How Prediction Markets Actually Work (And What It Takes to Build One Legally)

Offering players worldwide the opportunity to bet on any world event: this is the promise of prediction markets platforms. With the massive success and traction of names such as Polymarket and Kalshi, one may wonder: how do these companies operate, behind the curtain?

Kalshi and Polymarket processed over $44 billion in combined trading volume in 2025. Monthly volume across the two platforms has since climbed to $24 billion as of April 2026, per a Pew Research Center analysis of data from The Block, a figure that exceeds the average monthly handle through legal US sportsbooks. Kalshi alone generated $263.5 million in fee revenue last year, a figure that has since annualised above $1.5 billion. This is no longer a niche experiment.

For founders watching those numbers, the question is obvious: could I build something like this? The answer is yes. The follow-up, which most people do not ask until it is too late, is: what would it actually take?

This article covers the mechanics of the business model, the revenue logic, what regulation it triggers, and the practical steps any founder needs to take before writing a line of code.

The platform does not bet. It does not take positions or hold risk. It collects a transaction fee from both sides of every trade and closes the book when the event resolves.

Kalshi charges a probability-weighted per-contract fee to both makers (order placers) and takers (order acceptors). The formula, simplified, produces fees that peak at 50/50 odds and decrease toward the extremes. Polymarket US charges a flat 0.10% taker fee. PredictIt, the US political market that nearly shut down after an enforcement action by the Commodity Futures Trading Commission (CFTC), charges 10% of gross profits plus a 5% withdrawal fee.

At scale, these percentages produce real money. Kalshi’s $263.5 million in 2025 fee revenue came from $22.88 billion in volume, which works out to roughly 1.15% of notional traded. Sacra estimates annualised revenue has since exceeded $1.5 billion.

Transaction fees are the primary revenue source. Secondary streams include data licensing (Polymarket has moved further in this direction in 2026, selling probability data to financial institutions and media), API access for institutional traders, and, for some platforms, market creation fees charged to entities that want to list specific contracts.

Sports drove 89% of Kalshi’s 2025 fee revenue. That distribution matters for any new entrant: the highest-volume markets are sports and politics, not the niche financial or geopolitical contracts that tend to attract the most regulatory scrutiny.

Here is the part that surprises most founders. There is no global consensus on what a prediction market is. Depending on the jurisdiction, the same product is a commodity derivatives exchange, a gambling service, an unlicensed financial instrument, or a product with no applicable framework at all – which defaults to a standard commercial relationship governed by general contract law.

United States

CFTC registration does not, however, resolve everything. Thirteen or more states have enforcement postures that treat prediction market contracts as gambling. Arizona filed a 20-count criminal information against Kalshi in March 2026, including charges of illegal gambling and election wagering. The CFTC sued Arizona on April 2, 2026, seeking to block criminal enforcement and won a temporary restraining order on April 10. Connecticut and Illinois face similar federal lawsuits. The Third Circuit affirmed a preliminary injunction for Kalshi against New Jersey in April 2026, finding the CEA preempts state gambling law as applied to CFTC-regulated event contracts. Courts in Maryland, Nevada, Ohio, and Massachusetts, however, have sided with state regulators at the preliminary injunction stage – meaning those specific benches have effectively favored local gambling enforcement over federal oversight.

The core legal question (whether CFTC oversight fully displaces state gambling law) may ultimately reach the Supreme Court. For any founder targeting US users, this is the single most important thing to understand. Federal registration is not a clean compliance path. State-level exposure is real, active, and varies by state.

European Union

France, Belgium, Poland, Portugal, Romania, Hungary, Italy, and Switzerland have all blocked or restricted access to Polymarket, treating it as unlicensed gambling. Spain ordered ISPs to block both Polymarket and Kalshi on May 26, 2026. Germany’s gambling authority has warned users that participation is illegal. Euronews reported in early January 2026 that Romania’s gambling regulator stated directly: “regardless of whether you bet in lei or crypto, if you bet money on a future result, under the conditions of a counterpart bet, we are talking about gambling that must be licensed.”

There is an additional compliance layer on top of this. Because Polymarket settles in USDC on Polygon, it falls within MiCA’s scope for the custody and transfer components. Since the end of MiCA’s grandfathering period in July 2026, any platform holding or transferring crypto for users in EU member states needs a CASP (crypto-asset service provider) license. A prediction market operating in the EU therefore needs both: a national gambling authorisation, at the member state level, and a MiCA CASP license, at the EU level, if it uses crypto settlement. No major prediction market currently holds both.

UK, Asia-Pacific, and other markets

The UK classifies prediction markets as gambling and requires Gambling Commission licensing. Singapore’s Gambling Regulatory Authority restricted Polymarket access in 2025. Australia’s ACMA determined in August 2025 that Polymarket was a prohibited and unlicensed regulated interactive gambling service under the Interactive Gambling Act 2001. As of early June 2026, Polymarket blocks users across 34 or more countries.

This is the point that gets founders into trouble. Incorporating in a permissive offshore jurisdiction (the British Virgin Islands, Cayman Islands, or Seychelles, for example) makes corporate setup straightforward and is a reasonable starting structure. What it does not do is allow the platform to serve users in France, Germany, the US (absent CFTC registration), the UK (absent Gambling Commission licensing), or any other jurisdiction that has blocked or regulated the product.

Geofencing is mandatory. Any operator handling real-money prediction contracts must block users from jurisdictions where the product is not permitted. Polymarket currently blocks users across more than 33 countries. Building and maintaining that compliance infrastructure is not optional; it is the operational baseline for avoiding criminal and civil exposure.

Offshore is a viable starting structure for platforms targeting markets that have not yet legislated, or for operators building toward a licensed pathway in priority markets. Gibraltar issued what is described as the first bespoke prediction market licence in Europe. Curacao, Anjouan, and similar offshore gaming jurisdictions offer faster, cheaper licensing with limited market access. These are real options for early-stage operators, but they come with a clear ceiling: banking relationships, payment processing, and access to institutional markets all depend on having credible regulatory standing.

Before writing code, a prediction market founder needs answers to three questions:

Which markets do I want to serve, and what does that require? The answer to this question determines the entire corporate and regulatory structure. US users require CFTC DCM registration or a partnership with an existing DCM. EU users require member state gambling authorisation plus MiCA CASP licensing. UK users require Gambling Commission licensing. A platform targeting only markets with no active restriction framework (parts of Latin America, Southeast Asia, Africa) needs a credible offshore structure with proper AML controls and a clear geofencing policy.

What is my product classification, and how do I defend it? The exchange model versus bookmaker distinction matters legally, but it is not settled. A legal opinion on how the platform’s specific contract mechanics are likely to be classified in each target jurisdiction is not a nice-to-have; it is the document that shapes every subsequent compliance decision.

What is my insider trading exposure? The CFTC issued an advisory on prediction market insider trading in February 2026. Two enforcement cases have already been brought involving a political candidate trading on his own candidacy and a YouTube channel employee trading ahead of video releases. Any serious platform operating political, financial, or sports markets needs written insider trading policies and technical surveillance from day one. This area is moving fast.

After launch, regulatory monitoring becomes an ongoing operational function. The prediction market space has produced more enforcement actions in the last 18 months than in the prior decade combined. A platform that is accessible in a given market today may face an ISP block, a cease-and-desist, or a criminal filing within months. Knowing what those changes mean for the platform’s existing users, fund positions, and contract obligations requires someone watching the regulatory environment actively.

There is no universal answer. The variables are target markets, product scope, and how much compliance infrastructure is built before the application versus after.

CFTC DCM registration in the US is the most rigorous process available. It requires demonstrating compliance with 23 statutory DCM core principles covering financial integrity, governance, market surveillance, information sharing, and customer protection. Industry estimates put the timeline at 12 to 24 months from filing to approval, with material legal and compliance costs throughout. Polymarket’s acquisition of QCEX (an existing licensed exchange) at $112 million is the clearest market signal for what established DCM status is worth when speed matters.

Gaming licensing in an offshore jurisdiction takes considerably less time. Curacao and Anjouan both offer 4 to 6 month timelines at significantly lower cost, with the trade-off of limited market access and reduced credibility with institutional counterparties and banks.

EU member state gambling licensing timelines vary by country. Malta’s MGA is a benchmark: the process typically runs 6 to 12 months and requires a local company, a certified gambling system, and a compliance programme meeting MGA standards. A MiCA CASP application layered on top adds parallel compliance work.

In all cases, the most expensive decision a founder can make is starting the licensing process with an incomplete compliance programme. Regulators in every jurisdiction expect to see a functioning AML/KYC framework, internal controls, and documented policies before the application is filed, not after.

Prediction markets have produced one of the clearest demonstrations in recent memory that regulatory infrastructure has direct commercial value. Polymarket spent $112 million to acquire it. Kalshi has spent years in federal court to defend it. The platforms that survive the enforcement wave of 2025 and 2026 are the ones that built compliance into the architecture before the regulators arrived, not the ones that treated it as a problem for later.

Founders looking at this space with genuine intent need a complete picture: the right corporate structure for their target markets, a legal opinion on product classification in each jurisdiction, a licensing roadmap, and AML controls operational from day one.