Denmark

§ 58 a(3) requires a company to register its beneficial owners in Erhvervsstyrelsen's IT system as soon as possible, § 58 a(4) a review at least once a year and § 58 a(5) keeping documentation for 5 years. Companies on regulated markets are exempt (§ 58 a(8)). Erhvervsstyrelsen's page adds that discrepancies found by AML-obliged businesses must be reported under AML Act § 15 a.

§ 9(1) requires employers with 50 or more employees to set up an internal scheme; the duty applied to private employers with 50-249 employees from 17 December 2023 (§ 31(2)). § 12(2) requires acknowledgment of a report within 7 days and feedback within 3 months of acknowledgment. Datatilsynet runs the national external scheme at whistleblower.dk.

Datatilsynet's English page states that controllers must report breaches that present a risk to individuals without undue delay and, where feasible, no later than 72 hours after becoming aware of it. Notification is not required if the breach is unlikely to present a risk. Reports are made through Virk.dk or by email. The page names the GDPR but not the article.

§ 12(1) of the NIS 2 Act requires essential and important entities to notify significant incidents to the competent authority and the CSIRT. § 13(1) sets an early warning within 24 hours of becoming aware, an incident notification within 72 hours and a final report no later than one month after that notification. SAMSIK's guidance says notifications go through Virk.dk and cites the same timetable. Applies only to entities covered by the Act.

§ 30(2) requires information to be kept for at least five years after the business relationship ends or the single transaction is completed; personal data is then deleted unless other legislation says otherwise.

§ 7(1) requires covered businesses to identify, assess, document and regularly update their money-laundering risk. § 8(1) requires adequate written policies, procedures and controls based on that assessment. § 7(2) requires daily management to appoint an employee with decision-making authority, and § 8(3) requires a management-level compliance officer for businesses in § 1(1) nos. 1-7 that must have a compliance function under other law.

§ 10 sets the triggers for due diligence: establishing a business relationship, occasional transactions above set thresholds, suspicion of money laundering or terrorist financing, and doubts about earlier identity data. § 11(1) nos. 1-5 cover identity information verified against a reliable and independent source, beneficial owners, the purpose and intended nature of the relationship, and ongoing monitoring. § 17(1) requires enhanced due diligence at higher risk (cited in Finanstilsynet's decisions).

Finanstilsynet states that major ICT-related incidents must be reported through Virk.dk: an initial notification as soon as possible and within 4 hours of classifying the incident as major, but no later than 24 hours after becoming aware of it; an intermediate report within 72 hours of the initial notification; and a final report within one month of the latest intermediate update. Cites DORA Articles 11(10), 19(1), 19(4) and 22(2) and Delegated Regulations (EU) 2024/1772 and 2025/301.

§ 26(1) requires a covered business that knows, suspects or has reasonable grounds to suspect money laundering or terrorist financing to inform Hvidvasksekretariatet 'omgående' (promptly). §§ 26(3), (4) and (6) restrict carrying out certain transactions before the report is made.

§ 2 allows e-money to be issued only by licensed e-money institutions (§ 8), banks, Danmarks Nationalbank and public authorities. § 3 allows payment services only from licensed payment or e-money institutions (§§ 8-9), banks and similar bodies. § 10 sets licence conditions, including a Danish head office, minimum capital and fit-and-proper requirements.

§ 35 requires e-money institutions to safeguard funds received for issued e-money (within five business days when received via a payment instrument) and both institution types to safeguard funds received for payment transactions. § 35(6) allows a separate account at a credit institution or central bank, low-risk liquid assets in a separate securities account, or a guarantee from an unaffiliated insurer or credit institution.

§ 332 c of the Financial Business Act, inserted by Act 481/2024, requires authorisation from Finanstilsynet to provide crypto-asset services, with an exemption in stk. 2 for certain firms that notify under MiCA Article 60. Finanstilsynet's crypto page says firms not authorised by 30 December 2024 may not provide services after that date, subject to an 18-month transition for those that applied in time.