The CFTC, VARA, and the Compliance Reckoning

This week's two biggest crypto-regulatory stories — the CFTC calling out sloppy self-certification practices at Kalshi and Polymarket, and Flowdesk picking up a full broker-dealer license from Dubai's VARA — look unrelated on the surface. They are not. Both signal the same structural shift: as crypto volumes go vertical, regulators are demanding infrastructure-grade compliance, and the firms that build it offshore first are gaining the most durable competitive advantages.

As of August 13, 2026. Sources: The Block, Covers, Sportico, crypto.news

---

The Week in One Sentence: Volume Ate the Rulebook

Prediction market event-contract volume is now measured in tens of billions per month —

Kalshi and Polymarket posted a combined $50.6 billion in trading volume during July, an all-time high for the sector.

That scale has torn through compliance frameworks that were designed for a much quieter market. The CFTC's advisory to Kalshi and Polymarket on self-certification, dropped July 24, is the regulator admitting that out loud. And Flowdesk's full VARA broker-dealer license, granted August 10, is a European firm demonstrating that the correct response to this environment is to over-invest in regulatory infrastructure — not to race past it.

The through-line this week is not enforcement. It is capacity. Regulators and operators alike are discovering that the compliance systems built in 2021–23 were not designed for markets trading over $1 billion a day.

---

What the CFTC Advisory Actually Said — and What It Didn't

On July 24, the CFTC's Division of Market Oversight released an advisory reminding Designated Contract Markets (DCMs), including Kalshi, Polymarket's U.S. entity, and Crypto.com's event-contract affiliate, about the strict legal procedures required for self-certifying new products.

The key point that most coverage missed:

the notice does not cite specific enforcement actions.

This is guidance, not a hammer.

The guidance doesn't ban grouping outright — it clarifies when closely related event contracts may still be certified as a class, or alternatively submitted for CFTC approval under Regulations §§ 40.2(d) or 40.3, the slower, pre-clearance track, rather than self-certified.

The practical problem that prompted the advisory is mechanical:

Kalshi alone processed over $27 billion in World Cup trading volume across 33,000 distinct event contracts. This sudden velocity compressed compliance review windows. When exchanges rush to list thousands of niche markets on tight schedules, relying on boilerplate templates introduces systemic operational risks if a settlement source fails or an event is delayed.

Equally notable is a second dimension to the CFTC's action flagged by CoinDesk: the regulator also warned that incentive programs used to drive trading may themselves be compliance problems.

Some of the rewards for high-volume participants can encourage them "to trade solely to reach volume targets, heightening risks of wash-trading, pre-arranged trading, or other fraudulent, manipulative, or disruptive trading practices."

Market-maker stipends got similar scrutiny:

market-maker programs guaranteeing net prices or covering losses "through stipends and rebates" could also encourage fraudulent behavior and market manipulation.

This is the CFTC telling operators that growth hacking on a derivatives exchange carries legal consequences. For platforms like Kalshi, which has built liquidity partly through structured market-maker programs, this demands an immediate audit of fee and incentive architecture.

---

The Self-Cert System Was Never Built for This Volume

Self-certification — where a DCM files a new contract with the CFTC and it goes live immediately unless the regulator objects within 24 hours — made sense when futures exchanges launched perhaps dozens of new contracts a year.

Driven by the 2026 World Cup, event contract trading set historic records, with Kalshi alone processing over $27 billion in World Cup trading volume across 33,000 distinct event contracts.

Thirty-three thousand contracts. Twenty-four-hour review windows. The arithmetic does not work.

The advisory is a structural acknowledgment that the self-cert regime needs procedural reinforcement for the new operating scale of prediction markets. The risk that regulators are flagging is not bad intent; it is operational brittlety. If a settlement data source for a batch-certified contract series goes offline mid-event — a realistic scenario with niche sports markets — the exchange faces cascading settlement failures across thousands of positions simultaneously. For context, Kalshi's single-day fee revenue reportedly topped $13 million on peak World Cup trading days, meaning the financial stakes of a settlement failure are no longer trivial.

The longer-term policy question this raises: should the CFTC formalize a tiered self-cert process — immediate listing for well-precedented contract types, expedited review for new categories — rather than applying a single 24-hour window regardless of novelty?

---

Insider Trading, Corporate Espionage, and a Market Coming of Age

The faulty-filings advisory arrived inside a much broader regulatory escalation cycle.

On April 22 and 23, 2026, Kalshi and the CFTC announced disciplinary and enforcement actions targeting insider trading in event contracts. The three Kalshi disciplinary matters involved political candidates who wagered on their own campaigns, while the CFTC's enforcement action was the agency's first-ever insider trading complaint concerning event contracts and involved an active-duty U.S. Army service member who allegedly traded Polymarket contracts using classified military intelligence.

The competitive dynamic between the two operators is making this harder to manage.

Polymarket even accused Kalshi of corporate espionage in interviews with the New York Post, a claim Kalshi denied.

Meanwhile,

CFTC Chair Michael Selig's approach has aided Kalshi's valuation run-up — last month, the firm said its most recent funding round came at a $22 billion valuation.

The institutional incentives are therefore misaligned in a specific way: Kalshi benefits from CFTC legitimacy while simultaneously lobbying the CFTC against its main competitor.

In a letter to the CFTC dated April 30, Kalshi co-founder Luana Lopes Lara asked Chair Selig to crack down on Polymarket for not doing enough to block U.S.

users. The regulator, appropriately, has not obliged on that specific request — though the self-certification advisory hits both operators equally.

---

The State-Federal Turf War Is the Real Macro Risk

The CFTC advisory cannot be separated from the broader jurisdictional conflict surrounding prediction markets.

The CFTC used its emergency authority under Section 8a(9) of the Commodity Exchange Act on August 11, 2026, to order KalshiEX to continue operating nationwide. The action came after New York Attorney General Letitia James filed a lawsuit seeking to shut down the platform and claiming more than $36 billion in damages.

New York alleges that Kalshi offers sports-related prediction markets to New York residents without obtaining a license from the New York State Gaming Commission, arguing that these contracts are gambling products subject to state regulation and that Kalshi owes taxes similar to those paid by licensed casinos and sports betting operators.

The judicial picture is fractured.

U.S. District Judge Analisa Torres denied Kalshi's motion for a preliminary injunction, ruling that New York's gambling laws are not preempted by the Commodity Exchange Act. The decision directly contradicts the Third Circuit's New Jersey ruling and makes a Supreme Court showdown increasingly inevitable.

If federal courts rule that prediction markets are exempt from state gambling regulation, states stand to lose tax revenue from a rapidly growing category of financial product.

That stakes map explains the ferocity of state-level opposition: this is not a consumer protection argument so much as a fiscal one.

The CFTC's self-cert advisory, read through this lens, is also a political signal — the agency demonstrating to Congress and the courts that it is an active, capable regulator of this market, not a permissive one. Regulatory legitimacy is being constructed in real time, partly to win the preemption argument.

---

Flowdesk and the Dubai Playbook: Compliance as Competitive Moat

The Kalshi-Polymarket story is about a regulator catching up to volume. The Flowdesk story is about a firm getting ahead of it.

Crypto market maker Flowdesk has secured a full broker-dealer license in Dubai, allowing the firm to provide regulated virtual asset services to qualified and institutional investors as it expands across major financial centers.

Dubai's Virtual Assets Regulatory Authority granted the license to Flowdesk Omega FZE. VARA's public register lists the license as active and authorizes Flowdesk to conduct broker-dealer services in and from Dubai.

The timing matters:

the authorization was issued on August 10, roughly two months after the subsidiary received in-principle approval in June. Just weeks earlier, Flowdesk Europe locked down its Crypto-Asset Service Provider status under the EU's Markets in Crypto-Assets (MiCA) framework, effective June 30.

That dual-jurisdiction posture —

holding regulatory approvals in both Dubai and Europe as a Crypto-Asset Service Provider by the Autorité des Marchés Financiers in France under MiCA

— is an institutional-grade liquidity provider making itself accessible to virtually every regulated pool of capital globally. It is a deliberate strategy:

Flowdesk Omega FZE is backed by BlackRock, Cathay Innovation, and Coinbase Ventures.

Those backers require regulatory cover before deploying meaningful capital.

VARA's framework makes this pathway possible because it is genuinely functional.

Dubai's 50 licensed VASPs exceed the totals reported in Hong Kong and Singapore, two other jurisdictions competing to attract regulated crypto businesses,

though

each jurisdiction licenses different types of crypto businesses, meaning the headline totals do not represent identical categories of firms.

What matters for Flowdesk is that VARA's broker-dealer category specifically unlocks institutional OTC relationships that Singapore's payments-oriented license framework does not neatly accommodate.

---

Dubai Is Not a Soft Option — VARA Has Teeth

A common misread of VARA licensing: that Dubai is a regulatory-arbitrage destination where oversight is nominal. This is inaccurate in 2026.

The receipt of the full license follows VARA's rigorous multi-stage licensing application process. Securing a license under VARA, widely recognized as one of the most sophisticated and transparent frameworks in the world for virtual assets, underscores the importance of licensing in one of the world's leading crypto hubs.

VARA's process for Flowdesk spanned at minimum two months from in-principle approval to full license — and that followed a prior application period.

Recent regulatory updates from VARA have targeted market abuse and anti-money laundering compliance, with new rules rolling out through 2025 and 2026.

The regulator also maintains a meaningful distinction between licensed and operational:

at the end of 2025, VARA classified 39 licensed VASPs as fully operational

— meaning a meaningful share of its licensee roster was still working through operational readiness requirements.

For institutional clients evaluating counterparties, this matters. A VARA broker-dealer license signals that VARA has reviewed capital requirements, AML controls, and custody arrangements — not just a corporate registration. Flowdesk's choice to pursue full broker-dealer status (rather than the more restricted proprietary trading category, which Wintermute holds) signals it intends to actively onboard institutional clients in the MENA region, not just use Dubai as a booking center.

The US SEC has noticed this dynamic.

The SEC has placed digital asset broker-dealer requirements on its 2026 regulatory agenda. In July, the agency listed possible amendments involving net capital, customer protection, recordkeeping, and financial responsibility requirements as they apply to crypto assets.

European and Gulf frameworks are setting the precedent that US regulators will eventually have to match.

---

The Counter-Argument

The bullish read on all of this is seductive: regulated volume is growing, institutions are engaging, compliance infrastructure is being built. But there is a credible opposing case.

On prediction markets: The CFTC's self-cert advisory and the state-versus-federal legal chaos actually reveal how fragile the current regulatory foundation is.

Combined monthly trading volume on Kalshi and Polymarket has grown to nearly $220 billion per annum

on a legal basis that multiple federal courts are currently contradicting each other about. If a circuit split produces an adverse Supreme Court ruling — or if Congress passes legislation that defers to state gaming authorities — the volume numbers evaporate.

Columbia University researchers estimated wash trading made up close to 25% of Polymarket's volume over a three-year stretch,

suggesting the headline volume figures already carry noise that regulatory scrutiny may surface.

On the Dubai playbook: The Flowdesk license is genuinely valuable, but broker-dealer licenses that restrict services to "qualified and institutional investors" are, by definition, not scaling to mass-market volumes.

Flowdesk did not say that the approval includes services for general retail customers.

A VARA license is a necessary condition for institutional distribution in MENA, not a sufficient one. Distribution takes years. Meanwhile, US-regulated competitors who survive the current legal turbulence will have home-market advantages that no offshore license replicates.

The stronger counter-argument, though, is systemic: regulatory proliferation across CFTC, MiCA, VARA, MAS, and SFC creates compliance cost burdens that only very well-capitalised firms can absorb. The likely outcome is consolidation, not democratisation — a market structure where three to five globally licensed operators control the bulk of institutional flow, and smaller players get regulatory arbitraged out of existence. That is great for Flowdesk, mediocre for innovation, and concerning for anyone who thought crypto's promise was a permissionless financial system.

---

What I'm Watching

1. The CFTC's formal event-contract rulemaking.

A proposal for the CFTC to regulate prediction markets such as Kalshi and Polymarket is under review by the White House, with details being reviewed by the Office of Management and Budget.

The advance notice of proposed rulemaking referenced repeatedly in enforcement actions is the document that will set the permanent compliance framework. Watch for OMB clearance timelines and whether the final rule addresses the self-cert problem the July 24 advisory flagged.

2. The Supreme Court petition timeline on CFTC preemption.

U.S. District Judge Torres denied Kalshi's preliminary injunction motion and found New York's gambling laws are not preempted by the Commodity Exchange Act — a ruling that directly contradicts the Third Circuit's New Jersey decision.

This circuit split is the predicate for a certiorari petition. Watch for Kalshi's legal filings in Q3 2026 and any CFTC amicus brief indicating how aggressively the agency will defend exclusive jurisdiction.

3. Polymarket's QCEX integration progress.

Polymarket's 2025-2026 acquisition of QCEX, a CFTC-licensed derivatives exchange, gives it a legal path to reopen to US retail traders under the same regulatory umbrella Kalshi has operated under from day one.

The speed and quality of that integration — technically, operationally, and in terms of CFTC sign-off — will determine whether Polymarket can close the volume gap. Current split:

Kalshi led July with $37.7 billion, while Polymarket revenue declined.

4. VARA's updated "fully operational" count for 2026.

At the end of 2025, VARA classified 39 licensed VASPs as fully operational, and the regulator said it is validating an updated figure for 2026.

The delta between licensed and operational tells you how much of VARA's growth is real commercial activity versus regulatory paper. Flowdesk's speed to market after licensing will be an indicator for the broader cohort.

5. The CFTC's incentive-program examination cycle. The July 24 advisory's warning on volume-based rewards and market-maker stipends was not a one-off comment. Watch for formal examination requests to Kalshi and Polymarket's compliance teams in Q3 and Q4, and whether either platform publicly adjusts its market-maker program terms. Any modification would be a trading signal on cost structure and fee revenue sustainability — both relevant inputs for anyone taking positions in the prediction market space itself.

---

Crypto assets carry substantial risk, including total loss of principal. Event contract positions on prediction market platforms are subject to regulatory change that may affect platform availability without notice. This article is analytical commentary and does not constitute investment or legal advice.