ESMA says the largest prediction markets have no EU authorisation

What happened

The European Securities and Markets Authority published its second Report on Trends, Risks and Vulnerabilities of 2026 on 10 September, a 58 page document numbered ESMA50-1949966494-4282. The accompanying news item quotes the chair, Verena Ross: 'Investor optimism continues to support elevated valuations despite rising geopolitical tensions and a weakening economic outlook. The wider this gap becomes, the greater the risk of an abrupt market correction.' Two of the report's in-depth sections are on this beat. The first is headed 'Tokenisation of equities: From visibility to viability?' and gives the market a size. 'Available public data point to rapid growth in outstanding asset value, from approximately EUR 0.3bn at end-2024 to around EUR 1.9bn by end-June 2026, representing a 6.5-fold increase over eighteen months', with activity 'concentrated in a limited number of large US-listed technology firms, reflecting their market capitalisation, high liquidity, and broad investor familiarity'. A footnote names the venues: 'Robinhood and Kraken offer tokenised equities that provide easier access to predominantly US-based tech stocks for EU investors, by repackaging US economic exposure into an EU-accessible instrument.' The report's structural finding is about what is being sold. Tokenized equities 'have predominantly developed through wrapped structures (whereby tokens represent a claim on, or economic exposure to, underlying shares held by a trusted party) offered by specialised platforms, while native issuance (where issuers tokenize their own shares directly on DLT) remains rare'. Because legal ownership remains off-chain, 'token transfers do not convey legal title, meaning that key benefits of DLT, such as a DLT-based single source of truth or direct investor ownership through self-custodial wallets, are only partially realised'. Settlement is hybrid rather than atomic in practice: 'While the token transfer may happen on chain, cash settlement often remains off-chain via conventional payment systems, requiring reconciliation between infrastructures.' And the market-structure warning is about fragmentation: 'Tokenisation may lead to the coexistence of multiple representations of the same underlying equity across different platforms. Where these are not fully fungible, liquidity may become fragmented across venues and legal frameworks. This could affect price discovery, market depth and execution quality, particularly in periods of stress, while thinner liquidity may increase susceptibility to market manipulation.' The second section is headed 'Prediction markets: relevance from a securities market perspective' and its central sentence is a statement about authorisation. Event contracts may be financial instruments under MiFID II, may fall within MiCA where they are DLT-based and are not financial instruments, or may be gambling products under national law; 'As a result, the marketing and sale of event contracts in the EU generally requires an EU authorisation, which the largest prediction market platforms currently do not hold.' Where they are financial instruments they are derivatives and fall within the national product intervention measures on binary options, 'under which their marketing, distribution and sale to retail investors are prohibited'. That reading rests on ESMA's own public statement of 3 July 2026, which says the same in terms and adds that 'The commercial name provided by firms' is irrelevant to the MiFID II categorisation. The regulator then questions the platforms' own controls. 'Both Polymarket and Kalshi state on their websites that users located in some, but not all, EU countries are prohibited from placing orders. It is unclear why all EU Member States are not included in the list of restricted jurisdictions', and 'Most importantly, such geographic restrictions do not prevent users located in the EU from accessing prediction market services through the use of VPNs.' The section carries numbers. Quarterly trading volumes by the fourth quarter of 2025 were about USD 8.8bn on Kalshi and USD 12bn on Polymarket. Sports account for 73 per cent of identified trading on Kalshi; on Polymarket politics is the largest category at 29 per cent, then sports at 19 and crypto at 15. The chart notes date the underlying data: Kalshi as of 25 November 2025, Polymarket as of 31 January 2026. On market integrity it lists incidents rather than assertions: newly created wallets that reportedly made USD 1.2mn shortly before the February 2026 strike on Iran became public; a US soldier criminally charged over bets placed on Polymarket ahead of the capture of Nicolas Maduro; and suspected tampering in April 2026 with the weather sensors used to settle Polymarket weather contracts, which prompted Meteo-France to file a police complaint. It cites a Wall Street Journal analysis finding that 67 per cent of profits on Polymarket accrued to 0.1 per cent of accounts. It records the institutional side too: ICE committed up to USD 2bn to Polymarket and became the exclusive global distributor of its event-driven data, Cboe launched prediction-style products on the closing level of the S&P 500 in June 2026, Nasdaq has SEC approval for prediction market options on the Nasdaq-100, and the SEC is reviewing prediction market ETF proposals from Roundhill, GraniteShares and Bitwise. Malta is named as 'the first EU Member State to publicly explore a dedicated regulatory framework for prediction markets'. Elsewhere in the report, decentralised finance total value locked fell 38 per cent in the first half of 2026 to EUR 70bn, which ESMA attributes to price falls and to outflows after the KelpDAO exploit of 18 April, in which attackers minted around USD 290mn of unbacked rsETH through a cross-chain bridge and borrowed against it, triggering an estimated USD 10bn to 15bn of withdrawals across interconnected protocols.

Why it matters

ESMA has done the thing the argument about tokenized equities has mostly lacked, which is to say how big the market is and what it is made of, and the composition is more interesting than the size. EUR 1.9bn is nothing against European equity markets. But almost all of it is wrapped exposure to a handful of large American technology stocks, sold to European investors by two non-EU venues. That is not the tokenization of European capital markets. It is a distribution channel for American ones, running on a legal structure in which the person holding the token holds a claim on a custodian rather than a share, and the regulator has now said so in a numbered document. The fragmentation argument is the one worth carrying forward, because it inverts the usual pitch. Tokenization is sold as a way of pooling liquidity across time zones and venues; ESMA's point is that as long as the representations are not fungible, each new venue that wraps the same share divides the book rather than deepening it, and the damage shows up in price discovery and in resilience under stress rather than in headline volumes. This corpus has the live instance. Nasdaq put $100m into Kraken's parent on the same date as this report, explicitly to build native tokenized equities, and Kraken is one of the two venues ESMA names as selling wrapped ones. A native token and a wrapped token on the same underlying are precisely the two non-fungible representations the report is describing. On prediction markets the finding is narrow and consequential: the largest platforms hold no EU authorisation, and under one of the three possible characterisations they could not sell to retail investors even if they did. Set that against the American position this corpus has tracked all year. In the United States, Kalshi is a CFTC-designated contract market and the fight is federal against state, with the venue winning on preemption in most of it. In Europe there is no federal licence to win: the same product could be a MiFID II derivative, a MiCA crypto-asset or a bet under national gambling law, and the first of those brings with it a retail prohibition that has been in force since 2018. The geo-blocking passage is the sharpest thing in the section because it is about enforcement rather than classification. A restricted-jurisdictions list that covers some member states and not others is, ESMA is saying, a compliance artefact with no coherent legal theory behind it, and one that a VPN defeats in any case. That is a regulator telling two venues that it does not believe their perimeter is real. What it does not do is act, and that gap is the story of European supervision of offshore venues generally: the report names the firms, states the legal position and stops. Finally, the KelpDAO passage deserves attention beside the headline sections, because it is the same failure the Liquid Network suffered on 6 September: a bridge or verification flaw that mints an asset nobody backed, which is then used as collateral or converted before anyone notices. In both cases the loss is not borne by the protocol that had the bug but by the lenders and holders downstream of it, which is what ESMA means by interconnectedness and is why a 38 per cent fall in total value locked follows a single exploit.

What is not settled

The prediction market data stop long before the report does. The quarterly volume chart ends in the fourth quarter of 2025, on Kalshi data as of 25 November 2025 and Polymarket data as of 31 January 2026, in a document published on 10 September 2026, so a reader is being shown a picture between seven and ten months old of a market the report itself describes as growing fast. ESMA also says its data 'mainly reflect global market activity and do not permit an assessment of EU retail participation', which means the central finding that prediction markets have not gained traction in the EU is not measured at all; it is inferred from the absence of a licence and offered as a possible explanation rather than a demonstrated one. Nothing in the report says what ESMA or any national competent authority intends to do about platforms it says are unauthorised. No firm is put on notice, no deadline is set and no enforcement is mentioned. Whether a given event contract is a financial instrument, a crypto-asset under MiCA or a bet is left to a case-by-case assessment that the report and the July statement both place on the firm itself, which is an odd place to put it when the conclusion determines whether a retail prohibition applies. The tokenized equity figures have no stated source beyond 'available public data', and the two endpoints given do not produce the multiple given: EUR 0.3bn to EUR 1.9bn is a factor of 6.3, not the 6.5 printed, so at least one endpoint is rounded and neither is precise enough to be checked. The report says nothing about how much of the EUR 1.9bn is held by investors in the European Union rather than elsewhere. On the exchanges it lists as showing interest in prediction-style products, it does not say whether any of them has applied for anything in the EU, and on Malta it records an expression of interest from March 2026 with no framework yet in existence. And this desk read the report itself in full, from the publisher's own address; the trade coverage of it is thinner than the document in both directions, with one outlet behind a subscription after its opening paragraphs.