Travel & Hospitality Compliance in Austria

Austria is open to online travel and hospitality businesses, and nothing in the rules forces an in-person check-in. Identity duties come from police registration and border law, not from financial crime law: the Federal Ministry of the Interior is responsible for guest registration and border control, mayors act as registration authorities and the police can inspect guest registers, and the Federal Ministry of Economy, Energy and Tourism is responsible for the trade law that licenses accommodation and travel agency businesses.

The biggest practical obstacle for a digital product is the guest register itself. A self-check-in flow must capture the full set of registration data, obtain a valid confirmation from the guest in one of three permitted ways, and store entries in a numbered, access-controlled electronic register that the police can request at any time.

1. Who regulates this sector

Tourism is a provincial matter in Austria. Local tourism levies are set under provincial law; in Vienna, for example, hosts of private accommodation must collect the local tax (Ortstaxe) from guests and pay it to the city under the Vienna Tourism Promotion Act (oesterreich.gv.at). Provincial levies are not covered further here.

2. Licensing and authorisation

Licensing runs through the Gewerbeordnung 1994 (Trade Act 1994, GewO, consolidated as of 11 November 2026):

Accommodation (Gastgewerbe)

Accommodating guests is part of the regulated hospitality trade (GewO § 111(1) no. 1, § 94 no. 26); no proof of competence is needed for up to ten guest beds with breakfast (§ 111(2) no. 4). Letting rooms with no services is not a trade, but online listings, linen, cleaning and short stays point towards one (oesterreich.gv.at).

Travel agencies (Reisebüros)

A travel agency licence (GewO § 126(1), § 94 no. 56) covers selling or arranging tickets, transport, accommodation and meals for travellers, package holidays and linked travel arrangements.

The licence follows the activity, not the channel: § 126 draws no distinction between a shop and a website. Package organisers and providers of linked travel arrangements must also cover travellers' payments and repatriation against their insolvency, by insurance or a guarantee, and report that cover for entry in the travel insolvency protection register (Reiseinsolvenzabsicherungsverzeichnis) in GISA (Pauschalreiseverordnung, Package Travel Regulation, PRV §§ 3 and 7).

Operating a trade without the required licence is an administrative offence with a fine of up to EUR 3,600 (GewO § 366(1) no. 1). Exchanging currency for guests is exchange bureau business (Wechselstubengeschäft), a banking business needing an FMA licence (Banking Act, BWG § 1(1) no. 22, § 4(1)).

3. Identity framework (AML rules do not apply)

Hotels, holiday-rental operators, tour operators and travel agencies are not obliged entities under Austrian AML law. The Financial Markets Anti-Money Laundering Act (Finanzmarkt-Geldwäschegesetz, FM-GwG) applies only to credit and financial institutions (§ 1(1)), and the Trade Act's AML chapter lists other trades, such as dealers in goods taking EUR 10,000 or more in cash, real estate agents and company service providers, but not accommodation or travel agencies (GewO § 365m1(2)). Currency exchange is the exception. Two cross-sector rules still apply:

• Cash limit. The EU Anti-Money Laundering Regulation, Regulation (EU) 2024/1624[Adopted, applies 10 Jul 2027], Article 80, will limit every person trading in goods or providing services to cash payments of EUR 10,000, including linked payments; member states may set lower limits (Article 80(2)).
• Sanctions. EU sanctions regulations apply directly to every business. Under the Sanctions Act 2024 (Sanktionengesetz 2024, SanktG) the Interior Minister monitors compliance outside the financial market, and the FMA monitors financial market participants (SanktG § 12(1) and (2)).

The identity rules that govern the sector are the Meldegesetz 1991 (Registration Act 1991, MeldeG), the Fremdenpolizeigesetz 2005 (Aliens Police Act 2005, FPG), the PNR-Gesetz (PNR Act, PNR-G), and the EU's EES and ETIAS.

4. Identity verification and onboarding

Guest registration in accommodation

Every guest who takes accommodation in a Beherbergungsbetrieb (accommodation business) must register without delay and in any case within 24 hours of arrival (MeldeG § 5(1), consolidated as of 11 November 2026). This covers hotels, inns, guesthouses, private room rentals, supervised campsites and mountain huts. Registration is complete when the business has:

• first name and surname, date of birth, sex, nationality, country of origin and address with postcode;
• for foreign guests, the type, number, issue date and issuing authority of the travel document;
• the guest's signature confirming that the data are correct.

Guests are de-registered at departure. Family members need only names and dates of birth if one of them registers fully; groups of at least eight staying up to two weeks can be covered by the tour leader's signed list (MeldeG § 5(3)). Stays over two months also require registration with the registration authority (§ 5(2)).

The business may make the entries itself from the guest's details, is responsible for them, and must report a guest who refuses to register to the registration authority or the police without delay (MeldeG § 7(5) and (6)). MeldeG and its Implementing Regulation (MeldeV) specify the data and the confirmation; they do not prescribe inspecting, copying or scanning the travel document, or any biometric check.

Proof of identity is owed to the authorities: on request of the registration authority or the police, the guest must produce official identity documents without delay, and the host must say whom it has accommodated in the last six months (MeldeG § 12). The Schengen Implementing Convention commits states to ensure that foreign guests sign registration forms and confirm their identity with a valid identity document (Article 45(1)(a)).

Holiday apartments outside the guest register regime

An apartment let without the host's management or supervision is a dwelling (Wohnung), not an accommodation business (MeldeG § 1(3) and (4)). Guests staying there up to three days need not register (§ 2(2) no. 1); longer stays must be registered with the registration authority within three days (§ 3(1)), and a host who suspects a guest has not registered must tell the authority within 14 days (§ 8(2)).

Carriers and border-crossing travellers

Air, sea and international scheduled bus carriers bringing people across the Schengen external border into Austria must take all necessary measures to make sure each passenger holds the required travel document and, where needed, an entry authorisation (FPG § 111(1)). Since 12 June 2026, every carrier crossing the external border must also send passengers' identity and document data to the border control authority when passenger formalities close (§ 111(2) and (3), BGBl. I No. 39/2026). Once ETIAS operates, air, sea and group coach carriers must check before boarding that visa-exempt travellers hold a valid authorisation (Regulation (EU) 2018/1240, Article 45). At the border, third-country short-stay travellers give fingerprints and a facial image for the EES (BMI, EES page, updated 24 April 2026).

5. Digital channels: what's different

Bottom line: the data a guest must give are the same online and at the front desk; what changes is how the guest confirms them and how the register is kept and secured.

Three permitted ways to confirm online

An electronic guest register must be filled at check-in in one of three ways: an electronic image of the completed data including the guest's signature (scanning), electronic capture of the data with an electronically captured signature (a signature pad), or entry with a qualified electronic signature (Meldegesetz-Durchführungsverordnung, Registration Act Implementing Regulation, MeldeV § 19(2)). A tick box or typed name is none of these, so pre-arrival data collected online still needs the guest's confirmation by one of these methods.

Securing the electronic register

Electronic entries must follow the official register sheet (Annex A to MeldeV), carry a running, unalterable number and be protected by state-of-the-art access controls; data are kept seven years, then deleted unless other laws such as tax rules require longer (MeldeV § 19(3) and (4)). The police can demand printed extracts or data transmission (MeldeG § 10(2)).

Online check-in for flights

The Advance Passenger Information Regulation, Regulation (EU) 2025/12[Adopted, date not yet set], requires air carriers to collect passport data by automated reading of the machine-readable zone, including at online check-in. It applies two years after the EU router starts operations, on a date the Commission has not yet set; manual entry with data verification remains possible during a transition period (Articles 5 and 46).

Pending changes

ETIAS [Adopted, start date not yet set] will require visa-exempt third-country nationals to obtain an online travel authorisation before travelling, for a fee of EUR 20 (Regulation (EU) 2018/1240, Article 18(1), as amended by Delegated Regulation (EU) 2025/1411). The Commission scheduled the start for the last quarter of 2026; as of November 2026 the system is not operating and the EU will announce the date several months ahead.

6. Data protection and biometrics

The GDPR applies to guest, booking and passenger data. The guest record is fixed by MeldeG § 5(1) and Annex A to MeldeV; anything beyond it, such as a passport copy or a selfie, needs its own lawful basis and purpose.

Biometric data processed to uniquely identify a person are a special category under Article 9(1) GDPR, which may be processed only under an Article 9(2) exception. Because registration law does not require a face match, biometric check-in cannot rest on the registration duty and needs another Article 9(2) ground, such as explicit consent.

Retention periods differ by regime:

• Guest register: seven years from the entry, then deletion (MeldeG § 10(2); MeldeV § 19(4)).
• Carrier passenger data under FPG § 111(2): held for 24 hours after arrival for border control queries, then destroyed by the carrier; the border authority deletes the data within 24 hours of transmission unless needed further (§ 111(2a)).
• Flight passenger name records: depersonalised by the Passenger Information Unit after six months and deleted after five years (PNR-G § 6(1) and § 4(4)).
• EES records: the individual file is kept for three years and one day after the last exit or refusal of entry (BMI, EES page).

7. Sector-specific obligations

Flight passenger name records

Air carriers flying between Austria and a non-EU country must send the passenger name record data they collect, free of charge, to the Passenger Information Unit at the Ministry of the Interior 24 to 48 hours before scheduled departure and again once passenger formalities close (PNR-G § 2(1)). The data include contact details, all payment information, the itinerary and the travel agency and agent who made the booking (PNR-G § 3(1)); for code-share flights the operating carrier is responsible (§ 2(3)). A carrier whose passenger is refused entry must pay for the return journey (FPG § 111(4) and (5)).

Entry rules travel sellers should check

Before a package holiday contract is concluded, the organiser and any retailer must tell the traveller the general passport and visa requirements of the destination, including approximate timescales for obtaining visas (Pauschalreisegesetz, Package Travel Act, PRG § 4(1) no. 6). Visa-exempt nationals may stay in Austria up to 90 days in any 180 without working; others need a Schengen C visa, and anyone intending to work generally needs a visa (BMEIA, Visa page). Since 10 April 2026, the EES has been fully applied at every external border crossing; in Austria that means international airports and airfields (BMI, EES page).

Short-term rental platforms

The EU short-term rental Regulation, Regulation (EU) 2024/1028, applies from 20 May 2026 but only where a member state sets up a registration procedure (Articles 4 and 19). In Austria each province decides; as of the application date no province had implemented it, so hosts need no registration number and platforms have no listing obligation for now (BMWET, STR Regulation page).

8. Risk indicators and red flags

Identity and registration risk indicators

• Refusal to register: must be reported (MeldeG § 7(6)).
• False identity data: an offence on registration (MeldeG § 22(1) no. 4).
• Registration without a stay: also an offence (MeldeG § 22(1) no. 2).
• Group list misuse: fewer than eight guests, or stays over two weeks (MeldeG § 5(3)).
• Long stays: over two months without registering with the authority (MeldeG § 5(2)).
• Overstay signals: third-country bookings beyond 90 days in 180 without a visa or residence document (BMEIA).
• Missing travel documents: no document or entry authorisation (FPG § 111(1)).
• Large cash payments: above EUR 10,000, barred from 10 July 2027 (Regulation (EU) 2024/1624, Article 80).

9. Enforcement and penalties

Penalties in the sector are administrative fines set per offence:

Carriers can be fined as legal persons for offences by managers or enabled by poor supervision (PNR-G § 10(2) and (3)).

The Salzburg Regional Administrative Court upheld a penalty on a motorhome parking site operator, treated as an accommodation business, for keeping no guest register (LVwG Salzburg, 405-10/803/1/5-2020, 7 April 2020). In June 2024 the Supreme Administrative Court held that the old wording of FPG § 112(1) no. 1 punished a carrier only if a passenger lacked both a travel document and an entry authorisation (VwGH, Ra 2021/17/0172, 4 June 2024); since 12 June 2026, lacking either one is an offence (BGBl. I No. 39/2026).

10. Recent changes and what to watch

• 10 July 2027[Adopted, applies 10 Jul 2027]: EU cash limit. Hotels and agencies may not accept cash above EUR 10,000 per transaction or linked transactions.
• November 2026[Adopted, start date not yet set]: ETIAS is scheduled for the last quarter of 2026 but not yet in operation; the fee is EUR 20, and booking flows should allow for it.
• 12 June 2026[In force]: carrier duties tightened. BGBl. I No. 39/2026 extends advance passenger data transmission to every carrier crossing the external border and makes it an offence to carry a passenger who lacks either a travel document or an entry authorisation (FPG §§ 111, 112).
• 20 May 2026[Optional, not implemented in Austria]: the EU short-term rental Regulation applies; no Austrian province had introduced registration numbers as of that date.
• 10 April 2026[In force]: EES fully applied. After a six-month progressive start from 12 October 2025 (Regulation (EU) 2025/1534), third-country short-stay travellers are registered biometrically at all external border crossings, which in principle replaces passport stamping.
• 19 December 2024[Adopted, date not yet set]: API Regulation adopted. Automated document capture at online check-in becomes mandatory for air carriers two years after the EU router starts.

11. What this means for identity verification

• Data set: build pre-arrival forms around the MeldeG § 5(1) fields, with travel document fields shown only for foreign guests and a short path for family members.
• Document reading: reading a passport's machine-readable zone or chip fills document fields accurately; hotels may use it but need not, while airlines must once the API Regulation applies.
• Confirmation: end a self-check-in flow with a scanned signature, a signature pad or a qualified electronic signature.
• Biometrics: face match or liveness checks are optional in hospitality and need their own GDPR basis under Article 9.
• Register integrity: each entry needs a fixed sequential number, access controls and seven-year retention, with export on police request.
• Re-verification triggers: a stay passing two months, a group passing two weeks, a refusal to register, and a third-country stay approaching 90 days in 180.