Blog
When the Rulebook Hasn’t Caught Up: Managing Emerging Risk Before the Rules Arrive
Alex Woodcock | 17 August 2026
In Part 1, we looked at prediction markets as a current emerging compliance risk and at how the response will likely draw on tools firms already have at their disposal, such as a personal-trading policy, communications surveillance, and information barriers, rather than a new regime built from scratch. Step back from the specifics, though, and a more universal problem comes into view. A problem that recurs whenever practice outruns regulation.
When we considered how firms should respond to prediction-market risk, we could not point to a single, settled rulebook. In the United States, the courts are split on the most basic question of who even regulates these products. And the same can be said in other jurisdictions.
And yet firms may have to act now, in real time, to manage the risks they face without waiting for the law to resolve. It is a standing condition of compliance that something new arrives — such as a market, a product, or a technology — faster than the framework that will eventually govern it. Artificial intelligence and blockchain-based assets sit in the same gap today, and something not yet on the radar will sit there next.
For many compliance professionals, the temptation can be to wait for clarity. It is an understandable instinct, but potentially a weak posture because the durable obligations do not wait.
A fund manager's duty to maintain reasonably designed, tailored policies and to supervise does not depend on how the jurisdictional fight resolves. Fiduciary duty, anti-fraud principles, and the obligation to protect confidential information apply now, whatever the eventual rule turns out to be.
Regulators assess conduct in hindsight, against standards that will have crystallized by the time they examine the facts. The absence of a specific rule today is not a safe harbor tomorrow.
A firm that waits has not avoided a decision; it has made one, and it will own it.
For some risks, informed monitoring — watching how the risk and the law develop, on a defined cadence, and recording why more is not yet warranted — is a perfectly defensible response, a middle ground of sorts between doing nothing and taking decisive action.
What matters is whether the choice was deliberate and documented, or just a default that arrived through neglect. "We considered this and concluded that monitoring is proportionate for now" is a documented position you can defend. Silence is not.
So how does an effective compliance function operate in the gap? A few principles travel well beyond this one topic:
Prediction markets make for a useful case study here, because they show what happens when one product must be classified under several regulatory regimes at once — each potentially reaching a different answer.
Take a U.S. registered investment adviser, as single node in a global fund ecosystem that also includes administrators, transfer agents, custodians, and corporate-services providers, frequently operating across multiple jurisdictions at once. For that adviser, the U.S. Advisers Act supplies the closest analogous framework: reasonably designed, tailored policies and a duty to supervise.
The same product, though, may get a different answer depending on where you look. U.S. courts cannot agree among themselves whether these contracts are swaps. This dispute began when New Jersey's gaming regulator tried to enforce state law against Kalshi's sports contracts. On appeal, a federal appeals court has held they likely are under exclusive federal jurisdiction that would preempt state gambling law. But a Nevada district court reached the opposite conclusion in a separate dispute, finding these are not swaps at all — and that ruling is now on appeal before the Ninth Circuit, in arguments involving Kalshi, Robinhood, and Crypto.com. If the Ninth Circuit upholds it, the resulting circuit split would put the question squarely in front of the Supreme Court. For now, whether the Court ultimately resolves the split remains an open question; the case has not yet been scheduled for review, let alone decided.
The E.U.'s markets supervisor, meanwhile, has signaled that binary event contracts can qualify as financial instruments subject to a retail prohibition, even as individual member states move against them under gambling law instead.
For a group operating across these jurisdictions, that leaves no single answer to plan around — a likely swap here, a restricted retail derivative there, and open disagreement within either camp. "Reason by analogy" and "follow the most restrictive plausible standard" stop being abstractions in that setting; they are the only way to write a policy that holds up everywhere you operate.
Why does the disagreement persist? Largely because regulators are focused elsewhere. Across regimes, it seems the energy has gone into classifying the product and protecting retail investors, not into what happens when the product is misused inside a regulated firm — so far, that question has begun to be answered through enforcement rather than developing new ones.
The market has not waited for the rulemaking to catch up. Kalshi, along with Polymarket, recently partnered with several compliance technology providers to bring their trade data into the surveillance tools firms already use for traditional securities among other purposes. No rule required it, yet the demand for oversight showed up on its own.
That is the crux for a fund manager: the rule this problem needs may never be written, at least not on the current trajectory, so the existing broad obligations in play are not a stopgap until something more specific arrives.
That said, over-engineering a response in these situations comes at a price. Proactive commitments will become the yardstick you are later measured against, and building a heavy control regime for a still-small risk carries real cost — in resources, in credibility, and in commitments you may not be able to keep.
"Principled" has to mean proportionate, reasoned, and documented, not maximalist. A firm that announces a rigorous posture and then does not operate it has manufactured its own exam finding. The goal is defensible judgment, not theatre.
This is also, in the end, how an examiner is likely to look at it. Reasonable procedures are tailored procedures; a generic policy bolted on after the fact rarely satisfies.
What could also hold up is evidence that a firm inventoried the information it actually holds, reasoned through how it could be misused, and adopted a proportionate response with the reasoning documented. What protects you is not an unenforceable ban — it's the record of a decision you can defend.
Acting ahead of prescriptive regulation is not gold-plating, and it is not about being seen to do the right thing. It is what the durable obligations already require, rule or no rule.
If it does, the firms in the strongest position will be the ones that did not wait for it — that treated the gap not as permission to defer, but as the moment their judgment mattered most. Prediction markets are today's example; the next may be AI, or tokenized assets, or something not yet named. The discipline is the same.
Is your firm monitoring emerging risk, or just hoping it resolves? Let's talk about turning "we're watching this" into a documented position you can articulate and defend.
When we considered how firms should respond to prediction-market risk, we could not point to a single, settled rulebook. In the United States, the courts are split on the most basic question of who even regulates these products. And the same can be said in other jurisdictions.
And yet firms may have to act now, in real time, to manage the risks they face without waiting for the law to resolve. It is a standing condition of compliance that something new arrives — such as a market, a product, or a technology — faster than the framework that will eventually govern it. Artificial intelligence and blockchain-based assets sit in the same gap today, and something not yet on the radar will sit there next.
Why Waiting Might Not Help
For many compliance professionals, the temptation can be to wait for clarity. It is an understandable instinct, but potentially a weak posture because the durable obligations do not wait.
A fund manager's duty to maintain reasonably designed, tailored policies and to supervise does not depend on how the jurisdictional fight resolves. Fiduciary duty, anti-fraud principles, and the obligation to protect confidential information apply now, whatever the eventual rule turns out to be.
Regulators assess conduct in hindsight, against standards that will have crystallized by the time they examine the facts. The absence of a specific rule today is not a safe harbor tomorrow.
Doing Nothing is a Choice Too
A firm that waits has not avoided a decision; it has made one, and it will own it.
For some risks, informed monitoring — watching how the risk and the law develop, on a defined cadence, and recording why more is not yet warranted — is a perfectly defensible response, a middle ground of sorts between doing nothing and taking decisive action.
What matters is whether the choice was deliberate and documented, or just a default that arrived through neglect. "We considered this and concluded that monitoring is proportionate for now" is a documented position you can defend. Silence is not.
How to Act Without a Rulebook
So how does an effective compliance function operate in the gap? A few principles travel well beyond this one topic:
- Anchor to the duties that already bind you, not the rule still being drafted.
- Borrow the closest existing framework and reason from there.
- When regimes disagree, default to the toughest one.
- Write it down. The record of your thinking is what protects you when there's no rule to point to.
- Right-size the response and never commit to more than you can actually deliver.
- Set a review date now, before the risk moves again.
The Global Picture
Prediction markets make for a useful case study here, because they show what happens when one product must be classified under several regulatory regimes at once — each potentially reaching a different answer.
Take a U.S. registered investment adviser, as single node in a global fund ecosystem that also includes administrators, transfer agents, custodians, and corporate-services providers, frequently operating across multiple jurisdictions at once. For that adviser, the U.S. Advisers Act supplies the closest analogous framework: reasonably designed, tailored policies and a duty to supervise.
The same product, though, may get a different answer depending on where you look. U.S. courts cannot agree among themselves whether these contracts are swaps. This dispute began when New Jersey's gaming regulator tried to enforce state law against Kalshi's sports contracts. On appeal, a federal appeals court has held they likely are under exclusive federal jurisdiction that would preempt state gambling law. But a Nevada district court reached the opposite conclusion in a separate dispute, finding these are not swaps at all — and that ruling is now on appeal before the Ninth Circuit, in arguments involving Kalshi, Robinhood, and Crypto.com. If the Ninth Circuit upholds it, the resulting circuit split would put the question squarely in front of the Supreme Court. For now, whether the Court ultimately resolves the split remains an open question; the case has not yet been scheduled for review, let alone decided.
The E.U.'s markets supervisor, meanwhile, has signaled that binary event contracts can qualify as financial instruments subject to a retail prohibition, even as individual member states move against them under gambling law instead.
For a group operating across these jurisdictions, that leaves no single answer to plan around — a likely swap here, a restricted retail derivative there, and open disagreement within either camp. "Reason by analogy" and "follow the most restrictive plausible standard" stop being abstractions in that setting; they are the only way to write a policy that holds up everywhere you operate.
Why does the disagreement persist? Largely because regulators are focused elsewhere. Across regimes, it seems the energy has gone into classifying the product and protecting retail investors, not into what happens when the product is misused inside a regulated firm — so far, that question has begun to be answered through enforcement rather than developing new ones.
The market has not waited for the rulemaking to catch up. Kalshi, along with Polymarket, recently partnered with several compliance technology providers to bring their trade data into the surveillance tools firms already use for traditional securities among other purposes. No rule required it, yet the demand for oversight showed up on its own.
That is the crux for a fund manager: the rule this problem needs may never be written, at least not on the current trajectory, so the existing broad obligations in play are not a stopgap until something more specific arrives.
Principled, Not Maximalist
That said, over-engineering a response in these situations comes at a price. Proactive commitments will become the yardstick you are later measured against, and building a heavy control regime for a still-small risk carries real cost — in resources, in credibility, and in commitments you may not be able to keep.
"Principled" has to mean proportionate, reasoned, and documented, not maximalist. A firm that announces a rigorous posture and then does not operate it has manufactured its own exam finding. The goal is defensible judgment, not theatre.
This is also, in the end, how an examiner is likely to look at it. Reasonable procedures are tailored procedures; a generic policy bolted on after the fact rarely satisfies.
What could also hold up is evidence that a firm inventoried the information it actually holds, reasoned through how it could be misused, and adopted a proportionate response with the reasoning documented. What protects you is not an unenforceable ban — it's the record of a decision you can defend.
Acting ahead of prescriptive regulation is not gold-plating, and it is not about being seen to do the right thing. It is what the durable obligations already require, rule or no rule.
The Rulebook May Catch up Eventually
If it does, the firms in the strongest position will be the ones that did not wait for it — that treated the gap not as permission to defer, but as the moment their judgment mattered most. Prediction markets are today's example; the next may be AI, or tokenized assets, or something not yet named. The discipline is the same.
Is your firm monitoring emerging risk, or just hoping it resolves? Let's talk about turning "we're watching this" into a documented position you can articulate and defend.