The editorial argues that for three years prediction markets bet on regulatory arbitrage — fix the U.S. via the CFTC and the rest follows — but Spain's action is the clearest signal that thesis is wrong in Europe. Under EU law gambling is explicitly carved out of the single market and reserved to member states, making the European framework structurally hostile to the U.S. play.
The editorial emphasizes that Ley 13/2011 covers any game with mixed elements of chance and skill where a resident stakes money on an uncertain outcome to win money — a bar prediction markets clear by design. The law doesn't care whether the platform calls itself a derivatives exchange or a financial event contract; it looks at the underlying economic activity.
Reuters reports that the DGOJ framed both Polymarket and Kalshi as unlicensed online gaming operators under the 2011 Gambling Act, ordering ISPs and payment processors to block access. The regulator's framing treats the platforms as gambling operations requiring a national license, rejecting the financial-derivative characterization.
The editorial situates Spain's block alongside France's ANJ ruling against Polymarket in late 2024, Belgium's Gaming Commission review opened in early 2026, and Italy's ADM circling. The pattern suggests prediction markets face a continent-wide regulatory wall, not a one-off jurisdictional dispute, and engineers in adjacent spaces should update their priors accordingly.
Both platforms have publicly maintained that what they offer is a financial derivative on an event outcome rather than a gambling wager. Kalshi points to its status as a CFTC-regulated Designated Contract Market trading event contracts, and Polymarket restored U.S. access in late 2025 via the QCX/QCEX acquisition path after its 2022 CFTC settlement — both leaning on a financial-instruments framing.
On May 26, 2026, Spain's Dirección General de Ordenación del Juego (DGOJ) ordered ISPs and payment processors to block access to Polymarket and Kalshi, citing operation without a Spanish gambling license. Reuters reported the regulator framed both platforms as unlicensed online gaming operators under Spain's 2011 Gambling Act (Ley 13/2011), which requires a national license for any operator offering games of chance — or, critically, games with mixed elements of chance and skill — to Spanish residents.
The action mirrors France's ANJ ruling in late 2024 against Polymarket and slots into a broader European pattern: Belgium's Gaming Commission opened a similar review in early 2026, and Italy's ADM has been circling. The U.S. side of the house looks very different. Kalshi operates as a CFTC-regulated Designated Contract Market trading event contracts. Polymarket, after its 2022 CFTC settlement, restored U.S. access in late 2025 via the QCX/QCEX acquisition path. Both have publicly maintained that what they offer is a financial derivative on an event outcome, not a wager.
Spain disagreed, and the legal text it leaned on doesn't care what the platform calls itself — it cares whether a Spanish resident can stake money on an uncertain outcome and win money based on that outcome. That's a definitional bar prediction markets clear by design.
For the better part of three years, the prediction-market thesis has been that regulatory arbitrage was tractable: get the U.S. right via the CFTC, the rest follows. The Spain block is the clearest signal yet that this thesis is wrong in Europe, and engineers building in adjacent spaces — sports data, crypto derivatives, fantasy platforms, even DAO-based forecasting tools — should update their priors.
The European framework is structurally hostile to the U.S. play. Under EU law, gambling is explicitly carved out of the single market (Services Directive, Article 2(2)(h)) and reserved to member-state competence. That means there is no "passport." You don't license once in Malta and serve the EU; you license in each country where you accept users, and the definitional tests vary. Spain's mixed-skill-and-chance test is broader than Germany's, which is broader than Sweden's. Polymarket's CFTC posture is irrelevant in Madrid.
The community reaction on Hacker News (869 points, top of front page) split predictably along two lines. One camp — heavy with crypto and trading practitioners — argued this is straightforward protectionism for the Spanish state lottery (SELAE) and the licensed sportsbook incumbents who pay into it. The other camp, including several EU-based lawyers in the comments, pointed out that Spain's framework has been consistent since 2011 and that the surprise isn't the block, it's that Polymarket got 18 months of unimpeded Spanish traffic before the hammer fell.
Both readings can be true. The interesting engineering question isn't who's right; it's what compliance posture survives contact with 27 different regulators who each get to define "gambling" their own way.
The enforcement mechanism is also worth a closer look. DGOJ doesn't sue Polymarket — Polymarket has no Spanish entity to serve. It orders Spanish ISPs to DNS-block the domain and orders payment processors (the Spanish branches of Stripe, Adyen, the local card networks) to refuse settlement to the operator's known wallets and accounts. For a crypto-native platform like Polymarket settling in USDC on Polygon, the DNS block is trivially circumvented with a VPN, but the payment processor order is the actual choke point — it kills the on-ramp and off-ramp for Spanish bank accounts. Kalshi, which is fiat-only, gets hit harder by exactly the same order.
If you're building anything in the prediction, parametric-insurance, or event-derivative space, three things become non-negotiable.
First, geo-fencing has to be a Day-1 control, not a compliance bolt-on. That means IP geolocation at the edge (Cloudflare's geo headers, AWS CloudFront geo-restrictions) plus a KYC-time residency check plus a payment-rail BIN check. Any one of those alone is insufficient; the AML and gambling regulators routinely demand defense-in-depth. The CFTC's 2022 Polymarket settlement specifically cited inadequate geo-fencing as a violation, and Spain's order will quote the same logic.
Second, assume your legal classification will be re-litigated in every jurisdiction you touch. The phrase "event contract" is a U.S. CFTC term of art. It has no force in Madrid, Paris, Berlin, or São Paulo. Architect your product so that you can disable specific contract types per country without a redeploy — feature flags keyed on user residency, with the flag state owned by legal, not engineering. The platforms that survive the next two years will treat regulatory jurisdiction as a first-class entity in their data model, not as a deploy-time config.
Third, watch the payment rail more than the DNS block. Domain blocks slow you down; payment processor cutoffs end you. If you're integrating Stripe, Adyen, or a card acquirer, read the gambling-and-betting clauses in your merchant agreement carefully. Most explicitly require a license in each jurisdiction where you accept funds, and most include a clause letting the processor freeze your account on regulator request without notice. A Spain-style order against your processor is a same-day revenue-stop event.
The interesting question isn't whether Polymarket and Kalshi appeal — they will, and they'll lose in Spain because the statute is clear. The question is whether either platform pursues actual Spanish licensure, which would require a Spanish legal entity, local capital reserves, integration with the national self-exclusion registry (RGIAJ), and a tax rate that probably makes the unit economics ugly. The more likely outcome is a hard geo-block, an acknowledgment that the EU is a 27-country licensing slog, and a renewed focus on U.S. growth where the regulatory question is at least answered. For developers in the space, the lesson is older than the technology: when your product is regulated, the regulator's definitions win, not yours.
When I see people making money on Iran attacks, and murder of heads of state - it shows clearly something is deeply wrong with Polymarket. Its a level worse than Vegas or Indian casinos. A literal ticket to hell. I'm all for banning these evil sites.
Good.Just naming things differently does not work in other countries.If it quacks like a duck, swims like a duck, and looks like a duck, then it probably is a duck.
I don't usually see advertisements, but I was in a position recently to see a real-life television stream, and I was quite surprised to see them run an advertisement for Kalshi. I was pretty surprised that something like this would be advertised to normal people. I'd half expect the next a
I’m surprised these haven’t already been banned tbh.It doesn’t make sense that if I bet on the outcome of a football match then it’s gambling but if I bet on the outcome of the Ukraine war then it’s I-can’t-believe-it’s-not-gambling.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
These - especially Polymarket - should be illegal globally, as they incentivize people with power to manipulate the real world in horribly destructive ways to win a bet.I would not be surprised if people are murdered at some point to reap the payout of some related bet.