Prediction Markets and Compliance Risk: How Financial Institutions Should Respond

A software engineer at Google allegedly used confidential information about the company’s 2025 “Year in Search” rankings to trade contracts on Polymarket. According to a civil complaint the Commodity Futures Trading Commission (CFTC) filed on May 27, 2026, he traded with near-perfect accuracy on at least 23 contracts tied to Google search trends and earned about $1.2 million. A parallel criminal case was brought in the same court. These are allegations, and no court has ruled on them.

The engineer had no trading role; he had access to data, and a prediction market gave that access a direct way to pay. He is also not an isolated case. Federal prosecutors have charged a U.S. soldier over prediction-market trades, and the Department of Justice is investigating former Rep. George Santos over Kalshi trades that the exchange has since cited as likely insider trading. In each case, the trader held information the market did not have.

Most conduct and surveillance programs were built around people who trade securities or work close to them, such as research analysts and others at financial institutions with access to material nonpublic information (MNPI). That design leaves a gap for everyone else who holds information a contract can price.

Why Prediction Markets Belong on Your Risk Register

Prediction markets let participants buy and sell contracts that pay out based on how an event turns out, whether that is a rate decision, an election, or a company’s search rankings. Platforms such as Kalshi and Polymarket list these contracts, and some sportsbooks now offer similar products. The markets have existed for several years, but their breadth has changed. Contracts now cover subjects that traditional exchanges rarely list, which brings in participants who have never traded securities.

He had access to data, and a prediction market gave that access a direct way to pay.

Regulators are still working out the details. In March 2026, the CFTC issued a staff advisory reminding designated contract markets of their obligations, along with an advance notice of proposed rulemaking that asks how the agency should treat these markets. The comment period closed April 30, 2026.

Neither step is a final rule. States have taken the opposite view: Several have treated prediction markets as gambling, and courts are now deciding whether federal law or state gambling law controls. Those cases are still moving, so I would read enforcement statements and active cases as the clearest signal of what regulators expect right now.

The CFTC Has Said Insider Trading Applies

Prediction markets introduce insider risk that existing controls were not built to catch, and firms are still working out how to police it. The CFTC has been clear that the rules apply. In a speech in late March 2026, David Miller, the agency’s director of enforcement, said the CFTC would “aggressively detect, investigate, and where appropriate, prosecute insider trading in the prediction markets.” He called the contrary argument a myth and described insider trading as “not a victimless offense,” because it often breaches a duty owed to the source of the information.

The Classification Question Is the Real Test

For most firms, the hardest question is which rulebook applies. A prediction market account does not look like a brokerage account, so an employee may reasonably conclude that PA dealing rules do not cover it. That gap gives some employees a reason to trade more than they otherwise would. The same activity could also fall under an outside business activity policy, a gambling or conduct policy, or nothing at all. Each classification triggers a different response: pre-clearance, disclosure, approval, or a conduct review. When the category is unclear, the outcome depends on which team happens to see the issue first, or whether anyone is looking for it at all.

I would run two tests now. First, check whether your PA dealing policy defines reportable accounts in a way that captures event contract platforms, or whether it names only brokerage accounts and custodians. Second, ask who would learn about a trade, and about the information behind it, if an employee made one tomorrow. That information could include earnings, technology plans, or any other proprietary data the firm can access. Without a statement feed, a disclosure, or an attestation that asks about these platforms directly, the honest answer is that the firm would learn only when the employee chose to say so.

Where Surveillance Programs Fall Short

Surveillance programs often miss conversations that move off the desk. Discussions move to personal phones and voice calls, which many programs do not capture in full. Lexicons built around securities also rarely include platform names or contract terms, so a message that names a specific contract can pass without a flag.

Even companies using advanced AI detection methods can struggle to detect trading on prediction markets. Prediction market contracts differ from exchange-traded instruments. They cover new topics regularly, and they generally lack the ISIN or LEI identifiers that many detection models rely on. Models trained on known contracts can miss them entirely, but Shield has built detection to close this gap.

When the category is unclear, the outcome depends on which team happens to see the issue first, or whether anyone is looking for it at all.

Intent is even harder. A colleague saying “I already know how this resolves” may be joking, may be guessing, or may be describing something he should not know. Telling those apart takes context that keyword matching alone rarely supplies. Trade surveillance often has a similar blind spot, because prediction market activity sits outside the venues a firm already monitors.

Strengthening Governance Now

• Start with definitions. Name prediction market platforms, event contracts, and sportsbook-style products in your PA dealing and outside activity policies, and decide in advance which category each falls under. Employees should not have to guess.
• Put direct questions into annual disclosures and attestations. Ask whether employees hold accounts on prediction market or sportsbook platforms, whether they have traded on events connected to their work, and whether they have shared nonpublic information about any listed event. Direct questions produce clearer answers than broad policy language.
• Run a short risk assessment. Map each risk to an owner, a control, and a known gap. The Google case makes a useful test: which team would have caught it, and what evidence would they have used?
• Tackle surveillance. Build prediction market venues and related speech into surveillance models, organized under the taxonomies you already use, such as PA dealing and insider activity. Venues, contract types, and the language around them change quickly, so static term lists fall behind. Treating them as part of the model’s taxonomy means coverage does not depend on someone remembering to update a list.
• Define escalation. Name who reviews a suspected case, how it moves between conduct and surveillance teams, and when legal and HR join. The alleged conduct in the Google case involved confidential data, a breach of an employer’s duty, and a public market, so it sits across several functions at once. A clear path keeps a case from stalling between them.

The Principles Are Familiar

Prediction markets are new to most compliance programs, but the risks are old: misuse of nonpublic information, trading outside personal account controls, and communications that reveal intent. Firms that ask how existing policies apply will find their gaps sooner than firms waiting for final rules.

If you want to see how your program handles prediction market conduct risk, talk with our team about where your current controls stand and how communications surveillance can support that review.