Self Check-In With No Front Desk: How to Still Meet the Identification Duty in 2026

On 21 November 2025 Italy's Council of State (Consiglio di Stato, Section III, ruling no. 9101/2025) reformed the TAR Lazio decision of 27 May 2025 and restored the Interior Ministry circular of 18 November 2024. Practical translation: in Italy a guest cannot pick up a code or a key without someone checking, in real time, that the face in front of the camera matches the document. In Spain, the same operation — nobody on site, smart lock, guest walks in at 23:40 — is perfectly legal, because Royal Decree 933/2021 obliges you to register and transmit data within 24 hours, not to stand at a desk.

That is the whole article in two sentences, and it is the thing most guides on self check-in skip: identifying a guest and registering a guest are two different legal duties, and only one of them can be fully automated. If you run units in more than one country, the same software flow is compliant in Madrid and non-compliant in Milan. Below: what each duty actually requires, the deadlines and fine brackets, a seven-step remote flow, and the four mistakes that turn a smooth check-in into a file with your name on it.

Try it right now — free, no signup →

The distinction that decides everything

Identification means verifying that the person entering is the person on the document. It is an act of verification, and it needs a live moment: a face, a document, at the same time.

Registration means writing down the mandatory fields, keeping the record and sending it to the security authority within the legal deadline. It is an act of data handling, and it can run entirely on software.

Self check-in never removes registration. What varies by country is whether it can also remove the live identification step.

Spain: you may hand over the keys, you may not skip the data

RD 933/2021 has been fully in force since 2 December 2024 and applies to hotels, tourist flats, campsites and rental agencies alike. Three operational facts:

The number of mandatory fields per traveller grew from 9 under the old model to around 17–18, plus the fields describing the transaction itself (payment method, dates, property).
Each booking triggers a submission, and the start of the stay triggers another, each within 24 hours.
Guests aged 14 and over must sign the entry form, and the record must be kept for three years.

Nothing in that list requires a human at the door. What it does require is that the data be complete and on time — and that is where unattended arrivals fail, because the guest who arrives at midnight is also the guest whose passport photo you never chased.

Fines sit under Organic Law 4/2015 on citizen security: failing to communicate guest data at all is treated as a serious infringement, in a bracket that runs from 601 to 30,000 euros, with repeat serious infringements opening the door to temporary closure. If you want the full submission mechanics, we covered them in the SES.Hospedajes traveller registration guide, and the exact field list in which ID fields the law requires you to collect.

Italy: identification came back, self check-in did not disappear

The November 2024 circular said that sending a photo of a document by WhatsApp plus a keybox code does not prove that the document belongs to the bearer. The TAR Lazio annulled it in May 2025 after an appeal by host associations; the Council of State reinstated it in November 2025.

Read the ruling carefully, because the headlines got it wrong: it does not ban self check-in. It bans access without identity verification. Remote verification is accepted when it happens live — a video call or video intercom where the operator sees the guest and the document at the same moment, right before access is granted. Asynchronous document upload alone is not enough.

On top of that there is a separate, municipal layer: several cities have banned keyboxes attached to public-facing walls and railings. Milan's ban started in January 2026, with 30 days to remove the devices and fines reported in the 100–400 euro range plus removal costs, following comparable measures in Florence. Note what is being regulated there — the box on the street, not the digital access system. An internal smart lock plus a live video check is still a workable setup.

Portugal: only foreign guests, but a longer deadline

Portugal works differently again. The *boletim de alojamento* applies only to foreign citizens, including EU nationals, and is filed through the SIBA portal, managed under the Internal Security System after SEF was wound down. The deadline is three working days from the guest's entry, which is far more forgiving than Spain's 24 hours.

The fine brackets are per missing report: roughly 100–1,500 euros for individuals and 500–10,000 euros for legal entities. With a 12-unit operation and a summer of unattended arrivals, "per report" is the phrase that hurts.

A remote check-in flow that survives an inspection

This is the sequence I would run for a property with no reception, ordered so that the compliance work finishes before the guest arrives, not after.

Ask for the document at booking, not at arrival. The single biggest predictor of a missing record is asking someone for their passport while they are standing in the street with luggage.
Collect it over a channel the guest already has open. A WhatsApp thread beats an app download or a portal login by a wide margin in completion rate, especially with international guests on roaming.
Extract the fields automatically. Type and number of document, support number where it applies, full name, sex, date of birth, nationality, address, phone, email. Manual retyping is where the typos that invalidate a submission come from.
Validate before the stay starts. Check that the document is not expired and that the checksum of the ID number is coherent. A rejected submission at hour 23 is a rejected submission.
Add the live verification step where the law demands it. In Italy, a short video call or video intercom moment at arrival. In Spain and Portugal, not required — but if you already do it, keep the evidence.
Capture the signature for guests aged 14+ where the entry form requires it, digitally.
Submit and archive. Send within the legal window and keep the record for the retention period, separately from the marketing database.

Four mistakes and what they actually cost

Storing the photo of the ID "just in case". The Spanish data protection authority has been explicit that photocopying or scanning identity documents and retaining them is not justified in most accommodation scenarios; the principle of minimisation means you keep the *fields*, not the image. The safe pattern is: extract, validate, delete the image. We wrote a full playbook on this in how to store client ID copies without breaking GDPR.

Treating the booking platform's data as your record. The name on the reservation is one person; the four people sleeping in the flat are four records. Every traveller counts, and minors are declared by the accompanying adult.

Assuming one flow works across borders. A Spanish-compliant automated flow, deployed unchanged on an Italian unit, is now a documented non-compliance. Split the flow by jurisdiction, not by property manager habit.

Batching submissions weekly. Spain's window is 24 hours per event. A Friday batch covering Monday's arrivals is late for four of them, and lateness is its own infringement category.

A simple decision criterion

If your units are in Spain or Portugal: full unattended check-in is viable. Put your effort into collecting and extracting the document early and submitting on time.

If your units are in Italy: keep the smart lock, add a scheduled live video verification before the code is released, and check your municipality's keybox rules before mounting anything on a street-facing wall.

If your units are in more than one: build the data collection once, and make the live-verification step a per-property setting.

The data part is the part that scales. Guests forward a photo of their passport or DNI to a WhatsApp number, the fields come back structured in seconds, and you file them while the guest is still in the taxi — no app for them to install, no retyping for you. That is exactly the flow described in registering guests in SES.Hospedajes by scanning their ID over WhatsApp.

Want to see what comes out of a passport photo before wiring anything up? Try it free — no signup.

Frequently asked questions

###