ESMA warns VPNs can bypass Polymarket and Kalshi location blocks in the EU

The European Securities and Markets Authority (ESMA) has said that virtual private networks allow users to circumvent the geographic restrictions of prediction-market platforms Polymarket and Kalshi, according to a chapter of its latest trends, risks and vulnerabilities report. The report was published on 10 September. ESMA said that offering these event contracts in the EU generally requires an EU authorisation that the largest prediction-market platforms do not currently hold.

The report states that all the large platforms it names, including Polymarket, Kalshi, PredictIt, Robinhood, DraftKings and FanDuel, are headquartered outside the EU. Depending on the type of contract, ESMA said, the products may be financial instruments subject to MiFID II, cryptoassets subject to MiCA, or gambling products regulated under national law. If treated as financial instruments, they would be derivatives covered by measures prohibiting the sale of binary options to retail investors.

ESMA questioned the effectiveness of the geographic blocks. Polymarket and Kalshi bar users in some but not all EU countries, and the regulator said it was unclear why not all member states are included on those lists, given the risk of providing services without authorisation. The report added that the restrictions do not prevent users located in the EU from reaching prediction-market services through a VPN. The platforms prohibit VPNs and warn that they will block anyone who uses one, but according to ESMA the practical effectiveness of these restrictions remains uncertain.

The warning also covers Spain, where a block on Polymarket remains in place. On player protection, ESMA said platforms without EU authorisation offer retail investors speculative gambling environments without the safeguards of regulated financial products, and that their gamified design and promotion on social media expose users to losses, addictive behaviour and exploitation by more sophisticated operators. The report cited analyses finding that 67% of Polymarket's profits are concentrated in 0.1% of accounts.

ESMA said manipulation and insider-trading risks have reached new levels, particularly on platforms built on distributed ledger technology such as Polymarket, where identity verification is limited. The report cited several cases: newly created wallets gained $1.2m shortly before the US and Israeli attack on Iran in February 2026; a US soldier was charged with betting on classified information before the capture of Nicolás Maduro; and Météo-France reported to police the manipulation of weather sensors used to settle Polymarket bets. The regulator considered the platforms' measures largely reactive.

On volumes, the report said quarterly traded volume at the end of 2025 reached about $8.8bn at Kalshi and $12bn at Polymarket. Sports betting accounted for 73% of Kalshi's volume, while Polymarket's activity was more spread out, with politics at 29%, sport at 19% and crypto at 15%. The report also noted that Malta is the first member state to publicly study its own regulatory framework for these markets.

The subject is also on the agenda of ESMA chair Verena Ross. According to her official meetings calendar, she discussed prediction markets with the Futures Industry Association (FIA) on 13 April and with Intercontinental Exchange (ICE), owner of the New York Stock Exchange, on 15 April; the report said ICE has committed to invest up to $2bn in Polymarket. On 22 May she discussed the matter with Michael Selig, chair of the US Commodity Futures Trading Commission. On 18 June she received Neal Kumar and Bailey Springer of Polymarket, accompanied by Mia Dassas of law firm A&O Shearman and Finn Meunier of consultancy Hanbury Strategy, to discuss event contracts and their regulatory treatment in the EU and the US. Kalshi does not appear on that calendar.

The question of whether financial supervisors or gambling regulators should oversee these products remains open in Spain, according to the report.