New EEA Financial Services Rules 2026: What Banks and Asset Managers Must Review

Key data

Banks, insurers and Spanish fund managers operating in the European Economic Area face new regulatory compliance requirements. EEA Joint Committee Decision No. 144/2026, adopted on 30 April 2026 and published in the Official Journal of the EU on 23 July 2026, amends Annex IX of the EEA Agreement, which regulates financial services in the expanded common European space.

The mechanism is the usual one in the EEA: when the EU approves new financial legislation, the Joint Committee incorporates it into the EEA Agreement so that it also applies in the three non-EU countries in the space—Norway, Iceland and Liechtenstein. This decision does exactly that: it updates the regulatory framework applicable to financial intermediaries active in those markets.

What does this regulation establish?

Decision 144/2026 amends Annex IX of the EEA Agreement, which is the specific annex dedicated to financial services. Its function is to ensure that EU financial regulations apply uniformly also in Norway, Iceland and Liechtenstein, countries that are part of the internal European market without being EU members.

The changes incorporated affect the obligations that financial entities must comply with to operate in these markets. Specifically, the decision updates requirements in three key areas:

• Registration: Review of registration requirements for entities operating in non-EU EEA countries.
• Authorization: Possible changes in the conditions under which a Spanish entity can provide cross-border financial services in Norway, Iceland or Liechtenstein.
• Reporting: New or modified information and communication obligations to the supervisors of these countries.

The EEA Agreement allows financial entities from the EU to operate in these three countries under the European passport principle. Any change to Annex IX alters the conditions of that passport and, therefore, the compliance obligations of entities using it.

Economic and operational impact

The direct impact of this decision is operational and regulatory compliance in nature. No new fees or direct economic amounts are established in the decision itself, but non-compliance with the new requirements may result in:

• Loss or suspension of the European passport to operate in Norway, Iceland or Liechtenstein.
• Administrative sanctions imposed by the financial supervisors of those countries.
• Obligation to adapt internal reporting and authorization processes, with the operational cost that entails.
• Risk of interruption of cross-border activity if compliance with the new requirements cannot be demonstrated.

For entities with significant business volume in these markets—especially fund managers and insurers with distribution in Norway—the cost of a preventive compliance review is significantly lower than the risk of supervisory sanctions or operational disruption.

Who does it affect?

The regulation directly affects all Spanish financial entities with activity in the non-EU EEA. Specifically:

• Banks and credit institutions that operate or have branches in Norway, Iceland or Liechtenstein.
• Insurers and reinsurers that distribute products or have active contracts in these markets.
• Investment fund managers (SGIIC, SICAV, UCITS or AIFMD managers) that market vehicles in the three countries.
• Other financial intermediaries: investment services companies (ESI), crowdfunding platforms and payment institutions with cross-border activity in the EEA.
• Financial groups with subsidiaries or holdings domiciled in Norway, Iceland or Liechtenstein.

Entities that operate exclusively in Spain and in other EU countries are not directly affected by this decision, since EU regulations already apply directly to them.

Practical example

A Spanish fund manager that markets a UCITS fund in Norway through the European passport must verify whether the new requirements incorporated into Annex IX of the EEA Agreement modify its notification obligations before the Norwegian supervisor (Finanstilsynet).

If the update to Annex IX incorporates, for example, new periodic reporting requirements or modifies the conditions of passport notification, the fund manager will need to:

1. Identify exactly what EU legislation has been incorporated into Annex IX through this decision.
2. Compare those requirements with its current internal procedures.
3. Adapt its reporting processes and, if necessary, submit new documentation to the Norwegian supervisor before it requires compliance.

The same analysis applies to a Spanish insurer with active policies in Iceland or a bank with a branch in Liechtenstein. The key is that entry into force is 30 April 2026, so technically the adaptation period has already begun.

What should companies do now?

1. Identify if they operate in the non-EU EEA: Verify whether the entity has activity—direct or through passport—in Norway, Iceland or Liechtenstein. If not, this decision does not generate direct obligations.
2. Review the full text of the decision: Access the official publication on EUR-Lex to identify exactly what EU legislation has been incorporated into Annex IX and what specific changes it introduces.
3. Evaluate the impact on registration, authorization and reporting: Compare the new requirements with current internal procedures regarding cross-border regulatory compliance.
4. Consult with the local supervisor: If there are doubts about how the new requirements apply in each EEA country, contact the corresponding financial supervisor (Finanstilsynet in Norway, FME in Iceland, FMA in Liechtenstein).
5. Update compliance documentation: If changes in obligations are detected, adapt internal procedures, contracts and regulatory documentation before the supervisor requires proof of compliance.
6. Document the analysis performed: Regardless of the outcome, keep internal record of the impact analysis. This protects the entity in the event of a supervisory inspection.

Official source

View complete regulation on official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202601482