Travel & Hospitality Compliance in Germany

Germany is open to online travel and hospitality businesses: there is no licence to sell accommodation or travel online, and identity rules attach to specific activities rather than to the sector as a whole. The obligations that matter most are guest registration under the Federal Registration Act, the carrier and passenger data duties of airlines and other carriers, the new EU short-term rental data rules, and licensing for currency exchange.

The principal authorities are the registration and police authorities of the 16 federal states (Länder), which inspect guest records, the Federal Police (Bundespolizei), which runs border control and receives advance passenger data, and the Federal Network Agency (Bundesnetzagentur), which now operates the single digital entry point for short-term rental data.

The biggest obstacle for a digital entrant is that contactless check-in must use one of the confirmation methods the statute names. A generic remote identity check that works for other industries does not, by itself, satisfy the hotel registration duty.

1. Who regulates this sector

Data protection is supervised under the General Data Protection Regulation (GDPR) by the independent federal and state supervisory authorities, which coordinate their positions in the Datenschutzkonferenz (DSK).

2. Licensing and authorisation

Operating a hotel, a booking site or an online travel agency does not require a sector-specific identity licence. Two activities do bring authorisation or registration duties; carrier duties are covered in section 7.

Currency exchange

Trading in foreign notes and coins (Sortengeschäft) is a financial service under § 1(1a) sentence 2 No 7 of the Banking Act (Kreditwesengesetz, KWG). A business that provides it commercially needs written or electronic authorisation from BaFin (§ 32(1) KWG), and operating without it is a criminal offence punishable by up to five years' imprisonment (§ 54(1) No 3 KWG). A business whose only financial service is currency exchange and whose main activity is something else, such as a hotel front desk, is not treated as a financial services institution (§ 2(6) sentence 1 No 12 KWG).

Short-term rentals

The EU Short-Term Rental Regulation, Regulation (EU) 2024/1028 [In force, applies from 20 May 2026], lets Member States and regions run registration procedures for rental units. Where a procedure exists, the host declares the unit and its own identity (for a natural person: name, a national identification number or other identifying information, address, telephone and email) and receives a registration number (Article 5(1)). Germany's implementing act [In force since 1 July 2026] amends the Digitale-Dienste-Gesetz (Germany's act implementing the EU Digital Services Act) and places the single digital entry point and national coordination with the Bundesnetzagentur (§ 22a). Registration procedures are optional and set by the Länder and municipalities: as of 26 October 2026 the Bundesnetzagentur listed 12 active areas (Berlin, Hamburg, Tübingen and nine municipalities in North Rhine-Westphalia, including Cologne, Düsseldorf and Dortmund). Hotel rooms and campsites are outside the Regulation's scope. Platform spot checks are planned from October 2026.

3. Identity framework (AML rules do not apply)

The Anti-Money Laundering Act (Geldwäschegesetz, GwG) lists its obliged entities in § 2(1). Hotels, tour operators, travel agencies, online booking platforms and carriers are not among them. The traders-in-goods category (§ 2(1) No 16, § 1(9) GwG) does not extend to services. For most of the sector there is therefore no customer due diligence, beneficial ownership or suspicious activity reporting duty under the GwG.

Identity in travel is instead governed by public-order and border law:

Guest registration

Federal Registration Act (Bundesmeldegesetz, BMG) §§ 29 to 30: foreign guests complete a registration form and show a valid identity document on arrival.

Carrier duties

Residence Act (Aufenthaltsgesetz, AufenthG) § 63: carry foreign nationals only with the required passport and residence title. Federal Police Act (BPolG) § 52: advance passenger information.

Passenger name records

Passenger Data Act (Fluggastdatengesetz, FlugDaG) § 2: airlines transmit booking data for flights to and from Germany.

Platform data

Regulation (EU) 2024/1028 and the Digitale-Dienste-Gesetz: host registration numbers and activity data for short-term rentals.

Where the AML regime does apply

A licensed currency exchange business is a financial services institution and therefore an obliged entity (§ 2(1) No 2 GwG). On top of the general GwG triggers, § 25k(1) KWG requires it to identify the customer, establish any beneficial owner and check politically exposed person status on cash exchanges of EUR 2,500 or more that are not settled through the customer's account with the institution. The full GwG framework then applies, including reporting to the Financial Intelligence Unit. Financial sanctions apply to all businesses regardless of sector; the Servicezentrum Finanzsanktionen of the Deutsche Bundesbank is responsible for implementing financial sanctions in Germany.

4. Identity verification and onboarding

Guest registration in accommodation

Under § 29(2) BMG, every foreign guest in commercial accommodation must sign a special registration form (Meldeschein) by hand on the day of arrival. Accompanying foreign family members are recorded only by number, and in tour groups of more than ten only the tour leader signs. Named guests must identify themselves with a valid, recognised passport or passport substitute (§ 29(3)).

The form may contain only the data listed in § 30(2) BMG: arrival and expected departure dates, surname, first names, date of birth, nationalities, address, the number and nationality of accompanying foreigners, and the serial number of the passport or substitute. The operator must compare the form with the identity document and note any deviation, or the absence of a valid document, on the form. Land law may add data needed for tourist and spa taxes (§ 30(3)). Education facilities, members-only company and club homes, youth hostels, mountain huts and religious bodies' facilities are exempt (§ 29(6)).

Electronic registration

With the guest's consent, the form can be replaced by electronic capture of the same data, provided the guest confirms its accuracy and completeness on the day of arrival by one of three methods (§ 29(5) sentence 1 BMG):

• a card payment with strong customer authentication within the meaning of § 1(24) of the Payment Services Supervision Act, with the payment instrument's dedicated reference number recorded;
• the electronic proof of identity under § 12 of the eID Card Act (the eID card available to EU and EEA citizens) or § 78(5) AufenthG (the electronic residence permit);
• reading the eID card or electronic residence permit on site.

Operators, groups of linked properties and providers of registration software may apply to the BSI to trial a different procedure for up to five years, if it offers a security level comparable to the three statutory methods. The Accommodation Registration Data Ordinance (BeherbMeldV) requires each electronic record to be stored on arrival day as a structured XML file.

Passengers and border crossing

Air carriers bringing passengers across the Schengen external border must collect document data and transmit it to the Federal Police when check-in closes (§ 52 BPolG). At the border, third-country nationals are recorded in the EU Entry/Exit System with facial image and fingerprints; entry is not possible without that registration.

5. Digital channels: what's different

Bottom line: the data a hotel must collect is the same online and at the desk, but going paperless depends on consent and on one of three statutory confirmation methods on the day of arrival; a generic remote identity check is not one of them.

Contactless hotel check-in

The card route turns the payment into the identity confirmation, so the SCA-authenticated payment must happen on the arrival day and its reference number must be stored with the record (§ 30(2) BMG). The eID routes serve only holders of an EU or EEA eID card or a German electronic residence permit.

Automated passenger processing at airports

§ 19e of the Aviation Act (Luftverkehrsgesetz, LuftVG), in force since 23 July 2026, allows airlines, airport operators and ground handlers to check passports and ID cards automatically at check-in, bag drop and boarding. It covers German documents and, through § 18 of the Freedom of Movement Act/EU and § 86b AufenthG, documents issued by EU and EEA states and Switzerland to their own nationals; other third-country documents are not covered. Operators may read the chip once and match its photo to a live image, only with explicit consent and only within the EU. The biometric template and encrypted data must be deleted at the latest three hours after departure, authenticity checks are presumed state of the art if they follow BSI technical guidelines TR-03121 and TR-03135, and every passenger must be able to choose manual processing instead. Under the European Data Protection Board's Opinion 11/2024, templates held only by the passenger, or centrally encrypted with a key only the passenger holds, can be compatible with the GDPR, while central airport or airline-cloud databases enabling one-to-many matching cannot.

Advance passenger information

Regulation (EU) 2025/12 [Adopted, applies two years after the EU router starts operating] will require air carriers to collect document data by automated means, including during online check-in. eu-LISA's 2026 to 2028 programming document plans the router for 2029.

6. Data protection and biometrics

The GDPR applies to all guest and passenger data; sector rules narrow it.

• Data minimisation by statute. The registration form may contain only the listed fields (§ 30(2) BMG). The Bavarian data protection authority (BayLDA) states that the BMG has never required an ID copy, and considers pre-arrival ID scans, with or without a selfie, unsuitable for confirming identity.
• German documents. A German ID card or passport may be copied only by the holder or with the holder's consent, the copy must be clearly and permanently marked as a copy, and it may not be passed to third parties (§ 20(2) Personalausweisgesetz, § 18(3) Passgesetz); nobody may demand a German ID card as a deposit (§ 1(1) Personalausweisgesetz). Carriers may otherwise read only a German passport's machine-readable zone, and only where border control cooperation requires it (§ 18(4) Passgesetz).
• Biometrics. The DSK position paper on biometric analysis (version 1.0, 3 April 2019, adopted against the votes of Bavaria and Baden-Württemberg) treats biometric processing for unique identification as prohibited in principle under Article 9(1) GDPR unless an Article 9(2) exception, typically explicit consent, applies. Face matching at self-service check-in should therefore be optional and consent-based.
• Retention. Guest records are kept for one year from departure and destroyed within three months afterwards (§ 30(4) BMG). Advance passenger information is deleted by the airline 24 hours after transmission (§ 52(5) BPolG); the Passenger Information Unit deletes PNR data after five years (§ 13(1) FlugDaG).

7. Sector-specific obligations

Passenger name records

Airlines must transmit PNR data for all scheduled, charter and taxi flights departing from or landing in Germany, including flights to and from other EU states, to the Passenger Information Unit at the Bundeskriminalamt (§§ 1 and 2 FlugDaG). Transmission happens 48 to 24 hours before departure and again once boarding closes (§ 2(5)). Travel agencies and other booking intermediaries that pass PNR data to airlines must do so in time for the airline to meet those deadlines (§ 3 FlugDaG).

Carrier liability for travel documents

Carriers may bring foreign nationals into Germany only if they hold the required passport and residence title (§ 63(1) AufenthG). The Federal Ministry of the Interior may issue a prohibition order and, for each person carried in breach of it, impose a coercive fine of between EUR 1,000 and EUR 5,000 (§ 63(2) and (3)). A carrier must also return passengers who are refused entry (§ 64 AufenthG).

Travel authorisations and visas

ETIAS [Adopted, start date not yet set] will require nationals of 59 visa-exempt countries and territories to hold an authorisation before travelling, at a fee of EUR 20, valid for three years or until the passport expires. Air carriers, sea carriers and coach operators carrying groups overland must query the ETIAS system before boarding, using the travel document's machine-readable zone (Article 45 of Regulation (EU) 2018/1240). For six months after launch ETIAS is optional; a six-month grace period follows, in which first-time travellers without an authorisation may still be admitted (Article 83, both periods extendable). Travel agents may apply for clients under a signed declaration of representation. For visa-required travellers, Germany's Auslandsportal accepts online national visa applications, but original documents and fingerprints are still presented in person.

8. Risk indicators and red flags

Identity and fraud indicators in travel and hospitality

• Document mismatch: registration data that differs from the identity document presented, which must be noted on the form.
• No valid document: a foreign guest who cannot show a valid passport or accepted substitute.
• Large groups: tour groups of more than ten, where only the tour leader signs and individual foreign travellers are recorded by number and nationality only.
• Unregistered rental units: listings without a valid registration number in areas with a registration procedure.
• Copycat authorisation sites: unofficial ETIAS websites that claim to file applications or charge higher fees.
• Stockpiled ID scans: stored ID copies that, once leaked, are used for online fraud and to open accounts under false identities.
• Large cash currency exchange: cash exchanges of EUR 2,500 or more not settled through an account, which trigger due diligence.

9. Enforcement and penalties

Guest registration is enforced locally by the authorities that Land law designates. Short-term rental platform duties under Articles 7(2) and (3) and 9 of Regulation (EU) 2024/1028 are enforced by the Bundesnetzagentur (§ 22b Digitale-Dienste-Gesetz). In its 2025 activity report (March 2026) the BayLDA reported frequent complaints about ID scans demanded by self-check-in accommodation, and notified businesses demanding ID cards as a deposit under Article 58(1)(d) GDPR.

10. Recent changes and what to watch

• 28 October 2026: New Federal Police Act [In force]. Advance passenger information duties now sit in § 52 BPolG; airlines should update references in their compliance documentation.
• 23 July 2026: Act enabling digital passenger processing [In force]. Airlines may read passport and ID chips and use consent-based face matching for German, EU, EEA and Swiss documents.
• 1 July 2026: Short-term rental implementing act [In force]. The Bundesnetzagentur runs the single digital entry point; platforms must collect and display registration numbers where a procedure exists.
• 20 May 2026: Regulation (EU) 2024/1028 [Applies]. Hosts registering in areas with a procedure must declare their identity and the unit's details.
• 10 April 2026: Entry/Exit System [Fully operational]. All third-country nationals' entries and exits are now recorded biometrically.
• 1 January 2025: Fourth Bureaucracy Relief Act [In force]. German guests no longer complete the federal registration form, and the BSI took over approval of trial electronic procedures for up to five years.
• Watch: ETIAS [Adopted, start date not yet set]. Carriers should prepare boarding checks.
• Watch: Digital Identities Act (DIdG) [Passed Bundestag, awaits Bundesrat]. It underpins the EUDI wallet planned for 2 January 2027; it does not amend guest registration rules.

11. What this means for identity verification

• Route by nationality first. Only foreign guests need the federal form, so capture nationality before asking for documents.
• Design around the three statutory confirmations. An SCA card payment on the arrival day is the only route available to most non-EU guests; eID and on-site chip reading cover EU eID card and German residence permit holders.
• Collect the minimum, keep a fallback. Record the passport serial number and listed fields rather than ID scans; keep biometrics optional, keep templates under the user's control, and offer a non-digital route.
• Build for audits. Store XML records for one year and export them on request.
• Treat currency exchange separately. If it is a main business, apply full GwG due diligence and the EUR 2,500 cash trigger.