Financial services EEE 2025: what changes for banks and entities with activity in Norway, Iceland and Liechtenstein

Key data

Financial entities with operations in the European Economic Area have new regulatory obligations from December 5, 2025. Decision No. 299/2025 of the EEA Joint Committee amends Annex IX of the EEA Agreement, relating to financial services, incorporating EU regulations that now also apply in Norway, Iceland and Liechtenstein.

The EEA Agreement allows these three countries to participate in the European internal market without being EU members. For this to work, relevant EU regulations must be periodically transferred to the agreement through Joint Committee decisions. This is one of those updates, and it specifically affects the financial sector.

What does this regulation establish?

Decision 299/2025 updates Annex IX of the EEA Agreement, which regulates financial services in the EEA area. The modification consists of incorporating new EU financial regulations into the scope of the agreement, so that it becomes mandatory in the three non-EU EEA countries as well.

According to the text of the decision, the areas that may be affected by the integrated rules include:

• Capital requirements for financial entities
• Supervision of banks, insurance companies and investment firms
• Transparency in financial activity
• Market conduct in the provision of financial services

The decision was adopted on December 5, 2025 and published in the Official Journal of the EU on April 16, 2026 with the reference OJ:L_202600633.

Economic and operational impact

The direct impact depends on the specific content of the EU regulations that have been integrated into Annex IX. However, any modification to this annex has concrete operational consequences for the affected entities:

• Review of internal compliance procedures to adapt them to new requirements.
• Possible adjustments in capital levels if the integrated regulations modify the required ratios or buffers.
• Update of reporting and supervision systems if new transparency obligations or information requirements to regulators are incorporated.
• Review of conduct policies in the marketing and provision of financial services in the three EEA countries.

Entities with cross-border activity that already operate under EU regulations may see reduced impact if their compliance systems already contemplate the regulations now incorporated into the EEA. However, they must verify that their application is correctly extended to operations in Norway, Iceland and Liechtenstein.

Who does it affect?

This decision directly affects:

• Banks and credit institutions with branches, subsidiaries or cross-border activity in Norway, Iceland or Liechtenstein.
• Insurance companies operating in the EEA market outside the EU.
• Investment firms and fund managers with activity in the three non-EU EEA countries.
• European financial groups with structures that include entities domiciled or supervised in the EEA.
• Compliance and legal departments of any financial entity with presence in the EEA.
• Regulatory advisors and consultants providing services to entities with activity in Norway, Iceland or Liechtenstein.

Practical example

A Spanish bank with a branch in Oslo (Norway) already complies with EU regulations in its operations in Spain. However, as a result of Decision 299/2025, it must verify that the new requirements incorporated into Annex IX of the EEA Agreement—which may include capital, supervision or transparency obligations—also apply to its operations in Norway.

If the entity assumed that its centralized compliance system automatically covered activity in the EEA, this decision requires reviewing that assumption. Compliance departments must confirm that the EU regulations now integrated into the EEA agreement are effectively implemented in the processes of the Norwegian branch, and not just in entities based in EU countries.

The same applies to an insurance company with activity in Iceland or a fund manager with operations in Liechtenstein.

What should companies do now?

1. Identify if you have activity in Norway, Iceland or Liechtenstein. If your entity operates in any of these countries, this decision directly affects you.
2. Review the specific content of the integrated regulations. Consult the full text of Decision 299/2025 in the Official Journal of the EU to identify what specific EU regulations have been incorporated into Annex IX.
3. Evaluate the impact on your compliance procedures. Analyze whether the incorporated regulations affect your capital requirements, supervision obligations, transparency or market conduct in the EEA countries.
4. Update internal systems and policies to ensure that the new regulations apply to operations in the affected EEA countries, not just to EU entities.
5. Coordinate with local regulators in Norway, Iceland or Liechtenstein if there are doubts about transposition or the application timeline in each jurisdiction.
6. Document the impact analysis to demonstrate to supervisors that the entity has reviewed its obligations arising from this update to the EEA Agreement.