Denmark
7 regulators · 7 laws & regulations · 12 obligations · 36 enforcement actions
Denmark is a constitutional monarchy with a parliamentary system, an EU member state since 1 January 1973 and a WTO member since 1 January 1995.
Regulatory pulse · 90 days
Laws & Regulations Enforcement NewsOverview
Denmark is a constitutional monarchy with a parliamentary system, an EU member state since 1 January 1973 and a WTO member since 1 January 1995. The monarch is head of state with limited powers, and the Folketing has 179 seats, four of them for Greenland and the Faroe Islands. In 2025 Denmark ranked fourth in the EU for GDP per capita, at about EUR 53,000, and produced 2.2 per cent of EU GDP. Denmark negotiated an opt-out from the euro; Danmarks Nationalbank has run a fixed exchange rate policy since 1982 and keeps the krone pegged to the euro. The US Federal Judicial Center describes the legal tradition as civil law with Scandinavian roots.
The IMF's 2025 Article IV summary describes strong growth driven mainly by pharmaceutical exports, sluggish domestic demand, inflation below 2 per cent, robust public finances and a resilient financial system. Hvidvasksekretariatet's national risk assessment of money laundering for 2022 rates tax and VAT crime, IT-related economic crime and the proceeds of crime committed abroad, with corruption among its examples, as high threats. It names banks, currency exchange businesses and providers of services to businesses as the three sectors most at risk. The FATF's 2017 mutual evaluation found that Denmark had the foundations of a sound AML/CFT regime but rated the effectiveness of supervision low. A 2021 follow-up report left two Recommendations partially compliant (correspondent banking and new technologies).
The Companies Act (selskabsloven) provides for public limited companies (A/S) and private limited companies (ApS), with minimum share capital of DKK 400,000 and DKK 40,000 respectively in the 2023 consolidated text. A company's articles must state its management structure and the number of members of each management body. Listed companies report against the Recommendations on Corporate Governance (2020 edition) on a comply-or-explain basis, and companies covered by Financial Statements Act section 107 b must publish the resulting statement. Businesses, foundations, certain associations and foreign trusts must register their beneficial owners with Erhvervsstyrelsen, and the Central Business Register publishes each owner's name, country of residence, and the nature of their rights. AML-obliged businesses must report discrepancies under AML Act section 15 a. In 2017 the FATF rated transparency of legal persons partially compliant.
Recent enforcement
Open tracker →| Date | Entity | Regulator | Action | Source |
|---|---|---|---|---|
| Oct 2026 | Kreditbanken A/S | Remedial Direction | official | |
| Oct 2026 | Skjern Bank AS | Remedial Direction | official | |
| Sep 2026 | Inpay A/S | Remedial Direction | official | |
| Sep 2026 | Sparekassen Danmark | Remedial Direction | official | |
| Sep 2026 | Dansk Boligforsikring A/S | Remedial Direction | official |
Industry compliance
Essential obligations
All obligations →| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Beneficial owner registration by companies | Register as soon as possible; review at least annually; keep documentation 5 years | Erhvervsstyrelsen (Danish Business Authority) | source | |
§ 58 a(3) requires a company to register its beneficial owners in Erhvervsstyrelsen's IT system as soon as possible, § 58 a(4) a review at least once a year and § 58 a(5) keeping documentation for 5 years. Companies on regulated markets are exempt (§ 58 a(8)). Erhvervsstyrelsen's page adds that discrepancies found by AML-obliged businesses must be reported under AML Act § 15 a. |
||||
| Internal whistleblower scheme for employers | Acknowledge within 7 days; feedback within 3 months of acknowledgment | Datatilsynet (Danish Data Protection Agency) | source | |
§ 9(1) requires employers with 50 or more employees to set up an internal scheme; the duty applied to private employers with 50-249 employees from 17 December 2023 (§ 31(2)). § 12(2) requires acknowledgment of a report within 7 days and feedback within 3 months of acknowledgment. Datatilsynet runs the national external scheme at whistleblower.dk. |
||||
| Personal data breach notification to Datatilsynet | Without undue delay and, where feasible, within 72 hours of becoming aware | Datatilsynet (Danish Data Protection Agency) | official | |
Datatilsynet's English page states that controllers must report breaches that present a risk to individuals without undue delay and, where feasible, no later than 72 hours after becoming aware of it. Notification is not required if the breach is unlikely to present a risk. Reports are made through Virk.dk or by email. The page names the GDPR but not the article. |
||||
| Significant incident notification under the NIS 2 Act | Early warning within 24 hours; notification within 72 hours; final report within one month | SAMSIK | official | |
§ 12(1) of the NIS 2 Act requires essential and important entities to notify significant incidents to the competent authority and the CSIRT. § 13(1) sets an early warning within 24 hours of becoming aware, an incident notification within 72 hours and a final report no later than one month after that notification. SAMSIK's guidance says notifications go through Virk.dk and cites the same timetable. Applies only to entities covered by the Act. |
||||
| AML record retention | At least 5 years after the business relationship ends or the single transaction is completed | — | source | |
§ 30(2) requires information to be kept for at least five years after the business relationship ends or the single transaction is completed; personal data is then deleted unless other legislation says otherwise. |
||||
| AML risk assessment, written policies and compliance officer | — | — | source | |
§ 7(1) requires covered businesses to identify, assess, document and regularly update their money-laundering risk. § 8(1) requires adequate written policies, procedures and controls based on that assessment. § 7(2) requires daily management to appoint an employee with decision-making authority, and § 8(3) requires a management-level compliance officer for businesses in § 1(1) nos. 1-7 that must have a compliance function under other law. |
||||
| No obligations match these filters. | ||||
Quick links — official sites
- Arbejdstilsynet (Danish Working Environment Authority) — Arbejdstilsynet (Danish Working Environment Authority)
- Danmarks Nationalbank — Danmarks Nationalbank
- Datatilsynet (Danish Data Protection Agency) — Datatilsynet (Danish Data Protection Agency)
- SAMSIK — Styrelsen for Samfundssikkerhed (Danish Resilience Agency)
- Digitaliseringsstyrelsen (Danish Agency for Digital Government) — Digitaliseringsstyrelsen (Danish Agency for Digital Government)
- Erhvervsstyrelsen (Danish Business Authority) — Erhvervsstyrelsen (Danish Business Authority)
- NSK — Nationale enhed for Særlig Kriminalitet (National Unit for Special Crime)
Newsletter
Get CRCGS Weekly
A free weekly email from the Centre for Risk, Compliance & Governance Studies: the week's regulatory news, new regulations, updated country profiles, and the Knowledge Hub's latest reading and events.