The European Securities and Markets Authority published Trends, Risks and Vulnerabilities No. 2 2026 on 10 September 2026. In the prediction-markets chapter, ESMA says marketing and sale of event contracts in the EU generally requires EU authorisation, which the largest platforms currently do not hold. That is a perimeter finding inside a risk monitor. It is not a Union-wide shutdown order.
Polymarket and Kalshi sit at the center of the chapter. ESMA lists other large operators too, all based outside the EU. The split is useful: Polymarket is partly on-chain with centralised governance; Kalshi is a fully centralised venue the U.S. Commodity Futures Trading Commission regulates as a designated contract market.
Bitcoin (BTC) last printed $77,298 on our CoinGecko snapshot at 2026-09-12T00:57:04+00:00 (24h +0.56%). Ether (ETH) was $2,512.60 (+2.30%). Those prints tell you the weekend tape is calm. They do not rewrite ESMA’s H1 2026 crypto section, and they do not licence an event-contract book in Europe.
Narrative is cheap here. Exit liquidity is not. Traders who treat an ESMA chapter as a takedown headline will mis-time both the EU perimeter and the U.S. venues that still list the same contracts.
What happened
ESMA’s 10 September 2026 press note is the cover letter. Chair Verena Ross warned that investor optimism is running ahead of geopolitics and a weaker outlook. The prediction-markets work sits in the financial-innovation block, next to tokenisation and DeFi, not in an enforcement docket.
The lead document is the TRV Risk Monitor 2 2026 PDF (ESMA50-1949966494-4282). The file’s last-modified stamp on ESMA’s host is 10 September 2026 08:33:31 GMT. Pages 49 and following define event contracts, then walk volumes, legal buckets, geo-blocks, and integrity risks.
Volume prints in the report are dated, and ESMA says so. By Q4 2025, quarterly trading was about $8.8 billion on Kalshi and $12 billion on Polymarket, with growth continuing into 2026. Kalshi figures are as of 25 November 2025. Polymarket figures are as of 31 January 2026. Sources listed: the two APIs, JBecker, and ESMA. Chart 72 splits the mix: sports are 73% of identified Kalshi activity; Polymarket is more mixed, with politics 29%, sports 19%, and crypto-related markets 15%.
The legal sentence that matters is short. Event contracts may be MiFID II financial instruments, MiCA crypto-assets when they sit on distributed-ledger technology and are not financial instruments, or gambling under national law. Marketing and sale in the EU generally needs EU authorisation. The largest platforms currently do not hold it. Where a contract is a financial instrument, ESMA says it would generally be a derivative caught by national binary-options product-intervention rules that ban marketing, distribution, and sale to retail investors.
ESMA also writes that both platforms say users in some, but not all, EU countries are barred from placing orders. The report asks why the rest of the Union is missing from those lists, given unauthorised-service risk under MiFID II, MiCA, gambling law, and binary-options measures. It adds that geographic restrictions do not stop VPN access, and that the practical effectiveness of VPN bans is uncertain. Polymarket’s own geographic restrictions help page is the footnote ESMA cites for that platform. Kalshi’s member agreement is cited too; that PDF challenged when we fetched it this hour, so we do not lean on a live Kalshi URL.
Context
This is the same venue-risk file we have been keeping on the U.S. side, only now with a Brussels date stamp. Kalshi’s CFTC designated-contract-market status is why ESMA can describe it as fully centralised and U.S.-regulated in one breath, then still say it lacks EU authorisation. That is not a contradiction. It is two perimeters. We already walked the U.S. emergency overlay in our read on the CFTC order that kept Kalshi open amid the New York suit, and the later Letter 26-23 incentive-filing warning. Those are Washington process. They do not mint a MiFID licence.
State geofences are the other half of the same story. Our Washington Kalshi geofence clocks piece was about a court timetable, not an EU passport. ESMA is now asking the inverse question: why some member states appear on venue block lists and others do not, while VPNs sit in the middle. Traders who only watch U.S. sports-bet lawsuits will miss that Brussels is mapping access, not copying a state attorney general.
The chapter also sketches traditional-market interest. ICE’s commitment to invest up to $2 billion in Polymarket, Cboe and Nasdaq prediction-style products, CME event contracts, Galaxy’s June 2026 OTC book, and SEC reviews of prediction-market ETF proposals all sit in ESMA’s text. Treat that list as the monitor’s integration sketch. Do not upgrade it into weekend filings.
Crypto shows up twice. Polymarket’s 15% crypto-related share is one. The broader TRV block is another: U.S. spot bitcoin ETP net asset value about €62 billion at end-June 2026 (down 36% from end-2025) and U.S. spot ether ETPs about €7 billion (down 55%). Those are H1 2026 monitor numbers, not today’s CoinGecko tape. They still explain why ESMA parks event contracts next to ether’s on-chain stack.
Integrity language is a literature recap, not a new ESMA investigation. The report says insider-trading and manipulation risks “reach new levels” on DLT venues such as Polymarket. It points to a $1.2 million profit in new wallets around the February 2026 Iran strike (Forbes, via ESMA), a U.S. soldier charged over classified-information bets (DOJ, 23 April 2026, via ESMA), and a Météo-France complaint after suspected weather-sensor tampering (FT, 23 April 2026, via ESMA). A Wall Street Journal footnote says 67% of Polymarket profits accrued to 0.1% of accounts. We are not re-trying those cases tonight.
Malta is the only member state ESMA names as publicly exploring a dedicated prediction-market framework (March 2026 government language, via ESMA). That is a legislative sketch, not a licence. Binary-options national measures remain the retail gate for contracts that are MiFID derivatives. If you want a method for reading regulator prose without turning it into a trade, use our guide on following crypto news without getting played.
Our read
I read TRV 2 2026 as a perimeter map, not a takedown. ESMA is telling NCAs and the Commission that the large books are outside EU authorisation, that partial geo-blocks are a weak control, and that binary-options rules already bite if the contract is a retail derivative. It is not publishing a Union-wide halt, a CASP approval, or a new product-intervention decision dated 10 September 2026.
The cheap story is “Europe just banned Polymarket.” The tape story is messier. U.S. designated-contract-market plumbing can keep listing while EU marketing stays unauthorised. Partial country blocks can coexist with VPN leakage. Sports-heavy Kalshi flow can look like a bookmaker, while Polymarket’s politics-and-crypto mix looks like a crypto-adjacent information market. None of that resolves counterparty risk for an EU retail user who is not supposed to be on the book in the first place.
Falsifiable claim: By 2026-10-31 23:59 UTC, ESMA or a named EU national competent authority will have published either (a) an authorisation or licence stating that Polymarket or Kalshi may market or sell event contracts in the Union, or (b) an enforcement or product-intervention decision that orders a Union-wide halt of those platforms’ event-contract access as a follow-on to TRV 2 2026. If neither (a) nor (b) appears by that clock, the “perimeter map, not a shutdown” read still stands on this document.
What to watch
Watch the ESMA and NCA document types, not social captions. A CASP register entry, a MiFID investment-firm authorisation, or a formal product-intervention decision is a different object from a TRV chapter. Malta’s framework, if it moves from speech to statute, is the only member-state path ESMA named.
Watch geo-block lists against VPN language. If Polymarket or Kalshi expands EU country blocks to the full Union and publishes a dated help-page or member-agreement change, that is a control change. If they add countries without closing VPN holes, ESMA’s effectiveness critique still applies.
Watch U.S. process on a separate calendar. CFTC DCM status, incentive-program 40.6 filings, and state geofence orders can all print while the EU authorisation sentence stays unchanged. A new 8-K or CFTC release still needs its own fingerprint. Do not merge it into this TRV.
Watch whether ICE, Cboe, Nasdaq, or ETF footnotes turn into live listing notices. Until a primary says they are trading, they stay in the monitor. The weekend BTC range under $80,000 does not settle those clocks.