Financial services in the EEA 2026: what Spanish entities must review

Key data

Financial entities and Spanish companies operating in the European Economic Area have a new regulatory review obligation. The Decision 40/2026 of the EEA Joint Committee, adopted on 6 February 2026 and published on 21 May 2026, amends Annex IX of the EEA Agreement, which regulates financial services throughout the economic area that integrates the EU with Norway, Iceland and Liechtenstein.

The direct impact falls on any Spanish entity that provides financial services or has operations in any of these three non-EU countries. The regulation does not create new obligations from scratch, but does require verification that existing compliance procedures are aligned with European legislation that is now formally incorporated into the EEA legal framework.

What does this regulation establish?

The European Economic Area Agreement allows Norway, Iceland and Liechtenstein to participate in the EU internal market without being Member States. For this to work, these countries must apply the same sectoral legislation as EU countries. That incorporation is not automatic: it requires periodic decisions by the EEA Joint Committee that update the Agreement's annexes.

Annex IX is the one that sets out the rules applicable to financial services. With Decision 40/2026, that annex is updated to integrate recent European legislation, ensuring that the rules of the game are identical throughout the EEA.

The amendment ensures homogeneity of the internal market in financial matters and facilitates the free provision of services throughout the EEA. This has direct practical consequences for any entity operating on both sides of the EU/EEA border.

Economic and operational impact

The impact does not translate into new fees or direct sanctions derived from this specific decision, but it does generate operational costs for review and adaptation for affected entities. These are the most relevant effects:

• Review of regulatory compliance procedures in subsidiaries, branches or activities carried out in Norway, Iceland and Liechtenstein.
• Verification of the concrete impact of European rules incorporated into Annex IX on products, services and contracts in force in those countries.
• Update of internal compliance policies to reflect the new version of the regulatory framework applicable in the EEA.
• Coordination with local legal teams in the affected countries to confirm that local transposition is aligned with the decision.

The risk of not acting is operating under an outdated regulatory framework in countries where new European legislation is already formally required from 6 February 2026. This can result in regulatory breaches detectable in inspections or audits.

Who does it affect?

This decision directly affects:

• Credit institutions and banks with branches, subsidiaries or cross-border activity in Norway, Iceland or Liechtenstein.
• Investment service companies that operate or distribute financial products in the EEA outside the EU.
• Insurance and reinsurance companies with presence or active contracts in the three non-EU EEA countries.
• Investment fund managers that market or manage assets in Norway, Iceland or Liechtenstein.
• Compliance and legal departments of any financial group with structure in the EEA.
• Advisors and consultants providing services to entities with activity in these countries.
• CFOs and financial directors of non-financial companies operating in regulated sectors in the EEA and with financial reporting obligations in those countries.

Practical example

A Spanish banking entity with a branch in Oslo (Norway) provides corporate financing services to local clients. Until Decision 40/2026, its compliance framework was based on the previous version of Annex IX of the EEA Agreement.

With the entry into force of this decision on 6 February 2026, the European legislation recently incorporated into Annex IX becomes mandatory in Norway as well. The entity's compliance team must:

1. Identify which specific European rules have been incorporated in this update to Annex IX.
2. Assess whether those rules affect the products or processes operated by the branch in Oslo.
3. Update the branch's procedure manuals and internal policies to reflect the new framework.
4. Confirm with the local legal team in Norway that national transposition is aligned with the Joint Committee decision.

If the entity does not carry out this review, it risks a regulatory inspection in Norway detecting that it operates under procedures that do not reflect the legislation in force in the EEA since February 2026.

What should companies do now?

1. Identify if you have activity in Norway, Iceland or Liechtenstein: If your entity operates, provides services or has active contracts in any of these three countries, this decision directly affects you.
2. Review the specific content of the rules incorporated into Annex IX: Access the official source on EUR-Lex to identify which specific European legislation has been integrated in this update.
3. Audit your regulatory compliance procedures in those countries: Compare the regulatory framework you currently apply with the new content of Annex IX to detect possible gaps.
4. Coordinate with local legal teams: Confirm with advisors in Norway, Iceland or Liechtenstein that the national transposition of the incorporated rules is already in force and how it affects your operations.
5. Document the review process: Keep records of the compliance assessment and any updates made to demonstrate to regulators that you have taken the necessary steps to align with the new framework.