Companies are only allowed to make payments to a NemKonto if the recipient’s NemKonto is the correct payment destination and the company has a legal basis to process the recipient’s CPR number in order to retrieve account information from the NemKonto system—such as when the recipient has given consent. This consent may be obtained, for example, when it is agreed that the payment will be made to the recipient’s NemKonto and the recipient provides their CPR number to the private payer.
In addition, before a company retrieves account information from the NemKonto system for the first time, it must notify the recipient that they can, at any time, inform the company that payments should not be made to their NemKonto.
There are also other requirements for companies acting as private payers - for instance, a company may only retrieve account information from the NemKonto system if it intends to make a payment to the recipient within four banking days.
Furthermore, special rules apply if the company is disbursing amounts covered by Section 513 of the Danish Administration of Justice Act (retsplejeloven).
You can read the requirements in the NemKonto Act here.
You can read the requirements in the Executive Order here.