Norway

Licensing, Authorisation & Market Access

Norway's current legal basis for payment services remains the Regulations on Payment Services and Systems of 15 February 2019 (no. 152), which applies to banks, credit institutions, e-money institutions, payment institutions and their EEA-branch equivalents. This is the standing scope baseline, confirmed and unchanged this cycle, and it draws the licensing/authorisation line explicitly between bank-PSPs and non-bank payment institutions and e-money institutions, both of which sit within scope but under differing prudential expectations appropriate to their institution type.

The material development this cycle is at the EU level rather than the domestic level: the proposed PSD3/PSR package's final compromise texts were approved for COREPER sign-off on 23 April 2026, setting up an EEA-wide repeal of the current PSD2/EMD2 framework once in force. The estimated timeline places entry into force roughly 21 months out, putting actual effect in the 2027-2028 window. For Norway, this is a future EEA-incorporation horizon item: the domestic Regulations on Payment Services and Systems will need to be replaced or substantially amended once PSD3/PSR is incorporated into the EEA Agreement, but that has not yet happened and the current 2019 regulation remains the operative licensing framework for market access today.

Outlook

The PSD3/PSR EEA-incorporation timeline is the primary licensing-framework item to track for Norway over the next one to two years. Firms currently authorised under the 2019 Regulations should expect a future transposition process once PSD3/PSR clears EU-level adoption and moves to EEA incorporation, though the exact domestic implementation mechanism and timeline remain to be confirmed.

Operational Resilience & Critical Infrastructure

Finanstilsynet's 2026 Risk and Vulnerability Analysis provides the clearest current read on Norway's operational-resilience posture. The analysis finds that implementation of the Digital Operational Resilience Act across Norwegian financial institutions remains incomplete, even as the sector's day-to-day operations are described as stable. Alongside the DORA finding, the analysis flags artificial intelligence as a dual-natured factor: an efficiency gain for institutions deploying it, and simultaneously a new governance and vulnerability vector that did not previously feature as a distinct supervisory concern. This framing suggests Norwegian supervisors are treating AI adoption within financial institutions as something to be actively monitored rather than passively welcomed, even as they recognise its operational benefit.

The incompleteness of DORA implementation is notable given the regulation's EU-wide application date has already passed; Norway's position as an EEA state means DORA-equivalent obligations apply via incorporation, and a finding of incomplete implementation points to a gap between the formal compliance deadline and the operational reality inside Norwegian institutions. TIBER-NO, Norway's threat-intelligence-based ethical red-teaming framework, continues unchanged alongside this finding, suggesting the resilience-testing framework itself is stable even as the broader DORA compliance picture is not yet complete.

Outlook

The pace at which Norwegian financial institutions close the DORA implementation gap identified in the 2026 Risk and Vulnerability Analysis is the primary item to track, alongside whether Finanstilsynet's AI-governance concern translates into a specific supervisory expectation or guidance document in subsequent periods.

Payment Corridor Dynamics

Two settlement-timeline questions define Norway's payment-corridor picture. First, the EU's Instant Payments Regulation has not yet been incorporated into the EEA Agreement, which means no Verification of Payee-style obligation currently applies to NOK-denominated payments; industry commentary indicates EEA incorporation is likely in 2026 or 2027, though no confirmed date has been set. This leaves Norwegian payment service providers and their NOK-denominated corridors outside the VoP obligation that already applies within the EU itself, a timing gap consistent with Norway's general pattern of EEA-lag incorporation of EU payments instruments.

Second, Finanstilsynet has circulated a legislative amendment aligning Norwegian securities settlement with the EU-wide transition to T+1 settlement, planned for 11 October 2027. This is a consultation-stage proposal rather than an adopted rule, but its existence indicates Norwegian authorities are proactively preparing the domestic settlement infrastructure for the EU-wide shift well ahead of the 2027 transition date, rather than waiting for incorporation pressure closer to the deadline.

Outlook

The two corridors to watch are: when the Instant Payments Regulation is formally incorporated into the EEA Agreement, and how Finanstilsynet's T+1 alignment amendment progresses through consultation ahead of the EU's 11 October 2027 transition date. Both carry direct implications for how NOK-denominated payment and settlement corridors interoperate with the rest of the EU/EEA payments landscape.

Industry Structure & Commercial Dynamics

Norway's payments market structure is being reshaped this cycle by Vipps MobilePay's consolidation of its pan-Nordic footprint under a single brand. From 6 October 2026, the MobilePay app in Denmark and Finland began displaying the Vipps smile as its icon, with the MobilePay name itself scheduled for retirement on 12 January 2027. This is a brand-unification move following the earlier merger of Norway's Vipps and the Danish/Finnish MobilePay into a single combined entity, and it signals an operator moving from a multi-brand regional presence toward a single pan-Nordic identity, likely intended to simplify cross-border consumer recognition and merchant onboarding across the three markets it now spans.

Alongside the rebrand, Vipps MobilePay has co-founded the European Network for Payments together with four other established national account-to-account schemes: Bancomat in Italy, Bizum in Spain, the EPI/Wero scheme, and SIBS-MB WAY in Portugal. This is a structurally significant development for the European account-to-account landscape, bringing together several of the continent's most established domestic wallet and transfer schemes under a shared interoperability initiative. For Norway specifically, Vipps MobilePay's inclusion as a founding member confirms its position as the Nordic region's representative scheme in what is shaping up to be a meaningful piece of pan-European payments infrastructure, positioning the Norwegian-origin operator at the centre of a wider European interoperability push rather than as a purely domestic utility.

The combination of brand consolidation and new cross-border scheme membership reflects a broader consolidation dynamic within the account-to-account payments space, where large, successful domestic mobile-wallet schemes are increasingly looking outward for interoperability partnerships rather than remaining nationally siloed. For market participants assessing competitive dynamics in Norway's payments sector, Vipps MobilePay's dominant domestic position is not in question this cycle, but its strategic posture, building scale through brand unification and international scheme participation, is the notable shift to track.

Outlook

The completion of the Nordic rebrand on 12 January 2027 is the near-term date to watch. Beyond that, the development and expansion of the European Network for Payments, including whether further national schemes join the five founding members and what interoperability functionality the network delivers in practice, is the structural item most likely to shape Norway's competitive payments landscape over the coming periods.

Legal & Litigation

Finanstilsynet's supervisory finding this cycle is that certain account-servicing payment service providers breach PSD2's information-parity requirement, set out in Article 36 of the Regulatory Technical Standards on strong customer authentication and common and secure communication (Commission Delegated Regulation (EU) 2018/389), by supplying richer transaction categorisation within their own proprietary banking applications than through the PSD2 dedicated interface used by third-party account information service providers (AISPs). The finding is Tier 1 sourced, drawn directly from Finanstilsynet's own published PSD2 clarifications, and carries High confidence.

Article 36's information-parity standard exists to ensure that account-servicing payment service providers do not degrade the quality, breadth or usability of account data made available through the dedicated interface relative to what the same institution's own customer-facing channels provide. Finanstilsynet's finding that this is happening in practice, with respect to transaction categorisation specifically, moves this concern from a theoretical vulnerability in the PSD2 framework to a documented instance of it.

From a legal-risk perspective, this finding sits at an early stage of the enforcement continuum: Finanstilsynet has made a supervisory finding, but no named provider, fine, formal order, or litigation outcome has been identified this cycle. The finding nonetheless establishes a clear evidentiary and legal basis on which Finanstilsynet, or an affected third-party provider, could pursue further action, whether through direct supervisory measures against identified providers or a market-wide guidance update, although no such claims have been identified in the sourcing available this cycle. The finding specifically concerns account-servicing providers, which in the Norwegian market are predominantly bank entities that hold and administer the underlying payment accounts, as distinct from the non-bank payment institutions and e-money institutions that typically sit on the API-consuming, third-party-provider side of this particular relationship. This bank-versus-non-bank framing matters for remediation: any corrective action properly falls to the account-holding banks operating the dedicated interfaces, not to the third-party providers disadvantaged by the parity gap.

Because Norway is a full PSD2-implementing EEA member, the finding also carries signal value for supervisory practice beyond Norway's own borders: a national regulator identifying and publishing an information-parity deficiency in dedicated-interface implementations is a template other EEA supervisory authorities monitoring compliance with the same technical standard may find directly relevant, even though this cycle's evidentiary basis speaks specifically to the Norwegian market and no cross-jurisdictional enforcement coordination has been identified this cycle.

Whether Norwegian law affords a private right of action to a disadvantaged third-party provider for an Article 36 parity breach, as distinct from Finanstilsynet's own supervisory powers, has not been established in the sourcing available this cycle; this is a live legal question rather than a settled one, and it would typically depend on the specific transposition mechanics of the underlying EU technical standard into Norwegian administrative and civil law, which fall outside this cycle's evidentiary base. Absent primary legal analysis on this point, the finding should be read as a supervisory-enforcement development in the first instance, with any private-litigation dimension remaining speculative until further sourcing is obtained.

Outlook

The clearest next-cycle marker is whether Finanstilsynet escalates this finding into named-provider supervisory action, publishes updated market-wide technical guidance on the specific data fields or categorisation standards account-servicing providers must expose through the PSD2 interface, or leaves the finding as a standalone clarification without further follow-up. Any of the first two outcomes would represent a material escalation in this module's severity read; the third would suggest the finding functions primarily as an interpretive signal rather than the opening move of a supervisory case. Given the Tier 1 sourcing and High confidence already attached to the underlying finding, this is one of the stronger candidates in this cycle's Norway coverage for generating a follow-on, named-entity development in a subsequent cycle.

Product Innovation & Market Development

The headline product-innovation development in Norway this cycle is Vipps MobilePay's launch of 'Tap with Vipps,' enabled by the EU Digital Markets Act forcing Apple to unlock iPhone NFC access to third-party wallet providers. This is described as the world's first native iOS alternative to Apple Pay, a notable first-mover product achievement for a Nordic payments provider operating in a market where Apple Pay has historically held a structural advantage on iOS devices through exclusive NFC access.

The significance of this development lies in its regulatory origin: it is a product-innovation outcome produced by platform-access regulation (the DMA) rather than by payments-specific rulemaking, illustrating a cross-regime interaction in which a non-payments regulatory intervention reshapes the competitive product landscape within payments. This is a structural product-development shift rather than an incremental feature launch, since it removes a technical barrier (exclusive NFC access) that had previously constrained wallet competition on iOS specifically.

Outlook

Watch for competitive responses from other Nordic and European wallet providers now that the DMA-forced NFC access applies EU/EEA-wide, not solely to Vipps, and for whether Apple's own commercial response (fee structures, technical terms for third-party NFC access) shapes how quickly other providers can replicate Vipps's first-mover position.

Consumer Protection & APP Fraud

Two distinct but related developments define this cycle's consumer-protection and fraud picture for Norway. First, DNB reported blocking NOK 2.1 billion (approximately USD 190 million) of fraud in 2024, a substantial figure that illustrates the scale of fraud attempts against Norway's largest bank and, by extension, the scale of the fraud-prevention infrastructure required to defend against it. Second, and forward-looking, the pending PSD3/PSR package will mandate IBAN and name-check verification and broaden authorised-push-payment fraud reimbursement obligations for banks and payment institutions once transposed EEA-wide.

The combination of a large current fraud-blocking figure and a forthcoming mandatory verification and reimbursement regime suggests that Norway's consumer-protection posture on payment fraud is set to tighten materially once PSD3/PSR reaches EEA incorporation. The current framework does not yet mandate IBAN/name checks at the domestic regulatory level in the way the future EU package will, meaning the DNB fraud-blocking figure reflects current-state fraud prevention absent that future mandatory verification layer.

Outlook

The PSD3/PSR-mandated IBAN/name-check and broadened APP-fraud reimbursement obligations represent a material forthcoming compliance shift for Norwegian banks and payment institutions once EEA-incorporated, expected in the 2027-2028 window. Watch for how Norwegian institutions position their fraud-prevention infrastructure ahead of that mandatory shift, given the scale of fraud already being blocked under current arrangements.

Correspondent Banking, Settlement & Access

The correspondent-banking and settlement development relevant to Norway this cycle is a scheme-level messaging-format deadline rather than a change to Norwegian access or correspondent-relationship rules directly. From 15 November 2026, only structured or hybrid address formats may be transmitted in SEK and SEPA payments. This is described as a hard deadline affecting Nordic-connected payment flows, including those touching Norway, even though Norway's own currency is NOK rather than SEK and Norway sits outside the eurozone. The relevance to Norwegian correspondent and settlement infrastructure arises through cross-border payment flows that interact with SEK-denominated or SEPA-scheme messages, where Norwegian-linked counterparties or correspondent banks will need to ensure structured or hybrid address formatting compliance ahead of the deadline.

This finding carries lower confidence in the underlying evidence this cycle and should be read as a reported scheme-level deadline rather than a fully corroborated Norwegian regulatory requirement; no Norwegian-specific implementing instrument or regulatory guidance addressing this deadline was identified this cycle. The analytical significance for correspondent banking and settlement access lies in the asymmetry the deadline could create: Norwegian-linked flows that fail to adopt structured or hybrid addressing in time for the 15 November 2026 cutoff risk rejection or delay when interacting with SEK or SEPA-scheme counterparties, a settlement-access friction point distinct from any licensing or conduct-rule question.

No further correspondent-banking access-asymmetry development, such as a bank-versus-non-bank access differential specific to Norway, was identified this cycle beyond the messaging-format deadline itself.

Outlook

The fixed 15 November 2026 deadline for structured or hybrid address formats in SEK and SEPA payments is a near-term, calendar-certain event against which Norwegian-linked correspondent and settlement flows should be assessed for readiness. Given the deadline's proximity and its reach into Nordic-connected flows generally, continued monitoring for any Norwegian-specific implementing guidance or correspondent-bank readiness signal ahead of the cutoff is the appropriate posture for the coming cycle.

Commercial Intelligence & Fintech

Neonomics, an open-finance platform connecting more than 3,500 banks across 30 European markets, raised four million dollars from existing shareholders, following an operating cost-base reduction of approximately 50 percent. The round was not disclosed with a formal stage designation beyond a general funding round, and the existing-shareholder composition of the raise suggests continuity of investor backing rather than a new investor entering the capital structure. The cost-base reduction preceding the raise indicates the company had already undertaken an efficiency programme before returning to existing shareholders for additional capital, a sequencing that differs from a growth-stage raise aimed primarily at expansion funding.

This commercial development sits alongside the standing reference acquisition of Kustom by Vipps MobilePay's Checkout business, which remains unchanged in status and continues to serve as the background major-M&A reference point for Norway's payments and fintech commercial landscape, without any new development attached to it.

Outlook

Whether Neonomics' reduced cost base translates into a sustainable path to profitability following this raise from existing shareholders, and whether further investment or consolidation activity follows among Norwegian open-finance and payments fintechs, are the points to track next.