ESMA says Polymarket and Kalshi lack EU authorization

The European Securities and Markets Authority, in its 10 September 2026 Report on Trends, Risks and Vulnerabilities No. 2, 2026 (ESMA50-1949966494-4282), published an in-depth chapter on prediction markets. A same-day press release (ESMA71-545613100-2999) names that chapter as one of the report's selected topics.

This is a TRV risk-monitor report plus an accompanying press release. It is not an enforcement order, not a MiCA license denial, and not a ban that names a fine.

ESMA says event contracts may be MiFID II financial instruments, MiCA crypto-assets (if they sit on DLT and are not financial instruments), or national gambling products. Marketing and sale in the EU generally need EU authorisation. The largest platforms do not currently hold it. Where the contracts are financial instruments or derivatives, national binary-options product intervention measures generally prohibit marketing, distribution, and sale to retail investors.

Polymarket and Kalshi sit outside the EU, as do PredictIt, Robinhood, Pariflow, DraftKings, and FanDuel. Both platforms geo-restrict users in some but not all EU Member States, and ESMA says it is unclear why all Member States are not restricted given the risk of unauthorised service under MiFID II, MiCA, national gambling law, and those binary-options measures. The report also notes a VPN can defeat a geo-block. Platforms say VPN use is prohibited, and ESMA says the effectiveness of that rule-out is uncertain.

By Q4 2025, ESMA's charts put quarterly volume at about USD 8.8 billion on Kalshi and USD 12 billion on Polymarket. Kalshi volumes are about 73% sports, while Polymarket is more diversified (politics 29%, sports 19%, crypto 15%). The report treats EU traction as limited next to the US. Malta is publicly exploring a dedicated prediction-market framework, citing March 2026 government comments.

The same US-EU rulebook fight already sits in the Ninth Circuit's Kalshi sports-contract ruling. Other Finpresso market-structure notes include Nasdaq's $100 million Kraken stake, the SEC transfer-agent rewrite for tokenization, and the ECB deposit-rate hike to 2.50%.

If you operate, distribute, or trade on Polymarket or Kalshi from the EU, treat the 10 September TRV as a supervisory flag on missing authorisation and incomplete geo-blocks, not as a completed action against either firm, and map which Member States you still serve before assuming a VPN clause holds.