New financial rules in the EEA 2026: what banks and insurers must do

Key data

Spanish financial entities operating in the European Economic Area face new regulatory compliance obligations following the approval of the Decision 173/2026 of the EEA Joint Committee, adopted on 5 June 2026. This decision amends Annex IX of the EEA Agreement, the chapter dedicated to financial services, incorporating EU legislation that must now also be applied in Norway, Iceland and Liechtenstein.

The objective is to ensure regulatory homogeneity in the enlarged internal market: that the rules of the game are the same on both sides of the border between the EU and non-EU EEA countries. For Spanish companies in the financial sector, this reduces barriers to cross-border service provision, but also requires an immediate review of contracts and operational procedures.

What does this regulation establish?

Decision 173/2026 updates Annex IX (Financial Services) of the EEA Agreement, which is the legal framework that extends the EU's internal market to the three EEA countries that are not members of the Union: Norway, Iceland and Liechtenstein.

By incorporating new EU legislation into this annex, two simultaneous effects occur:

• Obligation of transposition for non-EU EEA countries: Norway, Iceland and Liechtenstein must apply the same financial rules as EU member states in the areas affected by this decision.
• New obligations for entities operating in those countries: Spanish financial entities with presence or counterparties in these three countries must comply with the updated regulatory framework when operating in those territories.

The EEA Joint Committee mechanism is the usual instrument for keeping the EEA regulatory framework synchronized with EU legislative developments. This decision is therefore part of a continuous update process, but generates concrete and enforceable obligations from its adoption date.

Economic and operational impact

The main impact of this decision is not a new fee or direct penalty, but rather a cost of operational adaptation and regulatory compliance for the affected entities. The concrete effects are:

• Contract review: Agreements with counterparties in Norway, Iceland or Liechtenstein may need to be updated to reflect the new applicable regulatory framework.
• Update of internal procedures: Compliance policies, operational manuals and due diligence processes must be adapted to the new rules incorporated into Annex IX.
• Reduction of cross-border barriers: Regulatory harmonization facilitates the provision of financial services between Spain and non-EU EEA countries, which may represent a business opportunity for entities wishing to expand into these markets.
• Risk of non-compliance: Operating under contracts or procedures that do not reflect the new framework may generate regulatory exposure to supervisors in both Spain and the affected EEA countries.

Who does it affect?

• Banks and credit institutions with operations, branches or counterparties in Norway, Iceland or Liechtenstein.
• Insurers and reinsurers that provide services or have agreements with entities domiciled in the three non-EU EEA countries.
• Investment firms and asset managers that operate in financial markets of the EEA outside the EU.
• Regulatory compliance departments of any financial entity with exposure to the EEA.
• Legal advisors and financial consultants who advise entities with cross-border operations in the EEA.
• CFOs and financial directors of business groups with subsidiaries or investments in Norway, Iceland or Liechtenstein.

Practical example

Imagine a medium-sized Spanish bank that has a correspondent banking agreement with a Norwegian entity and manages investment funds distributed also in Iceland.

Before Decision 173/2026, this bank operated under the EEA Agreement framework in its previous version. Following the adoption of this decision on 5 June 2026, Annex IX of the EEA Agreement has been amended to incorporate new EU legislation. This means that:

• The correspondent banking agreement with the Norwegian entity must be reviewed to verify that the regulatory compliance clauses reflect the new framework applicable in Norway.
• Fund distribution contracts in Iceland must be updated if the new rules incorporated into Annex IX affect marketing or investor information requirements.
• The compliance department must issue a gap analysis report to identify which internal procedures require modification.

Failing to act in time exposes the bank to regulatory risk in two jurisdictions simultaneously: the Spanish and the corresponding EEA country.

What should companies do now?

1. Identify exposure to non-EU EEA: Map all operations, contracts and counterparties in Norway, Iceland and Liechtenstein to determine the scope of impact.
2. Consult the full text of Decision 173/2026: Review what EU legislation has been incorporated into Annex IX to identify the specific regulatory areas affected.
3. Perform a compliance gap analysis: Compare current operational procedures with the requirements of the new framework and identify the gaps that need to be filled.
4. Review and update contracts: Adapt agreements with counterparties in the three affected EEA countries to reflect the new applicable regulatory framework.
5. Update internal manuals and policies: Incorporate the changes into the compliance manual, due diligence policies and relevant operational procedures.
6. Coordinate with legal advisors specialized in European financial law: Given that the decision has effects in multiple jurisdictions, it is advisable to have specialized advice on EEA regulations.

Official source

Consult full regulation in official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202602011