EEE and financial services 2025: what changes for companies with cross-border activity

Key data

If your company operates, provides financial services or has clients in Norway, Iceland or Liechtenstein, this amendment directly affects you. Decision No. 300/2025 of the EEE Joint Committee, published on 16 April 2026 in the EU Official Journal, updates the Annex IX of the EEE Agreement, which regulates financial services in the European Economic Area.

The objective is to ensure that the three non-EU EEE countries apply exactly the same financial rules as European Member States. For Spanish companies with cross-border presence, this translates into new compliance obligations that must be reviewed immediately, given that the regulation entered into force on 5 December 2025.

What does this regulation establish?

The EEE Agreement allows Norway, Iceland and Liechtenstein to participate in the European single market without being EU members. For this to work, their regulatory frameworks must be aligned with those of the EU. The mechanism to achieve this is precisely the periodic updating of the annexes to the EEE Agreement, including Annex IX, dedicated to financial services.

With Decision 300/2025, the EEE Joint Committee incorporates new European regulation into that annex. Although the text of the decision does not detail exhaustively each regulatory act integrated, the areas that may be affected according to available information are:

• Financial supervision: new supervision requirements or procedures applicable in the three non-EU EEE countries.
• Capital requirements: possible adjustments in solvency or capitalization requirements for financial entities.
• Transparency: information and disclosure obligations to investors and regulators.
• Investor protection: updated rules on guarantees and rights of investors in these markets.

The practical result is that any company operating under the EEE Agreement in these three countries must apply the same rules as if it were operating in an EU Member State.

Economic and operational impact

The main impact is not immediate direct cost, but regulatory compliance cost. Affected companies will need to:

• Review and update their internal compliance procedures to adapt to the new regulatory acts incorporated into Annex IX.
• Assess whether their financial contracts, products or services marketed in Norway, Iceland or Liechtenstein comply with the new requirements.
• Coordinate with their legal and compliance teams in those countries to identify possible regulatory gaps.
• Potentially adapt reporting systems, documentation or capital structures if the integrated acts require it.

The risk of not acting is operating in these markets with outdated procedures, which can result in regulatory breaches with the local supervisors of Norway, Iceland or Liechtenstein, who have already been applying the new regulation since 5 December 2025.

Who does it affect?

This amendment directly affects:

• Spanish financial entities with subsidiaries, branches or regulated activity in Norway, Iceland or Liechtenstein.
• Investment firms that operate or distribute financial products in these markets.
• Fund managers with cross-border activity in the non-EU EEE.
• Insurance and reinsurance companies with presence in the three affected countries.
• Banks and credit institutions with operations in the EEE outside the EU.
• Financial advisors and consultants providing regulated services in Norway, Iceland or Liechtenstein.
• CFOs and financial directors of business groups with exposure to these markets, who must verify compliance of their local subsidiaries.

Practical example

A Spanish fund manager that distributes investment products in Norway must verify that its product documentation, transparency procedures and investor protection mechanisms comply with the new regulatory acts incorporated into Annex IX by Decision 300/2025.

If the integrated regulation includes, for example, new information disclosure requirements, the fund manager will need to update its product sheets and contracts with Norwegian clients to reflect those changes. Having entered into force on 5 December 2025, any transaction carried out from that date must already comply with the new standards. The review cannot be postponed.

The same reasoning applies to a Spanish credit entity with a branch in Iceland or an insurance company with a client portfolio in Liechtenstein: the starting point is to identify what specific acts have been incorporated into Annex IX and assess whether they generate new obligations for its operating model in those countries.

What should companies do now?

1. Identify your exposure: Determine whether your company has regulated activity (financial services, investment, insurance, credit) in Norway, Iceland or Liechtenstein.
2. Review the integrated acts: Consult the full text of Decision 300/2025 in the EU Official Journal to identify what specific regulation has been incorporated into Annex IX.
3. Audit current compliance: Assess whether your procedures, contracts and products in those markets already comply with the new requirements or if there are gaps.
4. Update compliance procedures: Adapt your internal manuals, product documentation and reporting systems to the new standards, with special attention to supervision, capital, transparency and investor protection.
5. Coordinate with local advisors: Contact your legal teams or advisors in Norway, Iceland or Liechtenstein to confirm how they are locally implementing the new requirements.
6. Document actions taken: Record the impact analysis and measures adopted so you can demonstrate them to supervisors if necessary.