Sanctions regime

Penalties for non-compliance with Spain's guest registry

The penalties for failing to comply with Spain's guest-registration regime do not come from Royal Decree 933/2021 directly. They come from Organic Law 4/2015 on the Protection of Citizen Security, the same statute that gives the Spanish government the constitutional authority to impose identification duties on hosts. RD 933/2021 sets out the substantive duty; LO 4/2015 supplies the sanctioning apparatus. For an owner, the practical result is a tariff that starts at €100 for the lightest breach and runs to €30,000 at the serious end — with collateral effects on licences, platforms, insurance and community of owners that often matter more than the fine itself.

Two tiers in play

LO 4/2015 defines three sanction tiers — minor, serious and very serious — but the third is reserved for conduct against national security and is not, in practice, applied to administrative breaches of the lodging regime. For the guest-registry context, only the first two tiers are operative.

Minor infractions: €100 to €600

The minor tier captures the host who is trying to comply but doing it imperfectly: late, partially, with errors. Typical examples:

• Late submission — data transmitted after the 24-hour window.
• Incomplete submission — one or more Annex I fields missing where the host could reasonably have captured them (the document support number, the exact arrival time, the second surname for Spanish documents).
• Data errors — typos in the document number, wrong date format, miscoded nationality, wrong sex.
• Negligent false data — discrepancies between the transmitted record and reality through carelessness rather than intent.
• Missing signature when the rest of the record is otherwise correctly transmitted.

From observation of files opened during 2025, isolated first-time minor infractions tend to attract fines near the lower end of the tier — €100 to €200 — coupled with an order to regularise. The amount climbs with recurrence and with non-response to administrative correspondence. For a foreign owner, non-response is a particular risk: notifications go to the registered address in Spain (or the representative's address), and an owner abroad who has not configured forwarding can find that the time-limited window to file objections has elapsed before they know the file exists.

Serious infractions: €601 to €30,000

The serious tier is for non-compliance rather than imperfect compliance:

• Operating without being registered as a provider in SES.Hospedajes (or Mossos / Ertzaintza). Running a property visibly on Airbnb or Booking without a corresponding registration is the fastest route to a serious-tier file.
• Total failure to communicate the data for a stay — nothing transmitted at all.
• Persistent minor breaches after a regularisation order. Recurrence escalates the classification.
• Deliberately false data. Intent moves the conduct up a tier automatically.
• Failure to retain records as a professional host, where the three-year archive is missing or manifestly inadequate.
• Intermediary platforms that do not report bookings or cancellations within the required window.

Within the serious tier the specific amount reflects criteria set by LO 4/2015: operator size, repetition, cooperation with the inspection, voluntary regularisation, intent, and the actual impact on the security purpose. A single-property owner who has gone two years without ever registering will not be sanctioned at the top of the tier; a multi-property professional with a pattern of evasion can be. The point is that the band is wide and the amount is discretionary.

How a sanction file unfolds

The procedure follows Spain's general administrative-procedure rules (Law 39/2015):

1. The Sub-delegation of the Government in the province where the property is located receives a triggering input: a cross-check against platform data, a third-party complaint, a programmed inspection, or a referral from the security forces.
2. A sanctioning file is opened by formal decision, notified to the alleged offender with a statement of facts and provisional classification.
3. The party has 15 working days to file objections and evidence.
4. A proposed resolution is issued; another 15 days to respond.
5. The final resolution is issued, ending the administrative phase. It is immediately enforceable.
6. The party can file a discretionary appeal (recurso de alzada) to the higher body, and after exhausting the administrative route, a contentious-administrative appeal before the courts.

In Catalonia the procedure is run by the Generalitat; in the Basque Country by the Department of Security of the Basque Government; elsewhere by the Sub-delegation of the Government in the province. Minor infractions prescribe in six months; serious ones in one year. The clock starts from the date the breach was committed, which is relevant for ongoing breaches: a missed communication starts prescribing immediately; a defectively maintained archive can be classified as a continuing breach that does not prescribe while the conduct persists.

Particular exposure for non-resident owners

Foreign owners are not less exposed than Spanish owners, and in three respects they may be more so.

Cross-checks with platforms

Since early 2025 the Ministerio del Interior has been systematically cross-referencing listings on Airbnb, Booking, Vrbo, Expedia and HomeAway against the SES register. A property that is visible to renters but absent from SES is a strong signal. Foreign-owned properties are over-represented on those platforms relative to their share of total Spanish accommodation, simply because foreign owners tend to use international platforms, so the cross-check tends to surface them more often than the average Spanish-owned property.

Service of notifications

Spanish administrative notifications are valid when sent to the address on file, even if the recipient does not actually read them. A non-resident owner who has not appointed a representative with a Spanish notification address can be notified at the property address, where there is nobody to receive the letter, and the procedural deadlines start running anyway. By the time the owner becomes aware of the file, the window for objections has closed and the resolution becomes harder to challenge.

Cumulative inspections

Once a file is opened on guest-registration grounds, the file becomes evidence available to other authorities looking at the same property: the autonomous community's tourism register, the regional tax office (for tourist tax), the central tax agency (for income tax under the IRNR regime), and so on. A coordinated set of inspections triggered by a single guest-registry sanction is not rare; for a non-resident owner who is not on the ground, the cumulative effect is much more disruptive than the headline fine.

Knock-on consequences beyond the fine

Tourism licence at risk

Each autonomous community keeps its own register of tourist accommodation. A confirmed sanction for a guest-registry serious infraction is admissible evidence for the regional tourism authority to open its own inspection. In serious cases the regional register can suspend or cancel the property's tourist licence; without a valid licence the property cannot legally be advertised. Loss of the licence is, for most foreign owners, the most economically damaging consequence — and one that takes months to undo.

Platform delisting

Airbnb, Booking and other platforms now include licence-compliance terms that allow them to require evidence of compliance with local regulation. A confirmed sanction can be used by the platform as grounds to require evidence, restrict the listing or remove it entirely. Even if the platform is not the sanctioning authority, its commercial decision can have immediate economic consequences while the administrative procedure is still running.

Community of owners pressure

The Spanish Horizontal Property Law allows communities of owners to introduce restrictions on tourist use by reinforced majority. A confirmed administrative sanction is documentary evidence that the community can use in a civil procedure to push for restrictions on the offending owner. For foreign owners in coastal blocks where tourist use is already controversial, the sanction is a card that the neighbours will play.

Insurance complications

Specialist short-term-rental insurance policies often exclude cover for activity carried on in breach of mandatory rules. A confirmed sanction can be used by the insurer to deny a claim arising from a stay that was not properly reported. The amount at stake here can run well beyond the fine, depending on what happened during the stay.

What triggers a file in practice

Empirically, files opened during 2025 cluster around a small number of triggers:

• Platform-vs-register cross-checks showing a listing without a corresponding SES registration.
• Volume discrepancies — when Airbnb reports 30 reservations in a quarter and the host has filed 5 partes, the gap is visible to the platform-data-vs-host-data reconciliation.
• Neighbour or community complaints about noise, traffic or behaviour, which routinely include a compliance check on the property's regulatory situation.
• Tourist-tax cross-checks in Catalonia, the Balearics and the Valencian Community, where stays declared to the regional tax agency do not match stays reported to the security authority.
• Sector-wide inspections in cities under tourist pressure: Barcelona, Madrid, Málaga, Palma, Seville, Valencia, Bilbao, San Sebastián.

The choice is not between complying and not complying: it is between complying well and complying badly. Imperfect compliance is a minor fine and a regularisation order. Non-compliance, in any of its forms, is a serious file with consequences that outlast the fine.

If you are behind — how to regularise

For an owner who has not been complying — never registered, or registered but never submits, or submits late — voluntary regularisation is consistently the better strategy than waiting for inspection. The Spanish administration treats proactive regularisation as an attenuating factor and frequently closes files without proceeding to sanction. The steps:

1. Register the property as a provider in SES (or the relevant regional system) if you have not.
2. Reconstruct the recent archive from your booking records and what guest data you still have.
3. Put in place an operational process — manual or, more realistically, automated — that ensures future compliance is systematic.

Regularisation does not extinguish breaches already committed; it does not delete the past. But it operates as a strong attenuating factor in the classification, and in many cases avoids the opening of a file altogether. The authority observably treats the engaged operator more favourably than the passive one.