Denmark

Payment services and e-money issuance require a licence as a payment institution or e-money institution (§§ 2, 3, 8 and 9), unless the provider is a bank or similar body. E-money and payment institutions must safeguard users' funds (§ 35). Finanstilsynet's fintech page describes the Act as the Danish implementation of PSD2.

Requires covered businesses to assess money-laundering risk (§ 7), keep written policies and controls (§ 8), carry out customer due diligence (§§ 10-11), report promptly to Hvidvasksekretariatet (§ 26) and keep records for five years (§ 30). Covered businesses include providers of crypto-asset services (§ 1(1) no. 22), currency exchange (no. 18) and estate agents (no. 16). Sections 47-49 (supervision) and 78 (penalties) were not reached in the text read.

Applies to non-life insurers, mutual companies, life insurers, cross-border pension funds and reinsurers (§ 9(1) no. 1). Insurance activity may not begin before Finanstilsynet has granted a licence (§ 14(1), §§ 19-23), and registration with Erhvervsstyrelsen is also required. The outsourcing rules in §§ 269 ff. are referred to but were not read.

Applies to actors and conduct on the capital markets: bond representatives, issuers' disclosure duties, shareholding notifications, takeover bids, market operators and investment firms. Finanstilsynet approves tender offer documents (§ 48) and the Act protects employees who report suspected violations (§ 9). The market-abuse prohibitions sit in EU Regulation 596/2014 (MAR), to which the Act refers.

Finanstilsynet states that DORA applies directly to covered financial entities from 17 January 2025. Chapter III covers reporting of major ICT-related incidents to Finanstilsynet, and the register of information on ICT third-party arrangements (Art. 28(3)) is submitted annually on a separate Finanstilsynet page. The related Directive (EU) 2022/2556 was implemented in Denmark on 1 July 2024.

Datatilsynet lists the GDPR first among the data protection rules in Denmark. Its guidance applies the Regulation's data subject rights (information, access, rectification, erasure, restriction, portability, objection) and its breach notification rule.

States that MiCA (Regulation (EU) 2023/1114) applies in full from 30 December 2024 and that crypto-asset service providers need authorisation from Finanstilsynet, or may notify it under MiCA Article 60. Firms already providing services that applied by 30 December 2024 may continue for up to 18 months unless refused. White papers are notified under MiCA Article 8.