EEA and financial services 2026: what changes for entities operating in Norway, Iceland and Liechtenstein

Key data

If your financial entity operates in Norway, Iceland or Liechtenstein—or if any of those entities operate in Spain—the rules of the game have just been updated. The Decision 36/2026 of the EEA Joint Committee, adopted on 6 February 2026 and published on 21 May 2026, amends Annex IX of the EEA Agreement, which regulates financial services in the European Economic Area.

The change is not minor in terms of scope: it requires the three non-EU EEA countries to apply the same updated European financial regulation as EU Member States. This directly affects the conditions under which cross-border operations are conducted in the enlarged internal market.

What does this regulation establish?

The Agreement on the European Economic Area integrates Norway, Iceland and Liechtenstein into the EU's internal market without them being Member States. For this integration to work, both parties must apply the same rules in key matters, including financial services, which are set out in Annex IX of the Agreement.

When the EU approves new financial regulation, the EEA Joint Committee—a parity body between the EU and the three EEA countries—must decide whether and how it is incorporated into the Agreement. Decision No. 36/2026 is precisely that incorporation decision: it updates Annex IX to reflect new European regulation on financial services.

The resulting harmonization strengthens legal certainty in financial operations within the enlarged internal market, reducing regulatory uncertainty for entities operating on both sides of the EU-EEA border.

Economic and operational impact

The concrete impact depends on what specific European financial regulation has been incorporated through this decision. What is clear is the type of operational consequences that this type of update typically generates in affected entities:

• Market access requirements: The conditions under which a Spanish financial entity can operate in Norway, Iceland or Liechtenstein—or vice versa—may have changed. This includes authorizations, financial passports and conditions for providing cross-border services.
• Supervision obligations: The updated regulation may introduce new reporting, audit or supervision requirements applicable to operations in the three non-EU EEA countries.
• Regulatory compliance: The compliance departments of entities with presence in these markets must verify whether their internal procedures remain valid under the new rules incorporated into Annex IX.
• Improved legal certainty: Harmonization reduces the risk of regulatory divergences between the EU and EEA countries, which can simplify the management of cross-border operations in the medium term.

Since the decision has been in force since 6 February 2026, any operation carried out from that date must comply with the new conditions of the modified Annex IX.

Who does it affect?

This regulation directly affects:

• Spanish or EU banks and credit institutions with branches, subsidiaries or service provision in Norway, Iceland or Liechtenstein.
• Investment entities and fund managers operating in the financial market of the three non-EU EEA countries.
• Insurance and reinsurance companies with cross-border activity in the EEA scope.
• Financial entities from Norway, Iceland or Liechtenstein operating in Spain or any EU Member State.
• Compliance and legal departments of any financial group with presence in the enlarged EEA.
• Financial and legal advisors providing services to entities with cross-border operations in the EEA.

Practical example

Imagine a Spanish bank with a branch in Oslo (Norway) that provides corporate financing services to local companies. Until now, that branch operated under the conditions set out in Annex IX of the EEA Agreement in its previous version.

With the entry into force of Decision 36/2026 on 6 February 2026, Annex IX has been updated to incorporate new European financial regulation. The bank must:

1. Identify what specific European regulation has been incorporated into Annex IX through this decision, by consulting the full text published in the EU Official Journal.
2. Assess whether that regulation affects the authorization, supervision or reporting conditions of its branch in Oslo.
3. Adapt its internal compliance procedures if the new requirements differ from those it has been applying.

The same exercise applies in reverse: a Norwegian financial entity operating in Spain must verify whether the update to Annex IX modifies the conditions under which it provides its services in Spanish territory.

What should companies do now?

1. Consult the full text of Decision 36/2026: Access the text published in the EU Official Journal to identify exactly what European financial regulation has been incorporated into Annex IX. This is the essential preliminary step for any impact analysis.
2. Map the affected cross-border operations: Identify what activities of your entity are carried out in Norway, Iceland or Liechtenstein, or come from entities in those countries to the EU. Focus the analysis on market access, supervision and regulatory compliance areas.
3. Review current authorizations and financial passports: Verify whether the authorizations under which you operate in non-EU EEA countries remain valid under the new conditions of the modified Annex IX.
4. Update compliance procedures: If the incorporated regulation introduces new reporting, audit or supervision requirements, update your internal procedures accordingly.
5. Engage with regulatory authorities: Contact the relevant supervisory authorities in the countries where you operate to clarify the practical application of the new requirements.
6. Document the transition: Keep records of the measures taken to adapt to the new regulatory framework, as this may be required in supervisory inspections.

Disclaimer: This article is for informational purposes only and does not constitute legal or financial advice. The interpretation and application of Decision 36/2026 may vary depending on the specific circumstances of each entity and the jurisdiction in which it operates. We recommend consulting with specialized legal and compliance advisors before making any decisions based on this information. The content is based on publicly available information as of the publication date and may be subject to updates or clarifications by the competent authorities.