Regulators are asking prediction markets about identity, not trading.

A congressional committee, a Spanish regulator and a French one have all looked at prediction markets this year, and all three landed on identity. What American courts are actually fighting about is something narrower: not whether the platforms should know their users, but who has the standing to make them.

The alleged failures were location and identity controls, not trading rules

A federal indictment filed on 24 April 2026 alleges that US Army Master Sergeant Gannon Ken Van Dyke used classified information about a military operation to place bets on Polymarket, gaining more than $409,000. According to court papers cited by Congress, he reached the platform using a virtual private network, a tool that disguises where a user is.

A prediction market is a venue where people buy and sell contracts that pay out depending on whether a future event happens. Polymarket and Kalshi are the two largest. The classified information concerned Operation Absolute Resolve, the operation that captured Venezuelan President Nicolás Maduro.

The case is not isolated. A New York Times investigation published on 13 May 2026 found more than 80 Polymarket users whose bets had suspicious characteristics, some placed hours before unannounced US and Israeli military operations against Iran. Summarising that reporting, the House Committee on Oversight and Government Reform wrote that it suggests "access controls and identity verifications may be insufficient".

That is the shape of the problem. Nobody is alleging the trades were mispriced or the markets rigged. The allegation is that the wrong people got accounts, and that nothing stopped them.

Three separate bodies looked at prediction markets and all three landed on identity

Three separate bodies examined prediction markets in 2026 and asked the same thing. The US House Committee on Oversight and Government Reform requested Polymarket's identity verification records. Spain's gambling regulator said the platforms lacked identity checks, age controls and self-exclusion. France ordered a national block in July.

The congressional letter is the most detailed of the three. On 22 May 2026 the committee wrote to Polymarket's chief executive, Shayne Coplan, requesting documents from January 2024 onward, with a deadline of 5 June 2026. A parallel letter went to Kalshi. It explained why it wanted documents rather than testimony. Internal records held by the platforms are, it wrote, "the only means by which bad actors can be identified and to determine whether platforms are meeting their legal obligations".

Read the requests and you get a working definition of an identity programme. The committee asked for the verification "technologies, vendors, and procedures" used at account creation and at later intervals, whether international account holders face the same checks as US ones, and for any "reduced-scrutiny pathways available by geography or account type". It also asked how many suspicious activity referrals had gone to the Department of Justice or the Commodity Futures Trading Commission. In anti-money laundering regimes that referral is a formal filing with its own form and deadlines; here the question is whether it happens at all.

One request stands out. The committee asked for documents "discussing tradeoffs between compliance costs and platform growth". That is a request for the internal argument about how much verification friction a business is willing to accept, which is not a question a regulator usually gets to see answered in writing.

Spain's Dirección General de Ordenación del Juego arrived from a completely different direction and stopped in the same place. It treated the contracts as bets on uncertain outcomes, and said unlicensed operators do not meet the protections Spanish law requires: knowing who the customer is, keeping minors out, and honouring self-exclusion. France's Autorité nationale des jeux was shorter, describing a site "aux audiences particulièrement élevées" promoting an illegal gambling offer.

A committee investigating insider trading and a gambling regulator enforcing licensing rules have little in common. They converged anyway, because both were asking a question only the platforms' own identity records could answer.

What is actually being litigated is who may require it, not whether

US courts have not settled who may regulate prediction markets. On 6 April 2026 the Third Circuit held that federal commodities law likely overrides state gambling law. The Ninth Circuit heard argument ten days later and has not ruled. Six other countries blocked the platforms without waiting for an answer.

The American cases turn on preemption, the principle that a federal law can displace a state one. In KalshiEX LLC v. Flaherty a divided Third Circuit panel found that sports event contracts are "swaps" under federal commodities law, and that the Commodity Futures Trading Commission's authority therefore displaces state gambling enforcement. On 21 May the Ninth Circuit declined to pause the state cases against Kalshi, Robinhood and Crypto.com while it decides the same question. It has issued no opinion on the merits.

Notice what that argument is not about. Neither court is weighing whether prediction markets should verify their users. They are deciding which government gets to say so.

Six other countries did not need that resolved. Between January and July 2026 Portugal, Brazil, India, Indonesia, Spain and France each ordered the platforms blocked:

• Portugal, January 2026, after a surge in presidential election bets
• Brazil, April 2026, as part of a sweep covering around 28 platforms
• India, 21 May 2026, having reclassified prediction markets as "money games"
• Indonesia, 25 May 2026, as illegal online gambling
• Spain, 26 May 2026, published in the Boletín Oficial del Estado
• France, 16 July 2026, ordered by the Autorité nationale des jeux

Each applied an existing licensing rule rather than resolving a jurisdictional question. Polymarket said on 22 July that it will challenge the French order in court, the first real test of whether that route holds.

For anyone operating in the sector, the two threads point the same way. The jurisdictional fight determines which authority issues the requirement and on what legal basis. It does not appear to be determining what the requirement is. Every body that has examined these platforms this year has asked for the same thing. It is the thing telecom regulators are now asking of phone companies, and the thing AML regulators already ask of precious metals dealers: know who your customer is, and be able to prove it afterwards.

Using Didit for the controls these regulators named

Two of the gaps in this story map to specific checks. Device & IP Analysis flags the kind of location masking alleged in the Van Dyke indictment, where a virtual private network was used to reach a platform from a place it did not serve. Age Estimation addresses the minor-access control Spain said was missing. ID Verification confirms a government-issued document, which is what the House committee meant when it asked for verification "technologies, vendors, and procedures".

Published rates are $0.03 per Device & IP Analysis check, $0.10 per Age Estimation and $0.15 per ID Verification. The Full KYC bundle is $0.33 per check, with 500 free every month. Current module prices are listed on the pricing page.

The larger half of this story is not an identity problem at all. Verification does not detect insider trading, which is trading surveillance and a different discipline. It does not decide whether activity is suspicious, and it does not make the referral to a regulator. Most importantly, it does not make an unlicensed operator licensed. Spain and France blocked these platforms for operating without authorisation, and no verification vendor, Didit included, can supply a gambling licence.

Related reading

• The FCC wants phone companies to run bank-style KYC — The same pattern in telecom: identity checks proposed for a sector that never had them.
• AUSTRAC Tranche 2 for dealers in precious metals & stones — What point-of-sale identity checks look like when a sector enters a regime for the first time.
• The new AUSTRAC SMR form (2026) — What a suspicious matter report has to contain once you have decided something is suspicious.

Sources

1. Letter to Shayne Coplan, Chief Executive Officer, Polymarket — US House Committee on Oversight and Government Reform · 22 May 2026
2. Comer Launches Investigation Into Insider Trading on Prediction Market Platforms — US House Committee on Oversight and Government Reform · 22 May 2026
3. Blocking announcement, Polymarket — Autorité nationale des jeux, France · 16 July 2026
4. KalshiEX LLC v. Flaherty, No. 25-1922 — US Court of Appeals for the Third Circuit · 6 April 2026

Who wrote this

Tuan Nguyen — Growth · Didit

Writes about identity verification, fraud and compliance at Didit. This piece was written from the House Oversight Committee's own letter and the regulators' own announcements. Several widely repeated claims about the US court cases did not survive that check and are not repeated here.

Last reviewed 28 July 2026 against the sources above