Europe’s top securities regulator has formally put the links between crypto and traditional finance on its risk map. In its second risk monitoring report of 2026, published Sept. 10, the European Securities and Markets Authority named tokenized equities, decentralized finance exploits and prediction markets as three areas where shocks could spill from crypto markets into the broader financial system.
The report lands at a sensitive moment. Crypto prices have erased nearly 2 trillion euros in market value since their October peak, while ties between digital asset platforms and established financial firms keep multiplying. ESMA kept market, contagion and operational risks at their highest classification and left credit risk rated high, tied to geopolitical tensions, persistent inflation and rising borrowing costs. Environmental risk was the only category scored medium.
Tokenized equities, up 6.5 times in 18 months
The sharpest growth numbers concern tokenized stocks. Outstanding tokenized equities stood at roughly 1.9 billion euros at the end of June, up from about 300 million euros at the end of 2024, a 6.5-fold rise in eighteen months. Most activity is concentrated in large U.S.-listed technology companies, whose market value, liquidity and name recognition make them the natural candidates for tokenization products. ESMA is careful to note the total remains negligible beside global stock markets. The concern is not size but structure.
Most of that activity runs through wrapped products, where a token gives its holder a claim on shares held by someone else. The blockchain transfer does not normally change the shareholder recorded in the company’s official register. That creates dependencies on tokenization platforms and custodians, and it raises a question the report does not answer: what a token holder actually holds if the platform or custodian fails.
ESMA also warned that multiple tokens tracking the same share can trade across platforms without being fully interchangeable, which can divide liquidity and weaken price discovery in stressed markets. Settlement adds another wrinkle. Some transfers occur on-chain while the corresponding cash payment moves through conventional systems, a hybrid structure that requires reconciliation between separate infrastructures and limits the settlement-risk savings tokenization promises.
The United States is testing a different model. The SEC has proposed recognizing blockchain databases as official securities ownership records, subject to transfer-agent controls, with public comments open for 60 days. If adopted, it would move American tokenized equities closer to being the real thing rather than a claim on a claim. Institutional money is arriving too: Nasdaq agreed to invest $100 million in Kraken parent Payward, and the two companies plan to launch Nasdaq Equity Tokens in the second quarter of 2027.
Prediction markets and the detection problem
On prediction markets, ESMA counted quarterly volume of roughly $12 billion on Polymarket and $8.8 billion on Kalshi in the fourth quarter of 2025. Sports made up 73% of identified Kalshi activity, while Polymarket’s volume split 29% politics, 19% sports and 15% crypto. The two platforms differ in design: Polymarket runs on-chain trading and settlement with centralized market administration, while Kalshi operates as a CFTC-regulated designated contract market.
The regulator’s core concern is conduct. Pseudonymous accounts make insider trading, wash trades and coordinated manipulation harder to spot. ESMA cited reports that newly created wallets earned $1.2 million shortly before February’s U.S.-Israeli strikes on Iran became public, while noting it did not identify the traders or establish that any law was broken. It also flagged a police complaint filed by the French weather service Meteo-France in April over suspected interference with sensors feeding Polymarket weather markets, a reminder that oracle integrity is not a theoretical problem.
Geographic controls drew skepticism. Polymarket and Kalshi restrict users in some EU countries, but ESMA questioned why the lists do not cover every member state and described the effectiveness of platform controls as “uncertain,” since virtual private networks can bypass country blocks.
DeFi plumbing gets a mention
On DeFi, ESMA noted that programmable securities could automate dividends, stock splits and regulatory checks, and that the same code could connect tokenized stocks to lending protocols as collateral. A smart contract error can misdirect a transfer or misallocate ownership, and blockchain immutability makes the result hard to reverse once it enters the ledger. Recent DeFi exploits have kept those concerns fresh.
The regulator did not claim crypto currently threatens EU financial stability. It asked for monitoring as the links deepen, citing the DLT Pilot Regime, common technical standards and the European Central Bank’s Pontes and Appia projects as work already addressing legal and settlement barriers. It also struck a note of caution on the technology’s promised benefits: atomic settlement can remove the delay between delivery and payment, but settling each transaction individually may require more immediate liquidity than systems that net many obligations together.
“Investor optimism continues to support elevated valuations despite rising geopolitical tensions and a weakening economic outlook,” ESMA Chair Verena Ross said, warning that an abrupt correction could follow if sentiment turned or economic risks materialized.
A transatlantic split on who regulates what
The report also sketches the jurisdictional fight over prediction markets. In the United States, the CFTC has sued several states, including New York and Illinois, to defend federal jurisdiction over event contracts, and New Jersey petitioned the Supreme Court on Sept. 2 asking it to settle the question. At least 20 states have filed lawsuits over whether sports event contracts fall under state gambling law. The Supreme Court has not said whether it will take the case.
In the EU, the same contracts can fall under MiFID II, MiCA or national gambling law depending on their structure, and derivatives-classified contracts can face national bans on sales to retail investors. Malta became the first member state to publicly explore a dedicated prediction-market framework in March, though no final regime has been enacted.
For EU supervisors the practical asks are modest but concrete: closer monitoring of transmission channels between crypto and conventional markets, attention to platform dependencies in wrapped equity structures, and scrutiny of settlement designs that split the asset leg and the cash leg across two systems. None of it amounts to new rules. It amounts to a warning that the bridges are being built faster than the inspection regime that should come with them.
The direction of travel is what matters. Tokenized equities remain tiny next to global stock markets, and ESMA stops short of calling crypto systemic. But the report treats the connection itself as the risk: as more bridges are built between the two systems, the paths for a shock to cross them multiply.