EEA Financial Services 2026: what changes for entities with cross-border activity

Key data

Financial entities operating in the European Economic Area have a new regulatory review obligation following the adoption, on 20 March 2026, of Decision No. 91/2026 of the EEA Joint Committee. This decision amends the Annex IX of the EEA Agreement, relating to financial services, incorporating EU regulation into the legal framework shared between the Member States of the Union and the three EEA countries not belonging to it: Norway, Iceland and Liechtenstein.

The fact that should most catch the attention of executives and CFOs: entry into force is prior to official publication (25 June 2026), which means that the obligations arising from this decision are already enforceable from March. If your entity operates in any of these three territories and has not yet reviewed the impact of this update, there is a compliance gap that must be corrected immediately.

What does this regulation establish?

The EEA Joint Committee is the body responsible for ensuring that European Union regulation is incorporated uniformly into the legal system of EEA countries not belonging to the EU. When the EU approves new regulation on financial services, the Joint Committee must adopt a formal decision to extend that regulation to Norway, Iceland and Liechtenstein.

Decision 91/2026 does exactly that: updates Annex IX of the EEA Agreement by incorporating new EU provisions on financial services. The objective is to maintain regulatory homogeneity throughout the European single financial market, so that the rules of the game are the same both in an EU Member State and in the three EEA countries.

Economic and operational impact

The direct impact of this decision is operational and regulatory compliance. It does not establish specific fees or sanctions in its own text, but it does require affected entities to adapt their internal procedures to the new provisions incorporated into Annex IX.

The main impact vectors for organizations are as follows:

• Review of internal procedures: Any process linked to the provision of cross-border financial services in the EEA must be verified against the new provisions incorporated.
• Access to the single financial market: Compliance with the updated Annex IX is a necessary condition for maintaining access to the markets of Norway, Iceland and Liechtenstein on terms equivalent to those of the EU internal market.
• Cost of adaptation: Entities already operating under EU regulation will have a simpler adaptation, given that the provisions incorporated into the EEA are the same as those already applied in the Union. The main effort lies in verifying that the specific procedures for the three EEA countries are aligned.
• Risk of temporal lag: Entry into force (20 March 2026) is prior to publication (25 June 2026), which creates a period in which obligations were already enforceable without official publication having taken place.

Who does it affect?

• Credit institutions (banks, savings banks, credit cooperatives) with operations in Norway, Iceland or Liechtenstein.
• Investment service firms with cross-border activity in the EEA.
• Insurance and reinsurance companies with presence in the three non-EU EEA countries.
• Investment fund managers and asset management entities that distribute products in the EEA.
• Financial groups with subsidiaries, branches or regulated activity in Norway, Iceland or Liechtenstein.
• Legal advisors, compliance officers and CFOs of entities with cross-border activity in the EEA.
• Non-financial companies that access financing or regulated services in the non-EU EEA markets.

Practical example

A Spanish credit entity with a branch in Oslo (Norway) provides financial services under the European passport. Until Decision 91/2026, its compliance framework in Norway was governed by Annex IX of the EEA Agreement in its previous version. With the adoption of this decision on 20 March 2026, the new EU provisions on financial services—already incorporated into Annex IX—are also enforceable in Norway.

The compliance team of this entity must, first, identify what EU regulation has been incorporated into Annex IX through this decision, review whether the operational procedures of the Norwegian branch already comply with those provisions and, if not, execute an adaptation plan. Given that entry into force was in March and publication in June, the period of priority review is immediate.

What should companies do now?

1. Identify if the entity operates in the non-EU EEA: Verify if there is regulated activity, branches, subsidiaries or provision of services in Norway, Iceland or Liechtenstein. If the answer is yes, this decision is directly applicable.
2. Consult the full text of Decision 91/2026: Access the official source on EUR-Lex to identify exactly what EU regulation has been incorporated into Annex IX. This is the critical step to know what specific obligations are activated.
3. Review current compliance status: Compare the internal procedures in force for the three EEA countries with the new provisions incorporated. Prioritize processes with greater operational impact.
4. Execute the adaptation plan: Implement the necessary procedural changes. Given that entry into force was 20 March 2026, any lag must be corrected urgently.
5. Document the compliance process: Record the actions taken to demonstrate compliance to national and European supervisors.
6. Alert legal and compliance teams: Ensure that those responsible for regulatory compliance in each EEA jurisdiction are informed and have incorporated this update into their regulatory risk matrices.

Official source

Consult full regulation in official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202601294