Travel & Hospitality Compliance in France

France is open to online travel and accommodation businesses, including those established elsewhere in the EU, and the rules apply equally to digital and traditional sellers. Identity obligations in the sector come from immigration, internal security, tourism and consumer law rather than from financial crime law.

The principal authorities are the Ministry of the Interior (border control, guest registration and passenger data), Atout France (registration of travel operators), the Directorate General for Civil Aviation (passenger rights), the CNIL (data protection) and municipalities (tourist rentals).

The biggest practical obstacle is not a licence but data design: collecting enough to meet police, platform and passenger-data duties while collecting no more than the law allows, especially when check-in and identity capture move online.

1. Who regulates this sector

Consumer protection agents empowered under the Code de la consommation investigate breaches of the travel-seller rules (art. L211-23 Code du tourisme).

2. Licensing and authorisation

Travel agencies, tour operators and online travel sellers

Article L211-1 of the Code du tourisme covers anyone who, as a business, puts together and sells package holidays, or sells transport, accommodation, car hire or other travel services they do not provide themselves, and anyone who facilitates linked travel arrangements. Carriers that only sell their own tickets are excluded unless they sell packages or linked arrangements. Under art. L211-18, every person covered must be registered (immatriculé) on the register kept by Atout France and, to register, must show a financial guarantee dedicated to refunding travellers (and, where transport is included, repatriation) and professional liability insurance. Registration is a mandatory declarative procedure and the register is public.

Sellers established outside the EU and the European Economic Area that sell to, or direct their activity by any means towards, France must provide the same insolvency protection (art. L211-18-1).

Furnished tourist rentals

Under art. L324-1-1 III Code du tourisme, as amended by Law 2024-1039 and in force since 20 May 2026, anyone offering a furnished tourist rental (meublé de tourisme) must first file, in person, a declaration through a national online service, which issues a declaration number and passes the file to the municipality. [Partly in force: national service due Q4 2026] Service-Public.fr (27 July 2026) states that the national service is planned for the fourth quarter of 2026; from its launch, registration becomes compulsory in every municipality, and numbers already issued by municipalities stay valid for a transition period of several months before they lapse. Where the unit is the host's main residence, letting is capped at 120 days a year, which a municipality may lower to 90.

Operating without registration

Selling travel without meeting the registration conditions is an offence punishable by one year's imprisonment and a €15,000 fine, and the authorities may order the temporary closure of the premises (art. L211-23).

3. Identity framework (AML rules do not apply)

Article L561-2 of the Code monétaire et financier lists the persons subject to France's AML and counter-terrorist financing obligations (version in force since 5 August 2026). Hotels, accommodation providers, travel agencies, tour operators and carriers are not on the list, so the customer due diligence, beneficial ownership and suspicious activity reporting regime does not apply to their core activity.

Two parts of the sector are touched by it:

Currency exchange

Bureaux de change (changeurs manuels) are obliged entities (art. L561-2 7°). For occasional customers they must identify and verify identity before any exchange, or linked exchanges, above €1,000, and for every exchange where the customer is not physically present (art. R561-10 II 4°, in force since 25 December 2024).

Cash payments

Hotels and travel sellers may not accept cash above €1,000 from a payer resident in France for tax purposes or acting professionally. A private non-resident paying a business outside the AML list may pay up to €10,000 (art. D112-3 Code monétaire et financier).

Asset freezes apply to everyone: any person in France and any legal person operating there must apply EU, UN and national freezes without delay and inform the Minister of the Economy immediately (art. L562-4). The national register is published by the Direction générale du Trésor.

Identity in the sector is instead governed by immigration law (Code de l'entrée et du séjour des étrangers et du droit d'asile, CESEDA), internal security law, tourism law and EU border and rental rules, set out below.

4. Identity verification and onboarding

Guests in hotels and tourist accommodation

Article R814-1 CESEDA (in force since 1 May 2021) requires hoteliers, operators of holiday villages and tourist residences, furnished tourist rental and guest-house hosts and campsite operators to have each foreign guest complete and sign, on arrival, an individual police form (fiche individuelle de police). Service-Public.fr confirms that this includes nationals of other EU countries and that a host may refuse the stay if the guest will not complete or sign the form. Lessors of unfurnished premises are exempt. The purposes are public order, judicial investigations and searches for persons.

The form collects, in particular (art. R814-2, matching the model form set by the arrêté of 1 October 2015, still in force): surname and first names; date and place of birth; nationality; usual address; mobile phone number and email address; date of arrival and expected date of departure. Children under 15 may be listed on the form of an accompanying adult. Forms are kept for six months and handed to the police or gendarmerie on request; transmission may be electronic (art. R814-3).

The CNIL's position is that a hotelier may not copy a guest's identity document. It may ask to see a document to confirm nationality for the police form, and may ask for proof of identity when a guest pays by cheque. For other travel businesses, the CNIL's 2021 référentiel on commercial activities allows a copy only where the law requires it or to hold evidence for a dispute.

Passengers

Air, sea and road carriers landing a non-EU, non-Schengen national without the required travel document, visa or travel authorisation face a fine (art. L821-6 CESEDA). To check, carriers must use the carrier web service of the EES and, under Article 45 of Regulation (EU) 2018/1240, of ETIAS. Visa applicants over 12 attend in person for their first application to give a photograph and ten fingerprints, as all French visas are biometric (France-Visas).

Hosts on rental platforms

When registering a tourist rental, a host who is a natural person declares their name, national identification number or other identifying information, address and phone number; a legal person declares its business registration number and legal representative (Regulation (EU) 2024/1028, art. 5).

5. Digital channels: what's different

Bottom line: the guest and passenger identity rules are channel-neutral, so an online booking does not replace the police form signed on arrival; the real digital differences are the platform duties for tourist rentals and the stricter identification rule for remote currency exchange.

Online pre-check-in does not move the legal moment

Article R814-1 ties the form to the guest's arrival ("dès son arrivée") and requires the foreign guest's signature. Capturing the R814-2 fields at booking shortens check-in, but the signature is still collected on arrival. The official model form (arrêté of 1 October 2015) carries a date and signature box; the regulations allow forms to be passed to the police in electronic form (art. R814-3) but do not expressly address electronic signature.

Platforms carry the verification burden for rentals

Intermediaries and platforms must inform hosts of their obligations, obtain a sworn statement and the declaration number before the listing goes online, and publish the number in every listing (art. L324-2-1 I Code du tourisme). Under Regulation (EU) 2024/1028, applicable since 20 May 2026, platforms must design their interface to require the number, make reasonable efforts to check declarations at random, report invalid or misused numbers to the authorities (art. 7) and transmit activity data monthly (art. 9). A platform must stop offering a main-residence rental once it knows the 120-day cap has been exceeded.

Remote currency exchange

An exchange bureau serving customers online must identify and verify every occasional customer, whatever the amount (art. R561-10 II 4°), using the methods in art. R561-5-1: an eIDAS "substantial" or "high" electronic identification means certified by the national cybersecurity agency (ANSSI) or a notified scheme, or, failing that, at least two of the measures in art. R561-5-2.

Pending

ETIAS [Adopted, start date not yet set] will add a travel authorisation check for visa-exempt visitors that carriers must verify; the Ministry of the Interior expects a start in late 2026. Regulation (EU) 2025/13 on advance passenger information [Adopted, date not yet set] applies to API data two years after the EU router starts operations.

6. Data protection and biometrics

The General Data Protection Regulation (GDPR) applies to all guest and passenger data. For police forms, the CNIL asks establishments to collect only the data on the official model form, which itself informs guests of their rights of access and rectification. Forms are kept for six months (art. R814-3) and may be passed only to the police or gendarmerie, on request (Service-Public.fr).

Facial recognition at boarding or check-in processes biometric data, which the GDPR treats as a special category. In its multi-factor authentication recommendation of 20 March 2025, the CNIL states that biometrics are possible only with the person's explicit consent unless a legal text makes them compulsory or expressly authorises them, that biometrics "ne peut être imposé sans alternative" (cannot be imposed without an alternative), and that templates should be stored only on devices under the person's exclusive control. For airports, it adds that the non-biometric route must be offered without pressure or reward and that consent cannot be bundled into ticket terms, and it recommends a data protection impact assessment. The European Data Protection Board's Opinion 11/2024 (24 May 2024) found compatible only storage options in which the individual keeps control of the biometric data.

State systems have their own rules. PARAFE automated border gates and EES self-service pre-registration are optional, and travellers may go to a border guard instead (CNIL deliberation 2024-010). Passenger name records are kept for at most five years (art. L232-7 Code de la sécurité intérieure) and depersonalised after six months (Directive (EU) 2016/681, art. 12); EES files are kept for three years from the last border crossing, or five years after an overstay.

7. Sector-specific obligations

Passenger data for carriers and charterers

Air carriers must collect and transmit to the Ministry of the Interior advance passenger information as defined in Directive 2004/82/EC, and rail and sea carriers have equivalent duties (art. L232-4 Code de la sécurité intérieure). For flights to and from France, excluding flights within metropolitan France, air carriers also transmit passenger name record (PNR) data from their reservation systems, and ministers may require the same from travel agencies and tour operators that charter all or part of an aircraft; they must inform passengers of the processing (art. L232-7).

Carrier document checks

Carriers bringing third-country nationals to France from outside the Schengen area must verify the travel document and any required visa or travel authorisation before boarding. The DGAC confirms that inadequate travel documents can justify denied boarding without compensation under Regulation (EC) 261/2004.

8. Risk indicators and red flags

These are fraud and identity-abuse indicators drawn from the official rules and warnings.

Travel and hospitality identity and fraud indicators

• Fake guarantee certificates: financial guarantee documents from issuers the prudential supervisor (ACPR) has flagged as false or irregular.
• Invalid or reused registration numbers: rental listings whose number does not match the declared unit, a sign of misuse platforms must report.
• Main-residence overuse: a "main residence" let beyond the 120-day cap or the lower municipal limit.
• Document gaps at boarding: third-country travellers without a valid document, visa or travel authorisation for their nationality and destination.
• Nationality mismatch: a guest declaring French nationality to avoid the police form while presenting a foreign document.
• Split cash payments: settlements broken up to stay under the €1,000 or €10,000 cash limits.
• Structured currency exchange: linked exchanges kept just under €1,000 to avoid identification.

9. Enforcement and penalties

Rental fines are imposed by the municipality or, for civil fines, by the president of the judicial court at the municipality's request, and are paid to the municipality. Carrier fines are imposed per journey or per passenger by the administrative authority after the carrier can submit written observations. The prudential supervisor (ACPR) warned on 23 December 2024 (updated 24 September 2026) that false or irregular financial guarantee certificates had been issued to travel agencies, naming the insurers concerned and a Luxembourg fund not authorised to give such guarantees in France. The DGAC can fine airlines for proven breaches of passenger rights rules. On data protection, the CNIL fined a hotel group €600,000 on 3 August 2022: €100,000 for marketing emails sent without consent and €500,000 for failures on information, access and objection rights and data security (GDPR arts 12, 13, 15, 21 and 32).

10. Recent changes and what to watch

• Expected late 2026, ETIAS[Adopted, start date not yet set]: visa-exempt visitors will need a travel authorisation; carriers must check it through the ETIAS carrier interface.
• 5 August 2026, AML scope[In force]: the current list of AML obliged persons still excludes hotels and travel sellers; currency exchange remains covered.
• Q4 2026, national rental registration service[Partly in force: national service due Q4 2026]: registration becomes compulsory in every municipality when the service opens; municipal numbers lapse after a transition period.
• 20 May 2026, tourist rentals[In force]: Law 2024-1039 provisions and Regulation (EU) 2024/1028 platform duties apply; listings in areas with registration need a valid number.
• 16 April 2026, tourism simplification bill[Bill, not enacted]: Sénat bill n° 560 would make Atout France registration fully electronic and renewable every three years.
• 10 April 2026, EES[In force]: the Entry/Exit System is fully operational at all external Schengen borders and has replaced passport stamping.
• 28 January 2025, API Regulation[Adopted, date not yet set]: Regulation (EU) 2025/13 will centralise advance passenger information through an EU router two years after it starts operations.

11. What this means for identity verification

• Collect to a list, not to a habit. Guest flows should capture the R814-2 fields for foreign guests only and verify nationality by viewing a document. Hotels should not store document images; other businesses may keep a justified copy for up to six years, archived and watermarked, and must not use the document number as a customer identifier.
• Separate arrival from booking. Pre-arrival capture is useful, but the design needs a signature step at arrival and electronic storage for six months with export to the police.
• Biometrics are optional by design. Facial check-in or boarding needs explicit consent, an equivalent non-biometric path and, preferably, templates held by the traveller.
• Platforms verify hosts, not guests. Rental platforms need registration-number capture, sworn statements, random checks, night counting and monthly data feeds.
• Remote exchange means full verification. Online currency exchange requires eIDAS "substantial" or "high" identification, or two R561-5-2 measures, for every transaction.
• Border data is changing. Carrier and charterer flows must handle EES and ETIAS checks and, later, routing of API data through the EU router.