EEA Annex III on Financial Services Updated: What Companies Must Review in 2026

Key data

Spanish financial entities operating in the European Economic Area face a new compliance review obligation. The Decision No. 177/2026 of the EEA Joint Committee, adopted on June 5, 2026, modifies Annex IX of the EEA Agreement, which regulates financial services applicable to EEA countries not belonging to the European Union: Norway, Iceland, and Liechtenstein.

The purpose of this modification is to ensure regulatory homogeneity in the enlarged internal market, incorporating the most recent European financial regulation into the EEA legal framework. For any financial sector company with cross-border operations in these three countries, this is not a minor change: it requires verifying whether the incorporated regulatory acts affect their activities and, if necessary, adapting compliance processes.

What does this regulation establish?

The Agreement on the European Economic Area extends the EU single market to Norway, Iceland, and Liechtenstein. For this market to function homogeneously, the EEA Joint Committee periodically updates its thematic annexes by incorporating applicable European legislation.

Annex IX specifically contains the regulation of financial services. When the EU approves new financial regulation, the Joint Committee must decide whether and how to incorporate it into the EEA Agreement so that it also applies in the three non-EU countries of the space.

Decision 177/2026 does precisely that: it updates Annex IX with recent European financial regulation, ensuring that the rules of the game are the same for all operators in the enlarged internal market, regardless of whether they operate in an EU Member State or in one of the three EEA countries.

Economic and operational impact

The direct impact of this decision is not punitive in nature nor does it involve new fees. Its effect is operational and compliance-related: financial entities already operating in Norway, Iceland, or Liechtenstein must verify that their processes, contracts, and service structures remain compliant with the updated regulation that now forms part of the EEA Agreement.

Associated costs are primarily legal review and internal adaptation costs:

• Audit of regulatory compliance of current cross-border operations against the new requirements incorporated into Annex IX.
• Possible updating of contracts, internal procedures, or service delivery structures in the three EEA countries.
• Coordination with local legal advisors in Norway, Iceland, and/or Liechtenstein to verify national transposition of the incorporated regulation.

The risk of inaction is regulatory non-compliance in foreign markets, with the regulatory consequences this may entail in each jurisdiction.

Who does it affect?

• Spanish or European banks and credit institutions with branches, subsidiaries, or cross-border service provision in Norway, Iceland, or Liechtenstein.
• Investment firms and fund managers that operate or distribute products in the financial markets of these three countries.
• Insurance and reinsurance companies with activity in the EEA space outside the EU.
• Payment and electronic money institutions with active services in Norway, Iceland, or Liechtenstein.
• CFOs and compliance officers of financial groups with presence in the non-EU EEA.
• Legal advisors and consultants providing services to financial entities with operations in these countries.

Practical example

A Spanish fund manager that distributes its investment products in Norway through a cross-border distribution agreement must, following the entry into force of Decision 177/2026 on June 5, 2026, review whether the European financial regulation incorporated into Annex IX of the EEA Agreement affects the conditions of that distribution agreement.

In practice, this means that the compliance department must:

1. Identify which specific regulatory acts have been incorporated into Annex IX through this decision.
2. Compare those acts with the activities the fund manager develops in Norway.
3. Determine whether it is necessary to update contracts, prospectuses, marketing procedures, or service structures to maintain regulatory compliance in that market.

The same exercise applies to any financial entity with active presence in Iceland or Liechtenstein.

What should companies do now?

1. Identify exposure: Determine whether the company has active financial services operations in Norway, Iceland, or Liechtenstein. If there is no presence in these three countries, this decision does not generate immediate obligations.
2. Review the updated Annex IX: Consult the full text of Decision 177/2026 on EUR-Lex to identify which specific regulatory acts have been incorporated into the EEA Agreement.
3. Audit current compliance: Compare the entity's cross-border activities with the new requirements incorporated. This review should be conducted with retroactive effect from June 5, 2026, the date of entry into force.
4. Coordinate with local advisors: Involve legal advisors in the affected EEA countries to verify how the incorporated regulation has been transposed or applied locally.
5. Update internal procedures: If the review detects misalignments, update contracts, compliance procedures, product documentation, or service structures as appropriate.
6. Document the process: Keep written record of the review conducted and the conclusions reached, as evidence of due diligence in the face of possible regulatory inspections.

Official source

Consult complete regulation at official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202602001