Spain blocks Polymarket, Kalshi: the EU's prediction-market jurisdiction problem

What happened

On 26 May 2026, Spain's Dirección General de Ordenación del Juego (DGOJ) ordered ISPs to block access to Polymarket and Kalshi, citing operation without a Spanish gambling licence. Reuters reports the regulator issued cease-and-desist letters and added both domains to its national blocklist alongside roughly 60 unlicensed casino and sportsbook operators flagged earlier this quarter.

Polymarket runs on Polygon, settles in USDC, and routes most non-US traffic through a Panamanian entity after its 2022 CFTC settlement. Kalshi is a CFTC-regulated Designated Contract Market headquartered in New York that won a landmark federal ruling in 2024 allowing US election contracts. Neither holds a licence under Spain's Ley 13/2011 de Regulación del Juego, the statute that governs every form of real-money wagering offered to Spanish residents.

The DGOJ's notice frames the products as apuestas de contrapartida — counterparty betting — regardless of the operators' US-side classification as derivatives or event contracts. This is the first time a major EU member state has taken public enforcement action against either platform, and it lands two months after France's ARJEL issued a similar warning that stopped short of a block.

Why it matters

The core fight here isn't really about Spain. It's about whether a product can be a derivative in one jurisdiction and gambling in another — and the answer, increasingly, is yes. The CFTC spent eighteen months litigating whether Kalshi's election contracts were swaps or wagers under the Commodity Exchange Act; the court sided with Kalshi on the swaps theory. None of that reasoning is portable to EU law, which doesn't have a federal-derivatives carve-out. MiFID II covers financial instruments, but a binary contract paying $1 if an outcome occurs and $0 otherwise generally fails the "underlying asset" test the way a CFD or option doesn't.

For crypto-native prediction markets like Polymarket, the situation is worse. The platform's UMA-based oracle and on-chain settlement are irrelevant to the DGOJ's analysis — they don't care how the wager clears, only that a Spanish resident can place one. The Markets in Crypto-Assets Regulation (MiCA), which fully applied from December 2024, explicitly excludes anything that qualifies as gambling under national law. There is no MiCA passport that gets you around a gambling block.

Community reaction on Hacker News (252 points, top of the front page) split along predictable lines. The libertarian/crypto contingent framed the block as censorship of "information markets," pointing to research showing prediction markets outperformed pollsters on the 2024 US election. The regulatory-realist response: information value doesn't exempt you from licensing, and "we're a forecasting tool" has never worked as a defence in any jurisdiction that's actually tested it. Spain's DGOJ has been particularly aggressive — it blocked over 200 unlicensed operators in 2025 and runs an ML-driven scraper that flags new domains within 48 hours of launch.

There's a quieter technical wrinkle. Polymarket's frontend implements geo-IP filtering for US users (post-CFTC settlement) but not, until last week, for Spain or France — which means EU residents were transacting through a Panamanian entity with no licence anywhere in the EU. That's not a regulatory grey zone; it's a clear violation that was always going to get enforced eventually. The interesting question is why it took Madrid four years to act.

What this means for your stack

If you're building anything that touches real-money outcomes — prediction markets, parametric insurance, esports betting, fantasy with cash prizes, even some DeFi options protocols — three things change immediately:

Geo-fencing is now a compliance primitive, not a feature. A single IP-allowlist check at the edge isn't enough; the DGOJ specifically calls out VPN circumvention as the operator's responsibility under Article 13 of Ley 13/2011. You need device fingerprinting, payment-instrument geo-checks (BIN country), and a documented refusal flow. The operational cost is non-trivial: expect 3-5% of legitimate users to fail geo-checks and require manual review.

Licence-per-jurisdiction is the real cost structure. Spain's gambling licence runs €38,000 in application fees plus 20% gross gaming revenue tax. Multiply that across 27 EU member states (each with its own regulator) and you're looking at €1-2M in compliance overhead before you serve a single user. This is the moat that established sportsbooks have spent two decades building and that crypto-native platforms have, until now, mostly pretended doesn't apply to them.

Your settlement layer doesn't insulate you. On-chain finality, oracle decentralization, and "the protocol is just code" arguments have zero weight with national gambling regulators. The DGOJ, the UKGC, and ARJEL all enforce against the operator entity that markets the product to residents — not the smart contract. If your architecture assumes regulatory protection from decentralization, that assumption just got tested and failed.

Looking ahead

Expect the rest of the EU to follow within six months. Germany's GGL and Italy's ADM have both indicated they're reviewing prediction-market activity, and the EU Commission has floated a unified gambling framework in its 2027 digital-services workplan. The likely endgame is a prediction-market-specific licence that recognizes the forecasting use case while imposing standard gambling-grade KYC, deposit limits, and tax treatment — which is roughly what the UK is already drafting. For anyone building in this space: the era of "we're not gambling, we're a derivative/oracle/information market" is closing fast. Pick a jurisdiction, get licensed, geo-fence the rest. The market that survives the next two years will be the one that took compliance seriously a year before it had to.