Travel & Hospitality Compliance in Singapore

Singapore is open to online travel and hospitality businesses, and its rules are largely channel-neutral: the same hotel registration, guest record and travel agent licensing duties apply whether a booking is made at a counter or in an app. The principal regulators are the Hotels Licensing Board, STB, the Immigration & Checkpoints Authority (ICA) and, for privacy, the Personal Data Protection Commission (PDPC).

The biggest practical obstacle for a new entrant is reconciling two rules that pull in opposite directions: hotels must record every guest's identity document number, while PDPC guidance treats national identification numbers as high-risk data that should be collected only where the law requires it and protected to a higher standard.

1. Who regulates this sector

Hotel, travel agent and border rules are national; Singapore has no regional layer. Short stays in homes fall under planning and public housing rules rather than hotel licensing.

2. Licensing and authorisation

Hotels and other paid accommodation

Under the Hotels Act 1954, no premises may be used as a hotel unless registered (section 5), and no person may keep or manage a hotel without a licence for those premises (section 7). Section 2 defines a hotel to include boarding houses, lodging houses, guesthouses and any premises with at least 4 rooms or cubicles where people are lodged for reward and domestic service is provided. Two authorisations are therefore needed: a certificate of registration for the premises and a hotel-keeper's licence for the individual managing them. Applications, amendments, renewals and cancellations are made through GoBusiness Licensing; HLB renews licences annually between 1 October and 15 November, and a hotel that stops operating must apply to cancel within 10 days. HLB may suspend or cancel a registration where a hotel is run in an improper or unsatisfactory manner (section 8), and licensees are liable for the acts of their staff (section 13).

Travel agents and online travel sellers

Section 6 of the Travel Agents Act 1975 prohibits carrying on the business of a travel agent without an STB licence. Under section 4, that covers selling or arranging travel on any conveyance, travel-and-accommodation packages, travel bought for resale, and tours. STB offers two licences:

Niche licence

Tours within Singapore with conveyance but no accommodation. Companies need paid-up capital and net value of S$50,000; sole proprietors and partnerships, net value of S$50,000.

General licence

Everything else, including outbound packages and air tickets. Companies need paid-up capital and net value of S$100,000; sole proprietors and partnerships, net value of S$100,000.

Applicants nominate a key executive and must show that they and their directors and managers are suitable persons. Applications go through STB's TRUST system (S$200 application fee, S$400 licence fee). Licences have been issued electronically since 1 January 2024, and since 27 April 2026 an agent must inform STB at least 7 days before trading from a new place of business (regulation 10, Travel Agents Regulations 2017).

Short stays in homes and serviced apartments

Paid stays of less than 3 consecutive months in a dwelling house need planning permission (Planning Act 1998, s 3(3)(d) and Fourth Schedule, para 2); URA states homes may not be used this way, including via home-sharing platforms. Serviced apartments have a seven-day minimum. Public housing is stricter: HDB flat owners need HDB approval before renting out a flat or bedroom, each rental must run at least 6 months, and HDB states that tourists may not rent any HDB flat or bedroom. Letting without HDB's written consent is a ground for compulsory acquisition (Housing and Development Act 1959, s 63(1)(h)).

3. Identity framework (AML rules do not apply)

Hotels, travel agents and booking platforms are not financial institutions under MAS's AML Notices, so no customer due diligence (CDD) regime applies to them as such. Their identity obligations come from three sources.

Sector licensing rules

The Hotels Licensing Regulations require identity particulars from every guest (section 4). The Travel Agents Act requires no customer identification, but regulates who may sell travel.

Border law

The Immigration Act 1959 places passenger data and boarding duties on airlines and other transport operators (section 7).

Universal reporting duty

Any business that knows or has reasonable grounds to suspect property is connected to crime must file a suspicious transaction report (STR) with STRO. Failure to report may be an offence (section 45, Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992).

A parallel duty covers terrorist property (sections 8 and 10, Terrorism (Suppression of Financing) Act 2002). STRs are filed through the Police's SONAR platform. MAS also expects everyone in Singapore to screen clients against United Nations sanctions lists.

The exception: money-changers

Travel businesses that exchange currency are subject to MAS Notice PSN01 (2 April 2024, last revised 30 June 2025), which is legally binding. A money-changer must perform CDD for any transaction above S$5,000 for a customer without an existing business relationship. Money-changing transactions up to S$20,000 that are funded from an identifiable source are exempt from that trigger. CDD is also required whenever money laundering or terrorism financing is suspected, or when earlier information is doubtful (paragraph 7.3). Split transactions must be treated as one (paragraph 7.4). CDD records must be kept for at least 5 years (paragraph 16.3).

4. Identity verification and onboarding

Guest registration in hotels

Regulation 27(1) of the Hotels Licensing Regulations requires the licensee to obtain, before the guest occupies a room, the guest's full name and nationality and the identification number of any identity card, passport or other travel or personal identification document the guest holds. An accompanying adult may give them for a guest under 7 (regulation 27(2)).

Regulation 28 requires a physical or electronic record of each guest's particulars and room location before occupancy. Each entry must be acknowledged by or for the guest by signature, right thumbprint or any other method the licensee considers appropriate, and kept for at least 5 years. Entering particulars known, or discoverable with reasonable diligence, to be false is an offence (regulation 28(4)).

Tenants of public housing

HDB flat owners must register tenants' particulars with HDB and ensure tenants are legally resident; non-citizens need one of six listed long-term passes valid for at least 6 months.

Travel agents and platforms

Travel agents have no statutory customer identification duty. Platforms face a seller-side duty instead: STB's Guidelines for Platform Operators ask platforms listing travel, tour or guiding services to obtain a copy of the seller's licence or check the seller's name against TRUST before publishing the listing.

At the border

All arriving travellers, except airside transit passengers and residents entering at the land checkpoints, must submit the free SG Arrival Card through ICA within three days (including the arrival day) before arrival; ICA does not endorse paid third-party submission services. Nationals of listed countries also need an e-visa, and visit passes are issued by email. All foreign visitors can use automated lanes on arrival, and residents and departing visitors can clear with face and iris biometrics alone at the airports and sea terminals.

5. Digital channels: what's different

Bottom line: the rules are channel-neutral for hotels and travel agents, but online sales change who needs a licence, add a seller-verification step for platforms, and make PDPC's limits on copying identity documents bite harder than at a front desk.

Online check-in

Electronic records and acknowledgement "by any other method" accommodate app or kiosk check-in, but the record must be complete before the guest occupies the room, so a contactless flow must close it before releasing a key.

Document images and the PDPA

Under PDPC's NRIC guidelines, merely sighting an identity card at a desk is not a collection of personal data (paragraph 5.12), but capturing an image of it collects everything on it, which must be justified as not excessive (paragraph 3.15). The hotel rules require only the document number.

Who needs a travel agent licence online

STB states that licensing applies only to transactions conducted within Singapore: an overseas agent selling outside Singapore, with payment made abroad, needs no licence even for trips to Singapore. A Singapore-based online agency does.

6. Data protection and biometrics

The Personal Data Protection Act 2012 (PDPA) governs private-sector handling of guest and traveller data. Public agencies, including ICA when it processes biometrics at the border, are outside its data protection provisions.

PDPC's Advisory Guidelines on the PDPA for NRIC and other National Identification Numbers (issued 31 August 2018) are central for this sector. The NRIC is Singapore's national identity card. Organisations may collect NRIC numbers, foreign identification numbers and work permit numbers only where the law requires it or where identity must be verified to a high degree of fidelity. PDPC uses hotel check-in as its example of collection required by law: a hotel may obtain the guest's name and NRIC number to comply with regulation 27. Consent is not needed where the law requires the number, though notifying the purpose is good practice. The guidelines also cover:

• Passport numbers: organisations should treat them like NRIC numbers. Where collection is not required by law, they should collect only partial numbers.
• Physical documents: organisations should not retain physical identity cards unless the law requires it.

PDPC's Guide on Responsible Use of Biometric Data in Security Applications (17 May 2022) uses hotel room and lift access as an example of biometric access control. It recommends explicit consent at enrolment, liveness detection against spoofing (citing ISO 30107), encrypted templates, and deleting raw images and templates once no longer needed.

The PDPA sets no fixed retention period. PDPC has said these guidelines will be updated following the Ministry of Digital Development and Information's statement of 13 December 2024. It already advises organisations not to use NRIC numbers to authenticate identity.

7. Sector-specific obligations

Airlines and transport operators: passenger data and No-Boarding Directives

The Immigration (Amendment) Act 2023 is being brought into force in phases. From 31 July 2025, inaccurate, incomplete or late advance passenger and crew information from aircraft, vessel and train operators is a strict liability offence. From 30 January 2026, ICA issues No-Boarding Directives to airlines at Changi and Seletar Airports. An airline that receives one must deny boarding to the named traveller. ICA may also issue them against travellers lacking a required visa or a passport valid for six months.

Hotel security duties

Since 1 January 2025, regulation 30 of the Hotels Licensing Regulations requires a video surveillance system recording every entrance and exit, lobby, front desk and route to guest rooms, with recordings kept for at least 31 days. Since 3 July 2025, regulation 31(2) requires the licensee to notify the Police without delay if it has reason to believe illegal activity is taking place in the hotel, or that drugs, weapons or explosives have been brought in or left there.

Travel agent conduct

Agents must display their electronic licence, which carries a verifiable QR code. Under regulation 21 of the Travel Agents Regulations 2017, before taking the first payment from an individual for a product delivered wholly or partly outside Singapore, they must invite the customer to consider insurance against the agent's insolvency and name insurers. They must record the customer's name, every traveller's name and the customer's acknowledgement, and keep that record for at least 12 months. STB can suspend or revoke licences and publishes a list of suspended travel agents.

8. Risk indicators and red flags

Fraud and identity-abuse indicators in travel and hospitality

• Unlicensed sellers: travel products offered by a business not listed on STB's TRUST directory.
• Off-platform payment: buyers of packages moved from social media to WhatsApp and asked to pay by PayNow QR code.
• Fake itineraries: booking confirmations or tickets that the operator cannot match on its own channels.
• Impersonated hotels: WhatsApp or email messages quoting genuine booking details and linking to sites that collect card details; Police reported at least 148 cases and S$185,000 lost from January to October 2026.
• Homes sold as hotels: residential units offered for stays shorter than URA's or HDB's minimum periods.
• Structured currency exchange: frequent money-changing over a short period, or amounts split to stay under the S$5,000 identification threshold.
• Note swapping: exchanging large amounts of small-denomination notes for higher denominations in another currency, or presenting counterfeit notes.

9. Enforcement and penalties

On 16 October 2025 STB publicly named an individual and two companies under investigation for allegedly supplying travel products without a licence. On 1 July 2025 URA reported charges against four companies and two individuals for short-term accommodation at 170 units in 50 private developments, and HDB acted on 571 unauthorised rentals in the five years to January 2024 (MND).

10. Recent changes and what to watch

• 9 October 2026[In force] Police advisory on phishing that impersonates hotels and booking platforms using real reservation details. Hotels should give guests a verifiable channel for payment requests.
• 8 May 2026[Announced, from early 2027] ICA will introduce automated in-vehicle clearance for cars and cargo vehicles at Tuas Checkpoint, using QR codes or passports plus facial biometrics.
• 27 April 2026[In force] Travel Agents Regulations amended: 7 days' notice to STB before trading from a new place of business.
• 31 March 2026[In force] Facial images began replacing fingerprints as the primary biometric for motorcyclists at Woodlands Checkpoint, with Tuas following.
• 30 January 2026[In force] No-Boarding Directives to airlines began at Changi and Seletar. Carriers need a reliable process to act on them at check-in.
• 16 October 2025[In force] STB advisory on unlicensed travel sellers, signalling active enforcement against sellers operating through online channels.
• 31 July 2025[In force] Stricter advance passenger and crew information duties for transport operators, enforced as strict liability offences.
• 3 July 2025[In force] Hotels must notify the Police without delay of suspected illegal activity, drugs or weapons on the premises.
• 1 January 2025[In force] Hotels Licensing Regulations amended, including a duty to record entrances, front desks and guest-room routes on CCTV and keep footage for 31 days.
• 14 December 2024[Update announced, not yet issued] PDPC will update its NRIC guidelines. Hotels should expect clearer rules on identification versus authentication.

11. What this means for identity verification

• Data to capture: hotels need name, nationality and a document number, recorded and acknowledged before a room key is issued.
• Document images: an image goes beyond what the rules require and brings everything on the document under the PDPA; keep only what is needed.
• Liveness and face matching: the hotel and travel agent rules do not require them. Where hotels use them, PDPC recommends consent, liveness detection and template-only storage. Remote money-changers can use MAS's listed checks, including real-time video and biometrics linked incontrovertibly to the customer.
• Authentication: NRIC numbers are identifiers, not proof of identity; do not use them to authenticate returning guests.
• Seller verification: platforms should check each travel seller's STB licence on TRUST before listing.
• Retention: guest records and money-changing CDD records at least 5 years, travel insurance acknowledgements at least 12 months, hotel CCTV at least 31 days; then delete.