Denmark AML Obligations for Accountants: Hvidvaskloven and Erhvervsstyrelsen

Denmark's money laundering act, hvidvaskloven, covers more than authorised auditors. Tax advisers, external bookkeepers and non-authorised auditors are named in the law's scope as well. This guide summarises what the Danish Business Authority (Erhvervsstyrelsen) says in its published guidance on the act's scope and obligations, so that accountants can see how Denmark compares with other countries. For the general ideas, see our guide to KYC and customer due diligence for accountancy practices.

Where this guide comes from

The source is Erhvervsstyrelsen's "Vejledning om Hvidvasklovens anvendelsesområde og tilhørende forpligtelser". The page shows version 2, published 15 September 2025, which added a section on shareholder loans; version 1 is dated 3 December 2024, and the page still shows 3 December 2024 as its last update, so the dates on the page are not fully consistent. The authority states that the guidance is not exhaustive and that firms are responsible for knowing the whole act. Section numbers below are as the guidance gives them. This is general information, not legal advice.

Who is covered

Under section 1 of the act, as the guidance lists it, the covered groups include approved auditors and audit firms (no. 14), and tax advisers, external bookkeepers, non-approved auditors and others providing the same services as lawyers, auditors and estate agents (no. 16). Company services, such as incorporation, professional directors, registered office providers and professional shareholders, are separate (no. 17). The guidance uses the term "eksterne bogholdere" for external bookkeepers.

Registration

The company services activities in no. 17 must be registered in Erhvervsstyrelsen's anti-money-laundering register before they begin (section 58(1)). Management and beneficial owners may be asked for criminal record certificates, and registration may be refused where there is a risk of abuse (section 58(2) and (3)). Lawyers and approved auditors do not need to register for these activities.

Risk assessment

Section 7 requires a documented risk assessment based on the firm's business model, covering customers, products, transactions, delivery channels and geography, updated over time. Each customer relationship is placed in a limited, normal or increased risk category (section 11(3)), and the guidance stresses that the risk must be reasoned, not just labelled.

Customer due diligence

Due diligence sits in sections 10 to 21. Identity must be obtained and verified for the customer and, for legal persons, the ownership and control structure must be understood. The purpose and intended nature of the relationship must be assessed and the relationship monitored. When helping set up a company, due diligence must cover both the party who approached you and the new company's owners, including beneficial owners. Politically exposed persons are dealt with in section 18. Our explainers on beneficial ownership and politically exposed persons cover the concepts.

Investigating and notifying

Sections 25 and 26 require unusual transactions and activities to be investigated and the result noted. If suspicion cannot be fully dispelled, the firm must notify the Hvidvasksekretariatet without delay ("omgående"). Notification is digital, through hvidvask.dk, and the organisation must register first. The duty also applies to rejected customer relationships where there is an attempt at money laundering or terrorist financing.

Retention and confidentiality

Documentation and notes must be kept for at least five years after the business relationship ends, and personal data must be deleted five years after it ends (section 30). Firms must keep confidential that a notification has been made or is being considered (section 38(1)). For auditors, the guidance adds that they may not inform management of the notification or record it in the audit protocol, although the audit report may still mention a breach so long as it does not reveal the notification. Read our guide to suspicious activity reports and tipping off for the wider picture.

Supervision and fees

Erhvervsstyrelsen supervises the non-financial businesses described above and expects cooperation and information on request. Other supervisors are named for other sectors: the Financial Supervisory Authority, the Danish Gambling Authority and the Danish Bar and Law Society. Auditors and estate agents pay an annual anti-money-laundering fee, based on the Auditors Act (section 49 a) and the estate agents act (section 62 a).

Practical steps (our suggestions)

• Check which numbered category in section 1 your services fall under, and whether any activity needs registration.
• Keep your risk assessment tied to your business model and give a reason for each customer's risk category.
• Create an account on hvidvask.dk before you need to notify.
• Set a deletion date for personal data five years after each relationship ends.

What we could not confirm

The guidance does not give penalty amounts or the section number for the prohibition on making funds available to sanctioned parties, so we have not described fines. We did not read the statute itself or any Danish professional body guidance, and the page notes it is not exhaustive. Check the current act and Erhvervsstyrelsen's latest version before relying on any detail here.

Frequently asked questions

Are bookkeepers covered in Denmark?

Yes. The guidance names external bookkeepers and tax advisers in section 1, no. 16.

Who receives suspicious activity notifications?

The Hvidvasksekretariatet, through hvidvask.dk, according to the guidance.

How long are records kept?

At least five years after the business relationship ends.

Can auditors mention a notification in the audit protocol?

No, the guidance says they may not record it there.

Explore more country guides in our AML and KYC hub, or build your team's skills with Learnsignal CPD courses.