EEA Annex IX Financial Services 2026: what changes for companies with activity in Norway, Iceland and Liechtenstein

Key data

If your company operates in the European Economic Area—especially in Norway, Iceland or Liechtenstein—the regulatory environment for financial services has just been updated. The Decision No. 90/2026 of the EEA Joint Committee, adopted on 20 March 2026 and published on 25 June 2026, amends Annex IX of the EEA Agreement, which regulates financial services within the framework of the enlarged internal market.

The objective is straightforward: Norway, Iceland and Liechtenstein must apply exactly the same financial rules as EU Member States, incorporating the latest European legislation into the EEA regulatory framework. For Spanish companies with subsidiaries, branches or financial activity in these countries, this means a more uniform and predictable environment, but also the obligation to adapt procedures to the updated regulation.

What does this regulation establish?

The Agreement on the European Economic Area allows Norway, Iceland and Liechtenstein to participate in the EU internal market without being Member States. For this to work, its annexes must be updated periodically to incorporate EU legislation as it is approved.

Annex IX specifically covers financial services: banking, insurance, securities markets, payments and other regulated financial services. Decision 90/2026 updates this annex by incorporating new EU legislation, with the following concrete effects:

• The three EEA countries not belonging to the EU (Norway, Iceland and Liechtenstein) are obliged to apply the same financial rules as EU Member States.
• Financial entities operating in these countries must adapt their procedures to the updated regulation contained in the amended annex.
• Regulatory homogeneity is strengthened in the enlarged internal market, reducing the risk of regulatory arbitrage between EEA countries and EU countries.
• For Spanish companies with activity in the EEA, the regulatory environment for financial services becomes more uniform and predictable.

The amendment does not create a new regime from scratch: it updates the annex to reflect EU legislation already in force, closing the regulatory gap that could exist between EU countries and the three EEA countries.

Economic and operational impact

The main impact of this decision is operational and compliance-related. It does not introduce new fees or direct sanctions, but it does require affected entities to review and adapt their internal procedures in the three EEA countries.

The most relevant practical effects are:

• Reduction of regulatory arbitrage: Until now, there could be a gap between the rules applicable in the EU and those in force in Norway, Iceland or Liechtenstein. This decision closes that gap, eliminating the possibility of structuring financial operations in these countries to circumvent EU requirements.
• Greater predictability: Spanish companies with financial activity in the EEA can operate under a more homogeneous regulatory framework, which simplifies compliance management across multiple jurisdictions.
• Adaptation cost: Financial entities already operating in these markets will need to review their procedures to verify that they comply with the updated regulation incorporated into Annex IX. The cost will depend on the degree of divergence between their current procedures and the new incorporated regulation.
• Compliance risk: The decision entered into force on 20 March 2026, so affected entities should have already initiated the adaptation process.

Who does it affect?

This regulation directly affects:

• Financial entities (banks, insurance companies, fund managers, investment service companies) with activity in Norway, Iceland or Liechtenstein.
• Spanish companies with subsidiaries, branches or regulated activity in the financial sector in any of the three EEA countries not belonging to the EU.
• International financial groups operating simultaneously in the EU and in EEA countries, which will now see the applicable rules homogenized across all their jurisdictions.
• Advisors and consultants providing compliance services to entities with presence in the EEA.
• CFOs and compliance officers of companies with financial exposure in Norway, Iceland or Liechtenstein, who must verify the alignment of their procedures with the updated regulation.

Spanish companies without activity in Norway, Iceland or Liechtenstein are not directly affected by this decision.

Practical example

Imagine a Spanish financial entity with a branch in Oslo (Norway) that provides asset management services to institutional clients. Until Decision 90/2026, there could be a difference between the compliance obligations applicable in Spain (as an EU Member State) and those in force in Norway (as an EEA country).

With the update to Annex IX, the Oslo branch is subject to the same European financial rules as the parent company in Spain. This means that the compliance team must:

• Review what EU legislation has been incorporated into Annex IX through this decision.
• Verify whether the branch's current procedures in Norway already comply with that regulation or require adaptation.
• Update internal manuals and compliance controls to reflect the new homogeneous regulatory framework.

The benefit is clear: once the adaptation is complete, the entity can manage regulatory compliance in a unified manner for its operations in the EU and the EEA, reducing operational complexity and regulatory risk.

What should companies do now?

1. Identify exposure: Determine whether your company or group has regulated financial activity in Norway, Iceland or Liechtenstein. If not, this regulation does not directly affect you.
2. Review the updated Annex IX: Consult Decision 90/2026 on EUR-Lex to identify what EU legislation has been incorporated into Annex IX and its specific scope for your activity.
3. Audit current procedures: Compare the compliance procedures in force in your operations in EEA countries with the requirements of the EU regulation recently incorporated into Annex IX.
4. Adapt and document: Update the internal procedures, compliance manuals and controls necessary to align yourself with the updated regulation. Document the adaptation process.
5. Verify the entry into force date: The decision entered into force on 20 March 2026. If you have not yet initiated the adaptation process, do so urgently to avoid non-compliance situations.
6. Coordinate with local advisors: Since practical application depends on how each EEA country implements the regulation, consult with advisors specialized in Norway, Iceland or Liechtenstein as appropriate.

Official source

Consult complete regulation in official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202601293