's president.

According to the regulator, low adoption of prediction markets in the EU is not a lack of demand but a result of binary options rules that bar selling such contracts to retail investors almost entirely. At the same time, in the US the same platforms already process tens of billions of dollars a month, and that gap in scale is what pushed ESMA to raise the alarm publicly.

Three episodes that caught the regulator's eye

ESMA pointed to cases where bettors appeared to have information ahead of the market. The first involves Iran.

• New wallets earned $1.2 million hours before a strike on Iran in February.
• By May, analysts at Bubblemaps had traced nine linked accounts that wagered $2.4 million on Iran-related events and won 98% of the time.
• A U.S. Army master sergeant was charged over $400,000 in Polymarket profits from bets on the capture of Venezuelan president Nicolas Maduro.

Each of these cases involves a public blockchain. The trail stays there forever, unlike a traditional bookmaker where a bettor's identity is shielded by default. Bubblemaps specializes in tracing wallet activity on-chain, which is how it linked accounts that looked independent at first glance. That is exactly why researchers could trace the wallets after the fact, even though no platform flagged anything unusual at the moment the bets were placed. Three cases are not a catastrophe on their own for a market worth tens of billions of dollars, but the regulator cares less about the sum than about a pattern that keeps repeating.

April brought another episode. Suspected tampering with the weather sensors used to settle Polymarket's weather contracts prompted French forecaster Meteo-France to file a police complaint.

Platform responses, ESMA said, are largely reactive and begin only after profits have already been taken. On traditional securities exchanges, surveillance for suspicious orders runs before a trade executes. Prediction markets largely lack that kind of pre-trade check, so investigations always trail the event instead of running alongside it.

Polymarket's chief legal officer Neal Kumar drew a different lesson from the Venezuela case.

"It's not anonymous. You will be found just like this guy."

- Neal Kumar, Chief Legal Officer at Polymarket, comment on the Maduro betting case, September 2026

Why EU rules hold the market back

Event contracts can qualify as financial instruments under MiFID II, fall under MiCA, or count as gambling under national law, depending on the country. Where they count as financial instruments, they become derivatives by default. National rules mirroring ESMA's binary options intervention from as far back as 2018 then bar selling them to retail clients at all.

For a platform, that means three separate sets of requirements across three jurisdictions instead of one shared license. That is why Kalshi and Polymarket have not scaled in Europe the way they have in the US, even though appetite exists. It is simpler for the companies to block a whole region than to get licensed country by country. In the end, European users get a worse product not because of missing technology but because of the bloc's own legal fragmentation.

Trading volumes outrun the oversight data

The monitor's own figures were already outdated at publication. ESMA's chart stops in November 2025 for Kalshi and January 2026 for Polymarket, while the market itself has grown several times over since then.

The jump owes largely to the World Cup, which drove a wave of new bets on Kalshi, where sports contracts make up 73% of volume. Polymarket, by contrast, splits its volume across politics, sports and crypto markets, so its audience runs noticeably wider than a purely sports crowd. A Bloomberg analysis found that most users on both platforms end up losing money, and that finding is exactly what underpins ESMA's argument about retail risk. Compared with traditional futures exchanges, where daily turnover has been measured in billions for decades, prediction markets went from a niche product to a multi-billion-dollar segment in under two years.

Holes in the geo-blocking

Kalshi and Polymarket restrict access in some EU countries but not others, and ESMA directly asks why the list is incomplete. For a single market, that kind of selectivity looks odd. A user in one blocked country has no access while a neighbor across the border plays freely.

Both platforms ban VPNs in their terms, yet verifying a user's real location when their traffic runs through a commercial VPN service is technically difficult. So the ban stays formal rather than effective. Malta is so far the only country drafting a dedicated regulatory framework for these products, and ESMA may end up using its approach as a template for the rest of the bloc.

The US argues about rules, not a ban

The American approach is the opposite. The Commodity Futures Trading Commission (CFTC) is defending its jurisdiction against individual states and has proposed banning only a narrow category of contracts, such as bets on wars and assassinations. At the same time, the CFTC and SEC are opening the door to perpetual futures on Bitcoin and other crypto assets on regulated venues, so regulators are settling rules for the adjacent crypto market alongside the prediction market question.

In August, CME's Terry Duffy and Kalshi's Luana Lopes Lara clashed at a CFTC roundtable. The argument centered on manipulation risk, the same issue ESMA now raises, except in the US it plays out as competition between exchanges for customers rather than doubt about the product itself. For the rest of the world, this fight matters because American rules will likely become the template for jurisdictions that have not yet settled on a position on prediction markets.

The difference is simple. Europe is still asking whether retail bettors should be allowed into these contracts at all. Washington has already decided yes, and is arguing only over the details of oversight and over who exactly should run it.

What it means for the market

Prediction markets have outgrown the pace at which regulators on both sides of the Atlantic can respond. Polymarket settles part of its bets in the USDC stablecoin, which makes moving winnings nearly instant and complicates tracking suspicious wallets before the funds are already gone. The practical takeaway for an ordinary user is simple. The less transparent the settlement mechanism, whether a weather sensor or the outcome of a military operation, the higher the risk that someone learned the result before the crowd did.

• Bets on a public blockchain leave a trail that sooner or later points back to whoever ran a suspicious winning streak.
• Geo-blocks fold to an ordinary VPN, so a country-level ban changes little in practice.
• Regulatory data lags real volumes by quarters, so decisions get made against an already outdated picture of the market.

While Europe keeps debating the legal status of these contracts, US regulators have already moved on to deciding which specific events can be wagered on. The coming months will show whether ESMA's report leads to real restrictions or stays a warning without consequences.