Italy Airbnb Rules: One Rental Code, Two Counts 104,000 Apart, and Key Boxes Only With a Face Check

One national code, two counts that do not reconcile

The Ministry of Tourism assigns the CIN on application, through its national database of accommodation and tourist rentals, known by its Italian initials BDSR (Article 13-ter, comma 3). The database became operational with a notice in the Gazzetta Ufficiale of 3 September 2024. The Comune di Firenze's guidance gives 2 November 2024 as the start of the national CIN rules and 2 January 2025 as the start of sanctions, after a ministerial note of 22 October 2024, reported in the press, moved the deadline to obtain a code to 1 January 2025.

The first counts came straight from the Ministry. Its release of 20 November 2024 reported 567,000 units transmitted by the Regions and 340,623 codes issued, a share of 60.07%. Its release of 10 December 2024 gave "oltre 549.900" structures registered (more than 549,900) and more than 385,000 codes, which it called over 70%. The two releases measure different things, units transmitted by the Regions in the first and registered structures in the second, and neither explains why the second total is lower.

Later counts reached the public through trade press citing Ministry updates. UfficioCommercio reported 686,645 registered structures and 610,686 codes on 23 September 2025, a share of 88.94%. On 14 January 2026 it reported 694,287 registered and 621,262 codes, a share of 89.48%, with 11,173 positions still under administrative verification, equal to 1.80% of the code count by our arithmetic. Between September 2025 and January 2026 the registry grew by 7,642 structures and 10,576 codes (our arithmetic). We read those two updates through UfficioCommercio, not on a Ministry page. The Ministry's "BDSR in numeri" PDF and its file by Region, Province and Comune were not opened for this article.

The October figures come from two parliamentary appearances, as reported in the press. Mazzi answered a question in the Senate in early October; Travelnostop reported the figures on 9 October, with the word "censite" (surveyed). He repeated them in the Chamber on 21 October in answer to question 3-02969 from deputy Zanella, as Il Sole 24 Ore NT+ reported the next day, with the word "registrate" (registered). We could not read either transcript. In the Senate the minister also said, "per la prima volta abbiamo misurato e catalogato tutte le strutture", which translates as "for the first time we have measured and catalogued all the structures". The figures he gave are registrations. We found no estimate of Italy's total rental stock, and no count of unregistered units, alongside them.

Set side by side, the two snapshots point in different directions. In January, 73,025 registered structures had no code. In October the figure was 83,995. The share holding a code was 89.48% in January and 85.77% in October, and the difference in codes is larger than the difference in totals. Codes may have been revoked, or the October scope may exclude categories that hold many codes. We found no Ministry breakdown of the database by type, such as hotels against short lets or buildings against units. Until the Ministry publishes a breakdown, the two counts should be cited as separate snapshots, each with its date and source, and their difference treated as a gap between two counts of undefined scope.

What the national rules require

The CIN must appear outside the building and "in ogni annuncio ovunque pubblicato e comunicato", in every listing wherever it is published (comma 6). Estate agents and the operators of online portals "hanno l'obbligo di indicare", are obliged to show, the code in their listings. The faithful copy of the law we read gives them no duty to verify that the code is genuine.

The fines in comma 9 come in four bands. Letting without a CIN costs €800 to €8,000, scaled to the size of the property. Failing to display or indicate the code costs €500 to €5,000, plus immediate removal of the non-compliant listing. Letting a unit without the safety equipment required by comma 7 costs €600 to €6,000 for each violation found. Running lets as a business without filing the SCIA, the certified start-of-business notice required by comma 8, costs €2,000 to €10,000. The often-quoted "fines up to €8,000" applies only to the top of the first band. Under comma 10 these national fines do not apply where regional law already punishes the same act.

Under comma 7, units must have working detectors for combustible gas and carbon monoxide, and portable fire extinguishers, one for every 200 square meters of floor area or part of it, with at least one per floor. Smoke detectors are not in the text. A region or comune may still have its own rules.

Checks and sanctions under the CIN law fall to the comune (comma 11, as summarized from the copy we read). The tax side changed in 2026. The 2026 Budget Law (Law 199/2025, article 1, comma 17, as reported) now presumes that letting more than two apartments is a business, from the third unit; before, the line was drawn at the fifth. The flat rental tax, the cedolare secca, stayed at 26%, reduced to 21% for one unit, according to the Revenue Agency's April 2026 guide as reported by mysolution. A draft that would have raised the rate to 26% for every unit was dropped in December 2025. The municipal tourist tax is a separate charge set by each comune.

This article describes rules and their sources. It is not legal advice. Hosts and managers should check their own obligations with the comune, their region and a qualified professional.

The national rule targets key-box access with no face check

The story that became known as the key-box ban starts with an Interior Ministry circular dated 18 November 2024, protocol 38138, from the Public Security Department and signed by the Chief of Police. As the Camera di commercio Irpinia-Sannio relayed the Benevento Prefecture's note, the circular lists entry codes, key boxes placed outside and the electronic sending of ID copies as critical practices. It says that remote check-in alone "non può ritenersi satisfattiva", cannot be considered sufficient. It does not mention video. We did not open the circular itself.

The legal duty underneath is article 109 of the consolidated public security law, known as TULPS, which requires accommodation managers to identify guests and report them to the police. The circular is the Ministry's reading of that duty. The association F.A.R.E. challenged it, and on 27 May 2025 the regional administrative court of Lazio (TAR Lazio, judgment 10210/2025) annulled it and ordered the Ministry to pay €2,000 in costs plus extras. The operative part reads "annulla il provvedimento impugnato", it annuls the contested measure, although La Nazione, reporting the appeal ruling on 21 November 2025, wrote that the TAR had suspended it.

The Interior Ministry appealed. The Consiglio di Stato, Third Section, heard the case on 9 October 2025 and published judgment 9101/2025 on 21 November 2025. It upheld the appeal, reversed the TAR ruling and dismissed the original challenge, with costs at both levels set off. The circular, the court said, is an internal guidance act for prefects and police chiefs, "meramente ricognitive dell'obbligo di legge senza nulla aggiungere", merely restating the legal obligation and adding nothing to it. A challenge to it therefore lacked the required interest. On the substance, the court wrote that the article 109 check "non può che essere effettuata de visu", can only be carried out in person, by sight, and that remote check-in alone does not satisfy it.

The key passage for hosts is section 6.3. The court first notes that identification by sight need not mean the owner standing at the door. It could be carried out "mediante appositi dispositivi di videocollegamento predisposti dal gestore all'ingresso della struttura", through video devices set up by the manager at the entrance, provided they confirm in real time that the guest matches the identity document, for example a digital peephole or a QR code that captures a still image. The circular, the court continues, "non tocca questi aspetti, né per converso li esclude categoricamente", does not touch these aspects nor categorically exclude them. It confines itself to censuring "le procedure più estreme di check in remoto", the most extreme remote check-in procedures, in which managers simply collect guests' identity documents "senza alcun controllo visivo", with no visual check, and send them automatic door codes or key-box access. No national statute bans the box as an object. Key-box or code access with nobody checking the guest's face against the ID is what the circular targets and what the court accepted. Video identification at the entrance is not excluded, but no authority has certified any system.

The rental association AIGAB and ItaliaOggi reported on 21 March 2025 that the Interior Ministry would issue a follow-up circular naming acceptable technologies before Easter 2025. We found no such circular. AIGAB was still asking for a working table with the Ministry in November and December 2025. The penalty for breaching article 109 is set by article 17 of TULPS, arrest of up to three months or a fine of up to €206; that figure comes from press reports, because the police document we tried to open refused access.

Florence and Milan ban the boxes themselves, under city rules

The only rules we found that ban key boxes as objects are municipal. Florence amended its urban police regulation on 10 February 2025. According to AGI on 24 February 2025, the use of key boxes is "sempre vietato", always prohibited, where they are "destinati a permettere l'accesso a edifici o appartamenti senza la presenza del gestore o suo incaricato", meant to let people into buildings or flats without the manager or a representative present. Separately, one numeric keypad per building may face the public street, with the condominium's authorization. The fine is €400, and fines began the day after the AGI report. AGI describes a rule of the Comune with no area limit. We did not open the regulation text itself and could not find the article number.

Florence's key-box rule sits beside its separate cap on new short-term rentals, which we covered in our analysis of the Florence rental rules. On 14 May 2026 the regional administrative court of Tuscany rejected the appeals against Florence's rental rules, including the key-box ban. Reports differ on whether there were 18 or 19 appeals and on the judgment numbers, and we did not open the texts. Visitors planning a stay can find the practical side in our Florence travel guide.

Milan followed in December 2025. Il Post reported on 5 December that the city had amended its urban police regulation to ban lockboxes in public space, such as on signposts and poles, and on private structures facing public land. The fine is €100 to €400, and the rule took effect 30 days after approval, which places it in early January 2026. We did not open the Milan deliberation.

Rome has no dedicated key-box rule that we could find. A general ban on fixing objects to heritage buildings carries a €400 fine, according to press reports, and our Rome travel guide covers the city for visitors. For Venice, Naples, Bologna, Turin and Genoa we found no ban. The result is two separate legal layers. The national identity duty under article 109 applies everywhere in Italy. The street-furniture bans apply only where a city has adopted one.

The EU data regime applies from 20 May 2026, with no Italian rules found

Regulation (EU) 2024/1028 on data collection and sharing for short-term rentals was adopted on 11 April 2024 and published in the Official Journal on 29 April 2024. Article 19 says it applies from 20 May 2026. Article 7(1)(b) requires platforms to "ensure that hosts have provided a registration number prior to allowing the offering" and to display that number clearly in the listing. Article 7(1)(c) requires them to make reasonable efforts to check declarations and the validity of registration numbers at random and on a regular basis. Italy's CIN law asks portals to show the code. The EU text adds the checks.

Article 9 adds data. For listings in areas on the published list of areas for which competent authorities have requested data (Article 13(1)(b)), platforms must collect activity data and send it each month to that state's single digital entry point. Article 15 splits enforcement. Duties under Article 7(1) and Article 8 are enforced through Chapter IV of the Digital Services Act. Authorities designated by each member state enforce the rest, including the data duty. Article 15(3) leaves penalties to member states, which must make them "effective, proportionate and dissuasive". Article 15(4) says member states "shall by 20 May 2026 adopt and publish" those rules and notify the Commission. The Regulation sets no fine amounts of its own.

For Italy we found no implementing decree or law, no designation of a single digital entry point or competent authority, no penalty rules under Article 15(4) and no list of areas for which data has been requested. Normattiva, the official database of Italian law, did not load for us, so this is a finding about what we could locate, and a measure adopted without wide coverage could have been missed. The legal site diritto.it wrote on 29 May 2026 that "questo meccanismo non è ancora operativo", the mechanism is not yet operational, and that Italy was still waiting to complete the technical infrastructure. In October Mazzi told the Senate that the ministry is working "con le principali piattaforme online per l'attuazione del Regolamento europeo numero 1.028 del 2024", with the main online platforms to implement the regulation, "affinché i controlli sugli annunci diventino sistematici e periodici", so that checks on listings become systematic and periodic. That is the future tense, more than four months after the application date. We found no Commission reminder or infringement step against Italy.

Two claims about the regime circulate without support. Agenzie WKI wrote on 22 May 2026 that the Ministry already receives monthly platform data and that the BDSR is Italy's single digital entry point. We found no official designation, and the minister's October wording describes the work as unfinished. The same outlet said platforms face fines of up to 4% of turnover under the Regulation. Article 15 sets no amounts, and the Digital Services Act route applies only to the duties in Articles 7(1) and 8.

The only published measure of platform use in Italy comes from Eurostat, in a statistical series that runs separately from the Regulation. In 2025, guests booked 138,736,628 nights in Italy through Airbnb, Booking and Expedia, third among the countries covered after France (213 million) and Spain (189 million). That is 14.6% of the 951.6 million nights for the EU and EFTA countries combined, by our arithmetic. From January to June 2026, Italy's platform nights reached 60,819,412, up 9.96% on the same months of 2025 on the same three platforms (our arithmetic). Eurostat warns that 2025 is the first year with three platforms instead of four, after Tripadvisor left, and that the figures cannot be combined with other tourism statistics. They are guest nights, not properties, so they cannot be set against CIN counts. They also differ from the national nights totals discussed in our comparison of Italy and Spain, which count private rentals on a different basis.

Where the enforcement data is missing

We found no national count of CIN fines, inspections or listings removed for a missing code. We looked in the Ministry's pages, its 2025 economic report and its BDSR slides, in coverage of the Guardia di Finanza and in the minister's October statements. Airbnb said on 20 November 2024 that it would remove listings without a CIN during 2025. It has published no count of removals that we found, and neither has Booking.com.

The only national inspection figures concern a different law. The Carabinieri health and safety unit, the NAS, ran a campaign from November 2024 that inspected almost 2,500 B&Bs and found more than 500 out of order. It recorded 43 violations of article 109 TULPS, about 1.7% of inspections by our arithmetic, along with 731 administrative and 61 criminal violations and fines of more than €500,000, according to AGI on 22 February 2025. We did not find the NAS original. The figures do not say how many of the 43 cases involved key boxes or remote check-in. No key-box count exists anywhere we looked.

We found no official estimate of how many short-term rental units Italy has, from ISTAT, the Bank of Italy or anyone else. The industry association Aigab's research center counted 509,342 homes advertised online in September 2026, as reported by monetaweb, without a described method. That number sits close to the minister's 506,296 codes, and the two should not be subtracted, since they differ in source, date and scope. In December 2024 then tourism minister Santanchè said she expected about 20% of units to stay unregistered, according to Il Post. That was a projection, and no measurement has followed.

Other Italian tourism data shows the same gap. The EES border system produced EU-wide counts and none for Italy. The Ministry's 2026 tourism totals in our record watch name no series. Here the rules, fines, court rulings and registration counts are public, and their effect goes unmeasured. The country lacks a count of fines collected, a count of listings removed, a change in unregistered stock, or a first month of platform data under the EU regulation.

What this means for travelers, businesses and analysts

Travelers booking a short-term rental in Italy should see a CIN in the listing and on the building. A listing without one is breaking the national display rule, though that alone tells you nothing about the property's safety. Expect hosts to check your identity in person or by live video at arrival. A code sent by message with nobody checking your face is the practice the Interior Ministry circular targets. In Florence, a key box on the street is banned, and Milan has banned them in public space. The rental rules sit apart from the Venice access fee and other visitor charges.

Tourism businesses and investors, including hosts, property managers and platforms, face four separate layers. They are the national CIN and safety rules with fines up to €10,000, the article 109 identity duty, city rules in Florence and Milan, and an EU regime for which we found no Italian penalty rules. No official list of approved remote-identification tools exists, so any self check-in system that relies on video carries some legal uncertainty until the Interior Ministry says more. Platforms will need a national entry point and penalty rules before the monthly data duty can work in Italy. From the third apartment, lettings are now presumed to be a business for tax purposes. None of this is legal advice, and each case depends on region and comune.

Journalists and analysts can cite 694,287 registered structures and 621,262 codes (Ministry database update, 14 January 2026, via UfficioCommercio) and 590,291 rentals with 506,296 codes (minister Mazzi, October 2026, as reported), always as separate snapshots. They can also cite the fine bands in comma 9, Consiglio di Stato judgment 9101/2025 of 21 November 2025, and Eurostat's 138.7 million platform nights for Italy in 2025. Claims not to repeat include a national key-box ban, a TAR suspension, "fines up to €8,000" for any breach, 4% platform fines and the minister's claim to have measured every structure. Italy publishes the rules and the registrations, and we found no measure of what enforcement achieved.