Alloggiati Web: reporting guests to the Questura in Italy

Who has to report guests?

Art. 109, paragraph 1 of the TULPS deliberately lists the obligated parties broadly: «i gestori di esercizi alberghieri e di altre strutture ricettive, comprese quelle che forniscono alloggio in tende, roulotte, nonché i proprietari o gestori di case e di appartamenti per vacanze e gli affittacamere, ivi compresi i gestori di strutture di accoglienza non convenzionali» (“the operators of hotels and other accommodation businesses, including those providing lodging in tents and caravans, as well as the owners or managers of holiday houses and apartments and room-letters, including the operators of non-conventional accommodation facilities”), with the sole exception of mountain huts (rifugi alpini) entered in the dedicated regional or provincial list.

The same paragraph sets a precondition: accommodation may be given only to people who hold an identity card or another document suitable for proving their identity. For non-EU foreign nationals, a passport or an equivalent document under international agreements is sufficient, provided it carries a photograph.

Short-term lets are also covered: art. 19-bis of the D.L. 4 ottobre 2018, n. 113 (converted by L. 132/2018) established by way of interpretation that the obligations of art. 109 apply «anche con riguardo ai locatori o sublocatori che locano immobili o parti di essi con contratti di durata inferiore a trenta giorni» (“also with regard to landlords or sub-landlords who let properties or parts of them under contracts lasting less than thirty days”). The portal’s FAQs repeat this unambiguously, and the circular of the Ministry of the Interior of 20 December 2018 clarifies that the obligation also concerns those who host in an occasional way («saltuario») and bed & breakfasts, «indipendentemente dal fatto che le prestazioni ivi erogate abbiano un carattere professionale o occasionale» (“regardless of whether the services provided there are professional or occasional in nature”).

The same circular also marks out a boundary: «sottratti agli obblighi di cui all’art. 109 le cessioni della predetta durata che avvengono a titolo di liberalità o sulla base di rapporti di carattere gratuito» (“exempt from the obligations of the article cited remain the transfers of the aforementioned duration that take place as an act of liberality or on the basis of free-of-charge relationships”). Be careful, though, because the portal’s FAQs answer «sì» (“yes”) to whoever asks whether a reciprocal, free exchange of homes must be reported. These are two official texts that are best read together, asking your own Questura in case of doubt, rather than deriving a general rule from either.

• ✓Hotels, residences, hostels, room-lets (affittacamere) and bed & breakfasts.
• ✓Holiday homes and apartments, and those who manage them on behalf of the owner.
• ✓Campsites, holiday villages and businesses providing lodging in tents or caravans.
• ✓Non-conventional accommodation facilities.
• ✓Anyone who lets or sublets a property, or a part of one, under contracts lasting less than thirty days.

What are the penalties for omitted or late reporting?

The circular of the Ministry of the Interior of 20 December 2018 says it in a single line: «la violazione degli obblighi di registrazione e comunicazione degli alloggiati è punita, a titolo di contravvenzione, con la sanzione prevista dall’art. 17 TULPS» (“the breach of the obligations to register and report the guests is punished, as a contravention, with the penalty provided for by the article cited”).

Art. 17 of the TULPS punishes breaches of the consolidated act for which no specific penalty is laid down «con l’arresto fino a tre mesi o con l’ammenda fino a lire quattrocentomila» (“with arrest of up to three months or a fine of up to four hundred thousand lire”). This is the text still in force, written in lire: the Polizia di Stato, in the FAQs published by the Questura di Roma, reports the conversion and speaks of «arresto fino a tre mesi o l’ammenda fino ad € 206,00» (“arrest of up to three months or a fine of up to € 206.00”).

Be wary of amounts different from this one that circulate on industry websites: when they are not accompanied by a primary source, they cannot be verified. For an assessment of your specific case, the person to ask is the territorially competent Questura or a legal adviser.

How do you obtain the access credentials?

The credentials are not generated online: they are requested from the Questura. The official FAQs answer that «bisogna rivolgersi alla Questura competente per territorio onde richiedere le credenziali di accesso» (“you must apply to the Questura competent for the territory in order to request the access credentials”), and the technical annex in force formalises it: operators «devono produrre apposita domanda di accesso al portale presso la questura territorialmente competente; la questura provvederà a fornire le credenziali necessarie all’accesso al portale che sarà basato su una autenticazione a due fattori» (“must submit a specific application for access to the portal to the territorially competent questura; the questura will provide the credentials needed to access the portal, which will be based on two-factor authentication”).

The two factors are a login with a password, which the user can change, and a code valid for a single working session. The code is read from the scheda dei codici (code card), which contains sixteen groups of four digits. The old model based on a digital certificate has been superseded: the 2021 decree allows it to be used only until the expiry of the certificate already issued.

If the message «ACCESSO NEGATO» (“ACCESS DENIED”) appears, the FAQs indicate that the user name or the password is wrong: you can use the credential recovery function on the portal — which requires at least two of access codes, scheda codici, PUK and password — or ask the Questura for a password reset.

If you want a property-management system to talk to the portal, the user profile has an item called «Chiave Web Service» (“Web Service key”): it generates the WSKEY, the key that enables direct sending between the Alloggiati system and the accommodation’s software. It is a key that the operator generates and regenerates on their own, at most once a day, and it must be regenerated at every password change.

I cannot find the receipt: what does that mean?

The receipt is downloaded from the «Ricevute» (“Receipts”) menu. The table shows only the days on which the accommodation actually transmitted something, with the date, the number of schedine sent, the protocol number and the download button. The file is a digitally signed PDF bearing a control QR code of the Polizia di Stato, and it cannot be modified by the user.

First hypothesis, the most banal: it is still early. The FAQs of the questure state that «la ricevuta digitale di invio viene emessa il giorno successivo all’invio delle segnalazioni» (“the digital sending receipt is issued the day after the reports are sent”). If you sent today, the receipt is not there yet today — and to check the day’s sendings there is the «Analisi» (“Analysis”) section, which shows the history of the schedine sent on today’s date.

Second hypothesis, less pleasant: the official answer to the question «non trovo la ricevuta ma penso di aver inviato» (“I cannot find the receipt but I think I sent”) is blunt — «l’assenza della ricevuta indica che non sono state inviate schedine in quella data» (“the absence of the receipt indicates that no schedine were sent on that date”).

Third hypothesis: more than 30 days have passed. Receipts remain downloadable from the portal for a maximum of 30 days from issue; beyond that term they can no longer be recovered from there. And they must be kept for five years in digital format: art. 4-bis, introduced by the D.M. 16 settembre 2021, requires it, and it is the receipt — says art. 2 of the D.M. 7 gennaio 2013 — that counts «come attestazione dell’avvenuto adempimento» (“as certification that the obligation has been fulfilled”). The same art. 4-bis asks the operator to delete the digital data transmitted and destroy any paper copy as soon as the receipt has been generated. Downloading and archiving them every month is the only habit that really protects you in the event of an inspection.

What BookCheckin does and does not do for Italy

BookCheckin does file with Alloggiati Web, and it does so itself. If your establishment in Italy is already registered for Alloggiati Web with your Questura, you switch Alloggiati Web filing on yourself in the property’s Legal tab and store there the Utente, Password and WS Key your Questura issued you; they are stored encrypted. Once those credentials are verified, BookCheckin transmits each completed check-in to the Polizia di Stato through the Alloggiati Web web service, automatically, signing in with your own credentials. Switching it on lets you create check-in links for that property, and guests see the Italian check-in form.

The obligation stays yours, and so does the deadline: 24 hours from arrival, or 6 hours for a stay of 24 hours or less (art. 109 TULPS; D.M. 16 September 2021). BookCheckin transmits each time the guests of a booking complete their check-in. This only works if your establishment is already registered for Alloggiati Web with your Questura and the Utente, Password and WS Key you store are the ones it issued: BookCheckin can verify that they sign in, never that your registration is in order. Testing the connection signs in to the live Alloggiati Web service: it sends no guest data, but it is a real login against the production system, not a simulation.

And there is no undo. Alloggiati Web has no cancellation or correction operation, and no test environment. A declaration that has been transmitted cannot be withdrawn or amended from BookCheckin: if something is filed wrongly, only your Questura can correct it. Since the portal accepts only today or yesterday as the arrival date, an arrival that has fallen outside that window can no longer be filed either; the person to turn to is the competent Questura.

What BookCheckin does not cover in Italy: the CIN, ISTAT statistical reporting and the tassa di soggiorno (tourist tax). Nor does it register you with Alloggiati Web or generate your credentials: that is a procedure of yours with the Questura.

In Spain, outside Catalonia and the Basque Country, BookCheckin sends the parte (traveller report) to SES Hospedajes automatically. In Catalonia (Mossos d’Esquadra) and the Basque Country (Ertzaintza), BookCheckin prepares the file and the operator uploads it to the portal.

How to report a guest on Alloggiati Web

The five steps by which an accommodation business in Italy reports to the Questura the details of a person staying with it, from the issuing of credentials to keeping the receipt.

1. 1

   Request the credentials from the Questura

   Submit an application for access to the portal to the territorially competent Questura, as provided by the technical annex in force. It is the Questura that supplies the credentials, and access is based on two-factor authentication.

2. 2

   Log in to the portal with the Scheda dei Codici

   From the ACCESSO (“Access”) area of the portal log in with your login and password, then enter the code requested by the application, reading it from the scheda dei codici (code card). If «ACCESSO NEGATO» (“ACCESS DENIED”) appears, the user name or the password is not correct: use credential recovery or ask the Questura for a reset.

3. 3

   Record the guest’s identity document

   Art. 109 of the TULPS allows accommodation to be given only to people holding a document suitable for proving their identity. Copy the data exactly as they appear on the document: number and date of birth are the fields where manual transcription goes wrong most often.

4. 4

   Send within the deadline

   Enter the rows from the portal, or upload a file in the record-layout format (tracciato record), and send within 24 hours of arrival — within 6 hours if the stay does not exceed 24 hours. The arrival date field accepts only today or yesterday, so do not put it off.

5. 5

   Download and keep the receipt

   The receipt is issued the day after sending. From the «Ricevute» menu download the digitally signed PDF: it remains available on the portal for 30 days, but it must be kept for five years, because it is the document that certifies that the obligation has been fulfilled.