The compliance stack for booking platforms in Europe

A booking platform operating in Europe carries four layers of compliance obligation: tourist tax, guest registration, the EU Short-Term Rental Regulation 2024/1028, and seller income reporting under DAC7. Each layer has its own legal basis, its own authorities, and its own failure mode. This post maps all four, so your compliance team can see the full picture in one place and decide what to own internally and what to automate.

Layer 1: tourist tax

Tourist tax is set locally. Every municipality decides its own rate, its own exemptions, and its own calculation logic, and changes them without warning. For a platform selling stays across dozens or hundreds of European cities, monitoring those rates is a full time job that usually sits unowned or lands on the engineering roadmap one rule change at a time.

The liability question makes this layer the most expensive one to get wrong. Where the platform collects tourist tax from guests, collecting the wrong amount at scale creates exposure toward hosts, guests, and the authorities themselves. Whether the collection duty sits with the platform or the host varies per market and per city mandate, so the answer must be established jurisdiction by jurisdiction.

This is the layer where automation is most mature. Trippz maintains and automatically updates tourist tax rates across 70+ countries, monitors every relevant jurisdiction, and pushes rate changes automatically, so every calculation is based on verified, up to date local rules. Airbnb, Booking.com, and Expedia are Trippz clients.

Layer 2: guest registration

Guest registration is a host obligation, not a platform one. Many European countries require the host to register guest identity data with a national or regional authority. Italy requires submission to Alloggiati Web. Spain runs SES Hospedajes alongside regional police systems. Croatia, Slovenia, Portugal, and others run their own portals. Each system has its own data format, deadlines, and penalties, and none of them talk to each other.

Because the duty sits with the host, this layer is an opportunity rather than a requirement for the platform. A platform that organises registration for its supply base turns a recurring host headache into a reason to list with it, and strengthens the compliance health of the supply it depends on. It also sits next to the platform's own verification duty under 2024/1028, covered below.

Trippz provides direct connections to national and local governmental authorities for guest registration in nine European countries, including real time online ID verification of arriving guests, which a platform can surface to its hosts.

Layer 3: the EU Short-Term Rental Regulation 2024/1028

Regulation 2024/1028 is the anchor of the stack. It is confirmed and has applied across the EU since May 2026. For platforms, the headline duty is verification: platforms must check that hosts display a valid registration number where a registration scheme applies, and share listing and activity data with the authorities through the channels the regulation establishes.

The regulation ties layers 2 and 3 together. Host registration numbers come out of the same national registration schemes that guest registration systems serve, so a platform that has solved registration data flows is structurally better placed to meet its verification duties. Treat 2024/1028 as the frame your national and municipal obligations now sit inside, and expect member state enforcement practice to keep developing.

Layer 4: DAC7 seller income reporting

DAC7 obliges platform operators to report the income their sellers earn to EU tax authorities. It belongs in this map because your compliance team handles it alongside everything above, and because authorities increasingly cross reference the data. It is a reporting obligation on seller income, separate in nature from tourist tax and registration.

DAC7 sits outside what Trippz handles. It is a data sharing duty served by specialised reporting providers and internal tax teams. Include it in your stack review, and scope it separately from the tax and registration layers.

Who should own the stack

In most platforms the compliance team owns this problem, with the tax team taking the lead at larger companies. Engineering evaluates the tooling, legal approves, finance signs. The practical split that emerges from the map above: DAC7 stays with your tax and reporting function, while tourist tax is where the liability sits closest to the platform and the operational load is heaviest. Rate maintenance across every jurisdiction you sell in is a continuous obligation that carries real exposure when it slips. Guest registration is a host duty, but organising it is a lever the platform can choose to pull.

Vendor due diligence for the layers you decide to automate should cover data security and hosting. Trippz is SOC1 Type 2 and SOC2 Type 2 certified and GDPR compliant, with EU hosting available as a supporting detail for European buyers.

Where to start

Map your markets against the four layers: where do you collect tourist tax, which countries impose registration duties on your supply, where does 2024/1028 verification apply to you, and where does DAC7 reporting bite. The tourist tax gaps are the ones you can close fastest, and organised guest registration is the clearest way to turn compliance into a reason hosts choose your platform. To see how Trippz covers the tourist tax and guest registration layers, take a look at Trippz for Platforms. There is no commitment, and sandbox access follows within two business days once you create an account.