EEE Financial Standards 2026: What Changes for Banks and Insurers

Key data

Financial entities with operations in the European Economic Area have a new regulatory review obligation from February 6, 2026. The Decision 37/2026 of the EEE Joint Committee amends Annex IX of the EEE Agreement, the framework that regulates financial services in EEE countries not belonging to the EU, and incorporates new EU legislation of direct application in Norway, Iceland and Liechtenstein.

For Spanish companies with cross-border activity in these three countries, this is not a minor change: it can affect how they are authorized, what information they must report and under what market conduct rules they operate.

What does this regulation establish?

The EEE Agreement allows Norway, Iceland and Liechtenstein to participate in the European single market without being EU members. In return, they must incorporate and apply relevant EU legislation in their national legal systems. Annex IX of that agreement specifically sets out the rules applicable to the financial services sector.

Decision 37/2026 updates that annex by incorporating new EU legislation approved in the financial field. This means that the three EEE countries are obliged to transpose and apply the same financial rules that are already in force in EU Member States, including Spain.

The areas that may be affected by this update include:

• Requirements for authorization to operate as a financial entity in EEE countries
• Obligations for reporting and information transparency
• Rules of market conduct applicable to banks, insurers and investment firms

This decision is part of the ongoing process of regulatory harmonization between the EU and EEE countries, a mechanism that is activated periodically as the EU approves new financial legislation.

Economic and operational impact

The direct impact of this decision materializes in three operational areas for affected entities:

• Authorization review: If the legislation incorporated into Annex IX modifies the requirements to operate in Norway, Iceland or Liechtenstein, entities may need to update or expand their authorizations in those markets.
• Adaptation of reporting systems: New information obligations may require changes to internal reporting systems, with the operational and technological costs that this entails.
• Update of conduct policies: Market conduct rules directly affect how financial products are marketed, how customer relationships are managed and what documentation must be generated.

The specific cost of adaptation will depend on the scope of EU legislation incorporated into Annex IX in this update, information that is not broken down in the published decision. However, the risk of inaction is clear: operating in EEE countries without complying with the new rules may result in authorization issues or regulatory sanctions in those markets.

Who does it affect?

This decision directly affects:

• Spanish banks and credit institutions with branches, subsidiaries or cross-border activity in Norway, Iceland or Liechtenstein
• Insurers with operations or active contracts in non-EU EEE countries
• Investment firms (asset managers, brokers, financial advisory entities) that provide services in the EEE
• CFOs and compliance officers of financial groups with presence in the EEE
• Advisors and consultants providing services to financial entities with activity in Norway, Iceland or Liechtenstein

Entities that operate exclusively in Spain and other EU countries, with no links to the three EEE countries mentioned, are not directly affected by this decision.

Practical example

A Spanish insurer that markets life-savings products in Norway through an authorized branch must verify whether the new legislation incorporated into Annex IX of the EEE Agreement modifies the pre-contractual information requirements or the conduct rules applicable to insurance distribution in that market.

If the EU legislation incorporated includes changes to transparency obligations or customer suitability requirements, the insurer will need to update its sales processes, the documentation it provides to customers and, potentially, notify the Norwegian supervisory authority of the changes. Failure to do so from February 6, 2026, the date Decision 37/2026 enters into force, may create a regulatory risk in that market.

What should companies do now?

1. Identify EEE exposure: Determine whether the entity has activity, contracts, branches or active cross-border relationships with Norway, Iceland or Liechtenstein. If there is no exposure, no action is necessary.
2. Consult the full text of Decision 37/2026: Access the official publication on EUR-Lex to identify what specific EU legislation has been incorporated into Annex IX and its material scope.
3. Review current authorization requirements: Check whether current authorizations to operate in EEE countries remain valid under the new rules or require updating.
4. Audit reporting obligations: Verify that internal reporting systems comply with new information requirements applicable in affected EEE markets.
5. Update market conduct policies: Review marketing procedures, customer documentation and conflict of interest management in light of new rules.
6. Coordinate with local advisors: Since effective transposition depends on each EEE country, it is advisable to verify the implementation status with advisors in Norway, Iceland or Liechtenstein as appropriate.