Regulator warns of insider trading risks in expanding prediction markets

ESMA flags insider trading risk as prediction markets expand beyond US borders

The $1.2 million appeared in accounts that did not exist before the February 2026 military operation against Iran. By the time anyone looked closely, the operation was over and the profits were gone. The European Securities and Markets Authority documented this in its Trends, Risks and Vulnerabilities report, alongside a second case: a US soldier facing criminal charges for allegedly using classified information about the capture of Nicolás Maduro to place bets on Polymarket. ESMA's point was not that these incidents were isolated. Its point was that they were detectable only in hindsight.

The report is the most significant signal yet that European regulators are preparing to treat prediction markets as a financial stability question rather than a novelty. ESMA's concern is structural: platforms can freeze accounts and investigate suspicious trades, but the freeze typically comes after resolution and after profit. The information advantage that makes insider trading lucrative in equity markets is, if anything, more acute in prediction markets, where a single piece of non-public information about a discrete event can move a binary contract from near-zero to near-certain in hours.

What ESMA has done here — and I think the reporting understates this — is establish a supervisory posture before a regulatory framework exists. That sequencing matters. When a major regulator names the risk in a formal publication, it is staking out jurisdiction. The specific mechanisms ESMA described, account freezes, post-hoc investigation, CFTC manpower constraints, read less like a critique of American enforcement and more like a case for European authority over markets that European citizens can access via VPN regardless of where the platform is incorporated.

Malta is the detail worth watching. If a single EU member state establishes a dedicated prediction market framework, it creates a regulatory passport question that ESMA will not be able to defer. A licensed Maltese prediction market operator would have grounds to argue equivalence across the bloc. ESMA knows this. The report arrives before Malta's framework does, which is not coincidence.

The consensus read on European prediction market risk is that geography is a meaningful constraint — that Kalshi and Polymarket's EU restrictions hold, that the market stays small, that this is an American regulatory problem. I don't think that holds. The VPN disclosure in the ESMA report is not a footnote; it is an admission that the geographic restriction is already permeable. ESMA is telling you that the enforcement model it would inherit is broken before it has been built. The question is whether Brussels addresses that with rules that open the market under supervision or rules that harden the perimeter — and the Malta development suggests at least one member state has already made its choice.