EEE Financial Services 2026: What Changes for Companies Operating in Norway, Iceland and Liechtenstein

Key data

Spanish companies with financial operations in the European Economic Area have a new regulatory review obligation. The EEE Joint Committee Decision 31/2026, adopted on February 6, 2026, amends Annex IX of the EEE Agreement, relating to financial services, incorporating new EU regulation into the regulatory framework applicable in Norway, Iceland and Liechtenstein.

The practical impact is clear: any financial entity or company with cross-border activity in these three countries must verify whether its compliance procedures remain valid under the new framework, and whether there are new access requirements or regulatory equivalence conditions that must be met.

What does this regulation establish?

The EEE Agreement allows Norway, Iceland and Liechtenstein to participate in the European internal market without being EU members. To do this, the EEE Joint Committee periodically updates the annexes of the agreement to incorporate EU legislation as it is approved.

In this case, Decision 31/2026 updates Annex IX, which regulates financial services. The amendment incorporates new European financial regulation into the EEE regulatory framework, meaning that EU financial rules that have now been incorporated are mandatory in the three non-EU EEE countries as well.

This update is part of the ongoing process of harmonizing the European financial market. It is not an isolated amendment, but rather a structural mechanism through which the EEE maintains its alignment with the EU's regulatory framework on financial matters.

Economic and operational impact

The impact of this decision translates into two concrete areas for companies:

1. Adaptation of regulatory compliance procedures. Financial entities already operating in Norway, Iceland or Liechtenstein must review whether their internal compliance processes remain sufficient under the new regulatory framework incorporated into Annex IX. This may involve updates to internal policies, contracts, product documentation or reporting processes.

2. Access requirements or regulatory equivalence. For Spanish companies considering entering these markets, or already operating in them, the incorporation of new EU regulation may modify access conditions. In some cases, previously recognized regulatory equivalence may need to be reviewed or reconfirmed under the new framework.

Since the decision entered into force on February 6, 2026 and was published on May 21, 2026, there is a period in which the regulation is already applicable even though its official publication in the Official Journal is later. Companies must take this circumstance into account when assessing their compliance situation.

Who does it affect?

• Spanish financial entities with branches, subsidiaries or cross-border activity in Norway, Iceland or Liechtenstein.
• Banks and credit institutions providing services in the EEE area beyond the EU.
• Investment firms and fund managers with presence or clients in the three non-EU EEE countries.
• Insurance companies and payment institutions operating under European passport within the EEE.
• CFOs and regulatory compliance directors of business groups with structure in the EEE.
• Legal advisors and financial consultants advising clients with operations in Norway, Iceland or Liechtenstein.
• Non-financial companies with cross-border operations in these countries that may be affected by new regulatory equivalence requirements in their relationships with local financial entities.

Practical example

A Spanish payment institution operating under European passport and providing services in Norway has structured its regulatory compliance according to EU regulation in force until the end of 2025. With the entry into force of Decision 31/2026 on February 6, 2026, Annex IX of the EEE Agreement incorporates new EU financial regulation that is now also applicable in Norway.

The compliance director of this entity must, first, identify what specific EU regulation has been incorporated into Annex IX through this decision, and then assess whether internal procedures, contracts with Norwegian clients and regulatory documentation are aligned with the new requirements. If the entity does not conduct this review, it may be operating in Norway with a compliance framework that is outdated with respect to the local regulator's requirements, which now applies the new incorporated regulation.

What should companies do now?

1. Identify whether the company operates in Norway, Iceland or Liechtenstein: any cross-border financial activity in these three countries falls within the scope of Decision 31/2026.
2. Review the specific content of the amended Annex IX: consult the official publication on EUR-Lex to identify what EU financial regulation has been incorporated and what its specific requirements are.
3. Audit current regulatory compliance procedures: compare current internal processes with the new requirements arising from the regulation incorporated into the EEE.
4. Verify access requirements and regulatory equivalence: check whether the company maintains the conditions necessary to operate in the markets of Norway, Iceland and Liechtenstein under the new framework.
5. Update contracts, policies and regulatory documentation in cases where the review detects misalignments with the new requirements.
6. Inform compliance and legal teams that the regulation has been in force since February 6, 2026, even though its publication in the Official Journal is from May 21, 2026.