Is Polymarket Legal in Europe? What ESMA’s Warning Changes

Spain ordered Polymarket and Kalshi blocked in May. Four months on, neither platform lists Spain among the countries it restricts, and that gap, repeated across six member states, is the real answer to the question Europe’s markets regulator asked on 10 September. The short answer to “is Polymarket legal in Europe” is that no EU authorization exists for either platform, and whether a given contract is banned outright or merely unlicensed depends on what the contract asks and where the user sits.

What ESMA said on 10 September, and what it did not

The European Securities and Markets Authority published its second risk monitoring report of 2026 on 10 September. Four of its pages are an in-depth section titled “Prediction markets: relevance from a securities market perspective.” It names Polymarket and Kalshi as the major platforms, notes that both are based outside the EU, and reaches a conclusion that the press summarized as a warning.

“As a result, the marketing and sale of event contracts in the EU generally requires an EU authorisation, which the largest prediction market platforms currently do not hold.”

— ESMA, TRV Risk Monitor No. 2, 2026

The report then turns to the platforms’ own geoblocks. Both Polymarket and Kalshi state on their websites that users in some, but not all, EU countries are prohibited from placing orders. ESMA’s footnote for that sentence cites Polymarket’s geographic-restrictions help page and Kalshi’s member agreement, the same two documents examined below.

“It is unclear why all EU Member States are not included in the list of restricted jurisdictions, given the risk of unauthorised service provision under MiFID II, MiCA, national gambling legislation, and of breaching national product intervention measures on binary options. Most importantly, such geographic restrictions do not prevent users located in the EU from accessing prediction market services through the use of VPNs.”

— ESMA, TRV Risk Monitor No. 2, 2026

ESMA adds that the platforms say VPN use is prohibited and that detected users may be blocked, but “the practical effectiveness of these restrictions remains uncertain.” On market integrity it is blunter: “A growing number of incidents illustrates that prediction markets are rife with inside trading,” and the platforms’ monitoring is “largely reactive” because investigations tend to start after the profits are realized. The report also notes that prediction markets “remain relatively limited in scale within the EU,” and attributes that to the EU regulatory approach itself.

What the report is not is a ban. It creates no new rule and orders nothing. ESMA’s own social media post announcing it did not mention either platform. The operative legal position was set out two months earlier, in a public statement dated 3 July 2026, and that statement is the document that decides which contracts are illegal in the EU and which are merely unlicensed.

The three-bucket test: banned outright, or a license problem

An event contract, in ESMA’s definition, is an agreement whose financial outcome is binary, a fixed payout or nothing, and depends on a yes-or-no answer to a question about a future event. The 3 July statement makes one point that most coverage has flattened: not all event contracts are financial instruments. Only those “with an event question related to an underlying mentioned in Section C(4) to (10) of Annex I of MiFID II” qualify. Everything else falls outside EU securities law altogether.

Those Annex I underlyings are financial ones: securities, currencies, interest rates and yields, financial indices, commodities, climatic variables, freight rates, inflation rates and other official economic statistics. In a client note published on 8 July, lawyers at Katten Muchin Rosenman read that list to mean contracts on Federal Reserve decisions, inflation prints, the bitcoin price, index levels and weather measurements are in scope, while “sporting or political outcomes” are not.

For contracts that do qualify, the consequence is severe. They are derivatives, and because the payout is binary they are binary options. ESMA banned the sale of binary options to retail clients across the EU in 2018, first under a temporary decision that took effect on 2 July 2018 and then, when ESMA stopped renewing that decision on 1 July 2019, under permanent national measures adopted by every national regulator. The July statement’s footnote confirms that those national measures “are currently in place in all Member States of the EU.” That is the 27-state ban, and it predates prediction markets by years.

The statement closes three doors that platforms might have tried. The commercial name “is irrelevant for the categorisation under MiFID II,” so calling a binary option an event contract changes nothing. A “coupon” or “reward” paid on the funds staked “does not change the binary nature of the event contract itself.” And because these are financial instruments, offering them even to professional clients “requires an authorisation in accordance with MiFID II.” Participating in circumvention of the measures is prohibited.

Contracts on anything else, which is most of what the two platforms list, are not financial instruments. ESMA’s statement says they “may also classify as a bet under national gambling legislation” or, if they are issued as tokens, as crypto-assets under the Markets in Crypto-Assets Regulation. There is no EU passport for gambling. Each member state licenses separately, which is why the enforcement to date has come from national gambling authorities, not from ESMA.

The volume split explains why that matters more than the securities-law headline. According to ESMA’s own breakdown of platform data, sports account for 73% of identified trading activity on Kalshi, while Polymarket’s largest segments are politics at 29%, sports at 19% and crypto-related markets at 15%. Most of the money is in the gambling bucket, where the question is not whether a product is banned but whether the operator holds a license in the user’s country. Neither does, anywhere in the EU.

Who blocks whom: 27 states, three lists that do not match

ESMA asked why the platforms’ restricted lists do not cover every member state. The more revealing comparison is between those lists and the states that have already acted. Fourteen member states have taken a public step against Polymarket: Belgium’s Gaming Commission blacklisted the site on 30 January 2025; Poland’s finance ministry added it to its register of unlicensed domains on 8 January 2025; Germany’s Joint Gambling Authority placed it on the national blacklist in September 2025; Italy’s customs and monopolies agency ordered it blocked on 22 October 2025 and again in July 2026; Romania’s gambling office blacklisted it on 29 October 2025; Hungary’s supervisory authority ordered a temporary block on 16 January 2026; Portugal’s gaming regulator ordered it to stop serving the country in January 2026; the Dutch gambling authority issued a penalty order on 20 January 2026, as we reported in our coverage of the Netherlands decision; Spain’s gambling directorate opened proceedings and ordered a precautionary ISP block on 26 May 2026; Slovakia’s gambling office added it to its list of prohibited offers on 22 June 2026; a Danish court found on 8 July 2026 that it offered gambling without a license, leading to DNS blocking in August; the Czech finance ministry listed it on 13 July 2026; France’s gambling authority ordered ISPs to block it on 16 July 2026; and Ireland’s regulator secured a geoblock in July 2026 under threat of High Court action.

Set those fourteen against the platforms’ own documents. Polymarket’s geographic-restrictions page, last updated 14 August 2026, lists 39 fully blocked countries. Nine of them are EU member states: Belgium, Germany, France, Ireland, Italy, Malta, the Netherlands, Poland and Slovakia. Kalshi’s exchange notice of 22 June 2026 names 55 restricted jurisdictions, eight of them in the EU: Belgium, Bulgaria, France, Hungary, Ireland, Italy, Poland and Portugal.

Three things stand out. First, six of the fourteen states that have blocked Polymarket do not appear on Polymarket’s own list: Czechia, Denmark, Hungary, Portugal, Romania and Spain. In those countries the block exists only at the ISP or DNS level, which is exactly the layer ESMA says a VPN defeats. Second, Spain, the only regulator to name Kalshi in a blocking order, is on neither platform’s list. Third, only five states appear on all three: Belgium, France, Ireland, Italy and Poland.

The lists also disagree with each other in ways no regulator explains. Kalshi restricts Bulgaria, where no public action has been found, while Polymarket’s page uses Bulgaria as its example of a place a traveling user “can continue to trade.” Polymarket blocks Malta, the one member state whose government is openly exploring a licensing framework, while Kalshi does not. Germany and the Netherlands, both of which have acted against Polymarket, are absent from Kalshi’s list, and Polymarket’s Germany entry is not a block at all: German users must hold existing positions until the market resolves, then withdraw. Italy is view-only, Poland is close-only, and the same page bans VPN use under section 2.1.4 of the terms of service.

None of this makes the platforms’ lists wrong on their own terms. A country that blocks a domain at the ISP level does not need the operator’s help to keep casual users out. But it does answer ESMA’s question. The restricted lists are not a map of where the product is illegal. They are a record of which regulators have made themselves expensive enough to be added, a pattern visible in Polymarket’s response to the Italian block and in the French and Irish actions in July.

Kalshi’s quiet retreat, one exchange notice at a time

Kalshi’s list is the better documented of the two, because every change to it is filed as an exchange notice amending the member agreement, and those notices are public. Read in sequence, they show a platform that has been withdrawing from the EU one country at a time for nine months, usually after a national regulator moved first.

On 6 October 2025, four days before Kalshi announced trading in more than 140 countries, its restricted list held three EU states: Bulgaria, France and Poland. Belgium was added on 12 October. Italy was added on 23 October, one day after the Italian regulator’s first blocking order. Hungary followed on 27 January 2026, eleven days after the Hungarian block. Ireland was added on 16 April and Portugal on 23 April, three months after the Portuguese order. The list has stood at eight EU states since then.

The 22 June 2026 notice changed the wording rather than the list. The restrictions now “apply solely to the trading of Event Contracts and do not, in and of themselves, prohibit membership on, or non-trading access to, the Platform,” and Kalshi reserves the right to admit members from restricted jurisdictions at its discretion. That is narrower than the November 2025 version, which barred residents of restricted jurisdictions from accessing or using the platform at all. The exchange that overtook Polymarket on volume this year has, in the EU, been shrinking its own footprint while loosening the language that describes it.

Two claims circulating in guides do not survive the documents. Kalshi has not “withdrawn from the EU,” and it does not bar German residents: Germany is not on its list. Spain is not on it either, four months after the Spanish order named Kalshi alongside Polymarket.

What it means if you are in the EU

For a reader in a member state, the position follows the buckets. A contract on interest rates, an inflation print, a crypto price or a temperature reading is a binary option, and no firm may market or sell it to a retail client anywhere in the EU. There is no authorized venue to buy it from, because neither platform holds a MiFID authorization and no EU investment firm offers these products to retail. A contract on an election or a football match is not caught by that ban, but it is a bet under the gambling law of the state you are in, offered by an operator that holds no license there.

In most member states the offense in unlicensed gambling is the operator’s, not the player’s. Germany is the exception: section 285 of the German Criminal Code makes participation in unlicensed gambling an offense in its own right, which is why Polymarket’s Germany entry freezes existing positions rather than closing them.

Deposits and withdrawals are the practical edge of all this. Polymarket’s close-only and hold-only statuses exist so that users in newly restricted countries can still exit, and the Kalshi notice preserves “non-trading access” for the same reason. What neither document promises is that a user who was never entitled to trade from a blocked state will be able to withdraw without the account first being reviewed.

Where a legal path could come from

The first date is 30 September 2026. The European Commission’s targeted consultation on the review of MiCA asks, in its Question 70, whether prediction markets that run on distributed ledgers and settle through smart contracts should be governed by MiFID or by MiCA. Under MiCA an operator could in principle become a licensed crypto-asset service provider and passport across the bloc; under MiFID the same product runs into the binary-options machinery described above. The Commission’s report on the review is due by 30 June 2027, and a legislative proposal would follow that, not precede it.

Polymarket has begun lobbying for that outcome. On 9 September, the day before ESMA’s report, it announced it had joined Blockchain for Europe, a Brussels trade association, and said it is expanding into Europe and working with regulators toward a licensed model.

“Joining Blockchain for Europe reflects our commitment to engaging early and openly with EU policymakers.”

— Neal Kumar, Chief Legal Officer, Polymarket, 9 September 2026

Membership of a trade association is not a license, and the Polymarket statement does not name a regulator it has applied to. Kalshi has made no public statement on the ESMA report.

Malta is the only member state ESMA credits with exploring a dedicated framework. Its economy minister said in March that the government was “actively exploring” the sector, and its prime minister floated licensing through the Malta Gaming Authority in May. We examined Malta’s attempt to write the first EU rulebook when it was announced. Gibraltar, which is not in the EU, has gone further: it enacted its Prediction Market Regulations 2026 on 13 July and has licensed two operators, including FIFA’s prediction-market partner ADI Predictstreet. A Gibraltar license confers no right to serve EU customers.

Outside the EU the direction of travel is not uniform. The Times reported on 7 September that the UK Financial Conduct Authority has held talks with platforms about easing its own 2019 retail ban after being shown evidence of British users reaching overseas platforms through VPNs. No policy has changed, and any UK operator would still need a Gambling Commission license for sports and political markets. Inside the EU, the nearest decision is Spain’s. The gambling directorate gave its proceeding against both platforms three to four months from 26 May, which puts a final resolution around the time ESMA’s report landed.

FAQs

---

Sources

• TRV Risk Monitor No. 2, 2026 (in-depth section on prediction markets, pp. 49–52) — European Securities and Markets Authority
• Press release: Ongoing geopolitical and economic vulnerabilities masked by strong investor optimism, 10 September 2026 — European Securities and Markets Authority
• Public Statement on the application of the national product intervention measures on binary options to event contracts, 3 July 2026 — European Securities and Markets Authority
• ESMA reminds firms of existing rules and obligations under binary option measures, 3 July 2026 — European Securities and Markets Authority
• ESMA ceases renewal of product intervention measure relating to binary options, 1 July 2019 — European Securities and Markets Authority
• Geographic Restrictions (updated 14 August 2026) — Polymarket Help Center
• Kalshi Exchange Notice (Updated Member Agreement), 22 June 2026 — Kalshi
• Kalshi Exchange Notice (Updated Member Agreement), 6 October 2025 — Kalshi
• Promotion of illegal gambling services: blocking of the Polymarket website, 17 July 2026 — Autorité nationale des jeux (France)
• The DGOJ opens sanctioning proceedings against Polymarket and Kalshi and orders their websites blocked, 26 May 2026 — Dirección General de Ordenación del Juego (Spain)
• Adventure One QSS Inc. (Polymarket): penalty order, collection decision and decision on objection — Kansspelautoriteit (Netherlands)
• List of prohibited offers — Úrad pre reguláciu hazardných hier (Slovakia)
• List of unauthorized internet games — Ministry of Finance of the Czech Republic
• Strafgesetzbuch (German Criminal Code), section 285: participation in unlicensed gambling — Federal Ministry of Justice (Germany)
• Targeted consultation on the review of the MiCA Regulation — European Commission
• Polymarket joins Blockchain for Europe to support with expansion into Europe, 9 September 2026 (press release) — Polymarket