Every insider trading rule in European financial law starts from the same picture. A company knows something about itself the market does not know yet, and the people inside it may not trade on that knowledge until it is published. The rule works because the secret has an address: you can name the firm that holds it, the people inside it, and the moment they must tell everyone else.
A prediction market breaks that picture in one specific way. The price moving secret is not held by the venue and not held by anyone who issued the thing you are trading. It is held by whoever already knows how the referenced event turns out. A team doctor who has seen a scan. A campaign staffer who has seen an unreleased poll. A soldier who has read an order. None has any relationship with the contract, the token or the platform, and Europe has to decide whether its crypto-asset insider rule reaches them anyway. As of 30 October 2026 no published supervisory interpretation has answered that.
ESMA put insider trading at the centre and then named one regulation
On 10 September 2026 the European Securities and Markets Authority published the second Trends, Risks and Vulnerabilities Risk Monitor of 2026 (ESMA50-1949966494-4282), with a dedicated in depth section on prediction markets. The section is not hostile to the category: it says prediction markets may offer informational and analytical benefits and carry economically interpretable signals about political, economic and social outcomes.
On market integrity it is blunt. ESMA writes that manipulation and insider trading risks reach new levels in prediction markets, particularly on platforms built on distributed ledger technology that operate with limited identity verification and where, in the authority's own words, the platform itself "may not know who is behind a given wager". Pseudonymous participation and the ability to hold multiple accounts, it says, hinder detection. The report states that a growing number of incidents illustrates that prediction markets are rife with inside trading, and footnotes three: wallets created shortly before the February 2026 United States and Israel strike on Iran that reportedly produced around 1.2 million dollars of profit, a United States soldier criminally charged in April 2026 over the alleged use of classified information to trade, and suspected tampering with weather sensors used to settle contracts, which prompted a police complaint by Meteo-France. Platform responses, it adds, are largely reactive, because investigations usually begin once the event has happened and the profit is booked.
Then comes the sentence that matters most for anyone operating in Europe. ESMA says the Market Abuse Regulation may help address these risks, but only where prediction market contracts fall inside the financial regulatory perimeter. That is an accurate statement of the law. It is also a gap, because the population it excludes is not a rounding error.
Read that against the classification the same section sets out. An event contract may be a financial instrument under MiFID II, may fall within MiCA where it is built on distributed ledger technology and is not a financial instrument, or may be gambling under national law, and the order is fixed: Article 2(4)(a) of Regulation (EU) 2023/1114 excludes crypto-assets that are financial instruments, so only a negative answer to the MiFID question moves a contract into the crypto-asset regime. We set that sequence out in our piece on which rulebook applies when an event contract is a token. The Market Abuse Regulation therefore covers the contracts that passed the MiFID test, while the ones that failed it land in MiCA, whose market abuse rules sit in Title VI. Those are by definition the tokenised venues, which is to say exactly the platforms ESMA had described a paragraph earlier as hardest to police because nobody there knows who is trading. For that half of the category the risk section names no operative route.
Article 87 describes a secret that has an owner
Article 87 of Regulation (EU) 2023/1114 defines inside information in four paragraphs. The main limb, 87(1)(a), covers information of a precise nature that has not been made public, relating directly or indirectly to one or more issuers, offerors or persons seeking admission to trading, or to one or more crypto-assets, and which if made public would be likely to have a significant effect on the prices of those assets or a related one. Article 87(4) sets the price test: a likely significant effect exists where a reasonable holder of crypto-assets would be likely to use the information as part of the basis of an investment decision.
Run outcome knowledge through that structure and part of it fits perfectly. If you know how the event settles, a reasonable holder would certainly use that in deciding whether to buy the yes side, so 87(4) is satisfied without argument, and the precision requirement in 87(2) is too, because a result is about as precise as information gets.
The strain is in the subject matter. Three of the four categories in 87(1)(a) are issuers, offerors and persons seeking admission to trading, and a market on a football match has none of them in the sense the provision assumes. Everything therefore rests on the fourth category, the asset itself.
Everything rests on the words "or to one or more crypto-assets"
This is an open question, not a settled one. There is a strong reading on which outcome knowledge does relate, at least indirectly, to the crypto-asset, because the result determines what the token pays. On that reading Article 87 reaches the team doctor, and the scope provision in Article 86 does the rest: it applies to acts by any person, in respect of crypto-assets admitted to trading or for which admission has been requested, on or off a trading platform, in third countries as well as the Union.
What makes the weaker reading plausible is the machinery around the definition. Information relating to an asset has traditionally meant information about the asset and the entity behind it. Article 88 puts the duty to publish inside information on issuers, offerors and persons seeking admission, with the technical means specified in Commission Implementing Regulation (EU) 2024/2861. A question about a football match has no such person, so half the mechanism the definition is wired into has nothing to connect to. Nobody publishes the result, because the event publishes itself.
Article 89 has the same shape. Paragraph 5 names members of the administrative, management or supervisory bodies of the issuer, offeror or person seeking admission, holders of capital in them, people with inside information through their employment, profession, duties or role in the distributed ledger technology, and people involved in criminal activities. Four of those five are relationships with the venue, the issuer or the chain. The fifth is a catch all for anyone holding inside information in other circumstances where they know or ought to know what it is.
So the catch all is doing all the work, and it only works if the information was inside information under Article 87 to begin with. The breadth of Article 89 cannot cure a narrow reading of the definition it depends on. This is a definitional question, and it deserves a published answer rather than an assumption.
Supervisors were given two examples and neither one is this
Article 92(3) required ESMA to issue guidelines on supervisory practices for preventing and detecting market abuse. It delivered them on 29 April 2025 in a final report numbered ESMA75-453128700-1408, applying three months after publication in all official languages.
Guideline 3 tells national authorities what to look at. On insider dealing it says they should consider, besides information held through employment, profession or duties, information held by a person because of their role in the distributed ledger technology. It gives one example of each: an employee at a crypto-asset service provider who knows a token is about to be listed, and miners or validators front running or shaping the flow of validated transactions.
Both examples are insiders of the market's own machinery. One sits in the venue, the other sits in the chain. Neither is the person who knows the result of the referenced event, which is the insider an event book most has to worry about. The guidance that tells twenty seven supervisors where to point their attention does not contain the case. The guidelines were written in April 2025 for crypto-asset markets in general, so that is not an oversight; it is simply what a supervisor reading them in 2026 is primed to look for.
The reporting template asks for an employer and an order book
The detection duty itself is in Article 92(1), and it is operative now. Any person professionally arranging or executing transactions in crypto-assets must have effective arrangements, systems and procedures to prevent and detect market abuse, and must report any reasonable suspicion to its competent authority without delay, including suspicions about how the distributed ledger functions.
How that is done was fixed by Commission Delegated Regulation (EU) 2025/885 of 29 April 2025. ESMA's final report on the template, numbered ESMA75-453128700-1278, contains the template itself, and two of its fields repay close reading if you run an event venue.
Section 3 asks why the activity looked suspicious, and for assets traded on a platform it asks specifically for the nature of the order book interaction that could constitute abuse. Section 4 asks the firm to identify the suspected person, including information about their employment, drawn from sources available internally to the reporting entity, with account documentation for clients and the staff information system for employees as the examples.
Read those fields against the prediction market insider and the mismatch is concrete. The evidence expected is trading behaviour, when the behaviour of someone who simply knows the answer looks like an ordinary confident trade. The identification expected assumes the suspect is your client with documentation on file or your own employee, when in practice they are a stranger whose edge comes from an employer you have never heard of and cannot query. ESMA acknowledged the general version of this in its own cost benefit analysis, noting that MiCA imposes the duty to detect and prevent market abuse without specifying how firms should comply from an organisational and governance perspective.
What detection looks like when a venue actually builds it
There is now a worked example of the missing capability, and it comes from outside Europe. On 27 October 2026 NPR reported that Polymarket has investigated dozens of bets placed on its midterm election markets, with at least two investigations referred to the Commodity Futures Trading Commission. The work is run by Shana Bautista, the platform's head of global intelligence and investigations and a former official of the Federal Bureau of Investigation. She declined to describe the detection criteria, but the signals she sketched were things such as device identifiers recurring across trades from newly created wallets and multiple accounts.
Note what that is. It is identity correlation, not order book analysis, and it is the work of tying separate pseudonymous accounts back to one human being, the step ESMA identified as the one pseudonymity blocks. A venue trying to satisfy Article 92 on an event book will find its most productive surveillance input is not in the template at all.
The reporting carries an honest caveat, which Polymarket's investigators have repeated about a separate inquiry into wallets used for election bets in Israel: early findings cannot settle whether an account traded on a secret, on good research or on luck. That is not a reason to skip the work. It is the reason the standard has to be written down in advance, because a judgement made after the fact will not hold.
Malta routed the boxes and left the conduct question alone
Until October 2026 no national authority in the European Union had published anything addressing prediction markets directly. On 19 October 2026 the Malta Financial Services Authority published a document on prediction markets and event contracts setting out how the existing frameworks apply, covering obligations under MiFID II, MiCA and gambling rules. It is the first such document from a member state regulator.
It also leaves this question untouched. In an analysis published on 23 October 2026, Rachel Gauci of the Maltese firm Mamo TCV Advocates summarised the circular as confirming that classification turns on the operator's activities and each contract's features, that contracts issued as tokens and not qualifying as financial instruments may fall within MiCA, and that it introduces no dedicated prediction markets licence. On Title VI, on market abuse and on inside information it says nothing. Classification was routed. Conduct was not.
That matches how the financial half of the perimeter has moved all year. The public statement ESMA issued on 3 July 2026, numbered ESMA35-243228190-8148, told firms which event contracts are financial instruments and who may sell them. It did not say who may trade them.
A venue can answer this before a regulator does
None of this is a reason to wait. The uncertainty is about which provision bites, not about whether trading on a known outcome is wrong, and a venue that wants to be trusted does not need a supervisory interpretation to say so in its own rulebook. We argued that general case in an earlier piece on inside information. The European layer adds four things worth writing down now.
Define the insider population by relationship to the event, not to the issuer. That is the substantive move, and the one the regulation does not make for you. For a market on a match it is the clubs, the officials, the medical staff and the governing body; for a market on an election, the campaigns and the bodies holding unpublished results. Name them per market type, before listing, and keep the list where a supervisor can read it.
Second, build the identity layer, because that is what detection runs on and what the template assumes you already have. Third, publish the resolution source and the dispute procedure for every market before it opens: ESMA's risk section lists ambiguous event definitions, manipulated data sources and opaque resolution as a distinct risk, and the Meteo-France complaint shows what happens when the settlement input is softer than the contract built on it. Fourth, report under Article 92(1) on a reasonable suspicion even where you cannot tell which prohibition the conduct falls under. The duty is to report suspicion, not to reach a legal conclusion first.
The Commission is due to report on the application of MiCA under Article 140 by 30 June 2027, and the targeted consultation on the review closed on 30 September 2026 without a published summary. Somebody will eventually write down who counts as an insider in a market about an event, and firms that already have an answer in their own rulebook will be read first. That is the argument behind the voluntary commitment this initiative asks firms to sign.