What happened
The European Securities and Markets Authority has given prediction markets a dedicated section in its twice yearly risk report, published in September. ESMA describes them as platforms where participants trade contracts on the outcome of future events, and notes that growth, retail participation and links to crypto, DeFi, AI and social media have drawn regulatory attention worldwide.
Volume is not trivial. By the fourth quarter of 2025, quarterly trading reached roughly 8.8 billion dollars on Kalshi and 12 billion dollars on Polymarket, and every platform ESMA names is based outside the EU. Incumbents are moving in: ICE committed up to 2 billion dollars to Polymarket and became exclusive distributor of its event data, while CBOE, Nasdaq and CME Group have launched or expanded products tied to index levels and macro indicators.
ESMA's finding is that prediction markets raise a range of investor protection and market integrity concerns, and that continued monitoring is warranted. On unauthorised platforms, it says, retail users get a speculative gambling environment without the protections of regulated products, with gamified design and social media promotion that expose inexperienced users to loss and addiction risk. Insider trading risks reach new levels where identity checks are limited and participants can hold multiple accounts. It cites wallets that made about 1.2 million dollars before a February 2026 strike on Iran became public, a US soldier charged over bets on Maduro's capture, and a Meteo-France police complaint after suspected tampering with weather sensors used to settle contracts.
The EU position is restrictive but unsettled. Event contracts may be financial instruments under MiFID II, fall under MiCA where they are DLT based, or be treated as gambling nationally. Authorisation is generally required and the largest platforms do not hold it. Both major platforms block some member states, not all, a gap ESMA questions, and blocking does not stop a VPN. Malta is exploring a dedicated framework.
Why this is a GRC story
Classification is the whole control set. The same product can be a MiFID instrument, a crypto-asset under MiCA, or gambling, and each route brings different obligations. Firms entering this space are not choosing a feature, they are choosing a regime, and the file that justifies that choice is what a supervisor will ask for.
Data sources are settlement controls. Weather sensor tampering is the clearest example in the report. If a contract pays out on a third party feed, that feed's integrity is a financial control, not an IT detail, and belongs on the risk register next to market risk.
Monitoring is reactive by design. ESMA notes that platform measures to freeze suspicious accounts usually trigger after the profit has been taken. Compliance teams inherit the same weakness when surveillance is built around post trade alerts rather than identity assurance and pre trade limits. A geo-block is also a control you test by attempting the bypass and recording the result.
What to watch
Whether ESMA issues classification guidance that tells firms which regime applies, and whether the Market Abuse Regulation perimeter is extended to contracts that currently sit outside it. Malta's framework will be the first EU template, so its scope is worth reading closely. Once prediction style products sit inside regulated exchanges, the argument shifts from whether these markets should exist to how their events are defined and resolved.
Attribution: Analysis based on ESMA, Trends, Risks and Vulnerabilities Report No. 2, 2026 and related public reporting. This article is original commentary, not a repost of the source material.