EEE Financial Services 2025: What Changes for Companies Operating in Norway, Iceland and Liechtenstein

Key data

Spanish companies with financial activity in the European Economic Area have an active regulatory review obligation as of 5 December 2025. Decision 297/2025 of the EEE Joint Committee amends Annex IX of the EEE Agreement, the text that regulates how European financial services regulation applies in the three EEE countries that are not members of the European Union: Norway, Iceland and Liechtenstein.

The objective of this amendment is to ensure regulatory homogeneity in the enlarged internal market, incorporating new European financial sector regulation into the EEE legal framework. In practice, this means that the rules for operating financially in these three countries are updated to align with the latest regulatory developments in the EU.

What does this regulation establish?

The European Economic Area Agreement allows Norway, Iceland and Liechtenstein to participate in the EU internal market without being full members. For this to work, the EEE Joint Committee periodically updates the annexes to the Agreement to incorporate European regulation as it is approved.

Annex IX specifically contains the regulation applicable to financial services. With Decision 297/2025, adopted on 5 December 2025, new European financial sector rules are incorporated into that annex, so that entities operating in Norway, Iceland and Liechtenstein are subject to the same requirements that already apply in EU countries.

The amendment ensures that the financial regulation applicable in these three countries remains aligned with the regulation in force in the EU, avoiding divergences that could create barriers or asymmetries in cross-border operations.

Economic and operational impact

For Spanish companies, the main impact is operational and regulatory compliance in nature. Operating in Norway, Iceland or Liechtenstein under the EEE Agreement umbrella means that internal procedures must be updated each time the Joint Committee incorporates new rules into Annex IX.

The main operational effects are:

• Procedure review: Financial entities with activity in these countries must verify that their internal processes comply with the new requirements incorporated into Annex IX.
• Cross-border operations: Spanish companies that carry out cross-border financial operations with Norway, Iceland or Liechtenstein must be aware of the regulatory changes affecting those transactions.
• Regulatory homogeneity: The update ensures that there are no regulatory differences between operating in an EU country and doing so in these three EEE countries, which simplifies compliance management for companies operating in multiple jurisdictions.
• Immediate adaptation: Entry into force was 5 December 2025, prior to publication in the OJ (16 April 2026), so companies must verify whether they are already in compliance.

Who does it affect?

This amendment directly affects:

• Spanish financial entities with branches, subsidiaries or regulated activity in Norway, Iceland or Liechtenstein.
• Banks and credit institutions that operate or provide cross-border services in the three non-EU EEE countries.
• Investment firms and fund managers with activity in the Norwegian, Icelandic or Liechtenstein financial market.
• Insurance and reinsurance companies with operations in these territories.
• Spanish business groups with subsidiaries or holdings in the financial sector of Norway, Iceland or Liechtenstein.
• Financial advisors and consultants who provide services to clients with activity in these countries and need to know the updated regulatory framework.
• CFOs and financial directors of companies with cross-border operations in the EEE who must ensure regulatory compliance of their group.

Practical example

A Spanish financial entity operating in Norway through a branch has the obligation to comply with the regulation contained in Annex IX of the EEE Agreement. When the Joint Committee adopts Decision 297/2025 and incorporates new European rules into that annex, that branch is automatically subject to the new requirements, just as it would be if it operated in any EU country.

In practice, the compliance team of that entity must: identify what specific European rules have been incorporated into Annex IX through this decision, assess whether the current procedures of the Norwegian branch already comply with those requirements and, if not, implement the necessary adjustments. Since entry into force was 5 December 2025, any operation carried out from that date must already comply with the new framework.

The same reasoning applies to a Spanish company with an asset management subsidiary in Liechtenstein or an insurance group with operations in Iceland.

What should companies do now?

1. Identify exposure: Determine whether your company or group has regulated financial activity in Norway, Iceland or Liechtenstein, either directly or through subsidiaries, branches or holdings.
2. Review the updated Annex IX: Consult the full text of Decision 297/2025 in the Official Journal of the EU to identify what specific European regulation has been incorporated into Annex IX.
3. Assess current compliance: Compare current internal procedures with the new requirements incorporated. Entry into force was 5 December 2025, so compliance must be immediate.
4. Adapt procedures: Implement the necessary operational adjustments in the affected entities or activities to align with the new regulatory framework of Annex IX.
5. Inform local teams: Ensure that compliance and operations teams in Norway, Iceland and Liechtenstein are aware of the changes and understand how they affect their daily operations.
6. Document compliance: Keep records of the review process and the measures taken to ensure compliance with the new requirements, as this may be required by supervisory authorities.
7. Monitor future updates: The EEE Joint Committee continues to update the annexes regularly. Establish a monitoring system to stay informed of future amendments that may affect your operations.

Frequently asked questions

Q: Does this decision apply to all companies or only to financial entities?
A: It applies primarily to entities and companies with regulated financial activity in Norway, Iceland or Liechtenstein. However, any company that provides financial services or has financial operations in these countries should review whether it is affected.

Q: What happens if a company does not comply with the new requirements?
A: Non-compliance can result in regulatory sanctions, suspension of operations, or loss of authorization to operate in these countries. Supervisory authorities in each country are responsible for enforcement.

Q: When did the new requirements come into force?
A: Entry into force was 5 December 2025. Companies should already be in compliance as of that date.

Q: Where can I find the specific rules that have been incorporated into Annex IX?
A: The full text of Decision 297/2025 is published in the Official Journal of the EU (OJ:L_202600634). You can access it through the EUR-Lex portal.

Q: Does this affect only Spanish companies or also foreign companies operating in Spain?
A: It affects any company, regardless of its country of origin, that has financial activity in Norway, Iceland or Liechtenstein. The regulation is territorial, not based on the company's nationality.

Official source

Decision of the EEE Joint Committee No. 297/2025 of 5 December 2025 amending Annex IX (Financial Services) of the EEE Agreement, published in the Official Journal of the European Union on 16 April 2026 (OJ:L_202600634 [2026/634]).

Disclaimer: This article is for informational purposes only and does not constitute legal advice. The information contained herein is based on the regulatory text as published and may be subject to interpretation by competent authorities. Companies should consult with their legal and compliance advisors to assess the specific impact of this decision on their operations and to ensure full compliance with applicable requirements. The author assumes no responsibility for the use of this information or for any consequences arising from its application.