Short-term rental rules & taxes in Milan

In short: register for a CIN, report every guest to the police portal, collect and pay the city tourist tax, choose how the income will be taxed, and meet a short list of safety rules. Set it up once and most of it runs quietly in the background. Skip a step, and the penalties can be meaningful. Below is the full picture, section by section, in language that assumes no prior experience.

It helps to hold two ideas in mind from the start. First, there are national rules that apply everywhere in Italy (the CIN, guest reporting, the broad tax framework). Second, there are local layers on top (the tourist tax set by the Comune di Milano, and tourism and statistical rules set by the Lombardy region). Compliance means satisfying both at the same time. The good news is that the steps are finite and, once you have done them, they mostly repeat on a predictable rhythm.

1. The CIN, national registration

Italy now requires a CIN (Codice Identificativo Nazionale) for short-term and tourist rentals. It is a unique code issued through the Ministry of Tourism's national database, the Banca Dati delle Strutture Ricettive (BDSR), and it must be shown on every listing (Airbnb, Booking, your own website) and displayed at the property, typically visible near or at the entrance. The CIN unifies what used to be a patchwork of regional systems and, in Lombardy, has taken over from the older regional CIR code.

Obtaining it is a self-service process. You log in to the national portal with a digital identity (SPID or the CIE electronic ID card), enter the property's details including its cadastral data (the dati catastali that identify the unit in the land registry), confirm the safety declarations, and the system issues the code. It is free to request. Once you have it, the code stays with that property and should appear identically wherever the unit is advertised. Platforms increasingly check for a valid CIN before a listing can go live or stay online, so treating it as the very first task saves friction later. Operating without a CIN, or failing to publish it, now carries financial penalties, so it is genuinely the first box to tick rather than a formality to leave until last.

2. Reporting guests to the police

For every stay, you must submit your guests' identity-document details to the State Police through the Alloggiati Web portal, generally within 24 hours of check-in, and at arrival for stays shorter than 24 hours. This is a public-security obligation that predates the short-let boom and applies to all accommodation, from hotels to a single spare room. It is not optional and there is no small-host exemption.

To use the portal you first register with the local Questura (police headquarters) for that municipality, which issues your credentials. At each check-in you record every guest, including each person in a family or group, capturing the details from a passport or ID card. The purpose here is strictly security and identity, not tourism statistics or tax, which is why it is separate from the systems described below. Because you are handling identity documents, take data protection seriously: collect only what the portal requires, store it securely, and keep it no longer than the rules oblige.

3. Tourism statistics: Ross1000 and ISTAT

Separate from the police portal, Italy also collects statistical data on tourist flows, and this is a distinct obligation that many first-time hosts miss. In Lombardy the reporting is handled through the regional Ross1000 system, which feeds national tourism statistics gathered by ISTAT (the national statistics institute). Here you report arrivals, departures and the number of nights, along with basic guest information such as country of residence, rather than the identity details that go to the police.

The two systems answer different questions. Alloggiati Web asks who is staying here for security reasons; Ross1000 and ISTAT ask how many people are visiting and from where for planning and statistics. You will usually register for Ross1000 when you set up as an accommodation provider in the region, and then report on the required cadence (often monthly, with figures broken down by day). Confirm the exact registration route and frequency with the Comune di Milano or the region, since the practical steps can change.

4. The tourist tax

Milan charges an imposta di soggiorno, a tourist tax billed per guest, per night, which you collect from your guests and remit to the Comune di Milano. It applies up to a capped number of consecutive nights per stay, and it has exemptions, for example young children below a set age and certain other categories. The exact amount is set by the city and has been revised upward in recent years, so the single most important habit is to check the current rate and rules on the Comune di Milano's website rather than relying on a figure you saw once.

Mechanically, the flow is: you add the tax to what the guest pays, you set it aside, and you pay it over to the city on the schedule the comune sets (commonly a quarterly remittance with a periodic declaration of nights sold). In some cases a booking platform may collect and pass on the tax on your behalf, but the legal responsibility for correct collection and payment still sits with you, so keep your own tally. Because this is public money you are holding on the city's behalf, shortfalls are treated seriously, which is another reason to keep clean records from day one.

5. How the income is taxed

Short lets (rentals under 30 days) sit in a lighter regime than long tenancies. One immediate benefit: a contract for a stay under 30 days does not need to be registered with the Agenzia delle Entrate, which removes a layer of paperwork. On the income itself you generally have two routes.

The first is cedolare secca, an optional flat substitute tax that replaces ordinary income tax and certain related charges (such as registration tax and stamp duty) on the rental income:

• 21% is the standard flat rate on your first short-let property.
• Since the 2024 Budget Law, a 26% rate applies when you let more than one property short-term, though you may nominate one property to remain at 21%.

The second route is the ordinary IRPEF regime, where the rental income is added to your other income and taxed at Italy's progressive rates (which rise across income bands and can be higher than 21% for higher earners), plus regional and municipal surtaxes. Cedolare secca applies a single flat percentage to the rent and skips those surtaxes, which is why it is popular, but it is not automatically better in every case: your total income, your other deductions, and your personal circumstances all matter. This is a textbook question for a commercialista, who can model both routes on your actual numbers.

Where a booking platform collects the rent, it generally acts as a withholding agent (a sostituto d'imposta) and withholds a flat percentage at source. You then reconcile that withholding in your annual return, either settling under cedolare secca or, if you elected the ordinary regime, crediting it against what you owe. Keep every platform payout statement, because those figures have to line up with your declaration.

6. Tourist lease or casa vacanze? SCIA and the CAV distinction

There is a distinction that quietly decides which rulebook you fall under: whether you are running a simple tourist lease or an actual accommodation activity. A locazione turistica is a private rental with no hotel-style services, no reception, no daily cleaning while guests are in residence. Handing over keys, providing linen for the stay, and cleaning between guests keeps you on the lease side of the line.

A casa vacanze, often abbreviated CAV (casa e appartamenti per vacanze), is different: it is a non-hotel accommodation activity that offers services during the stay, and in Lombardy it is governed by the region's tourism law. Opening a CAV means filing a SCIA (Segnalazione Certificata di Inizio Attività), a certified notification of the start of activity submitted to the comune, and it usually brings a partita IVA (VAT number) and a business-style set of obligations with it. The practical trap is that adding hotel-like services to what began as a simple lease, for instance regular in-stay cleaning or a staffed reception, can reclassify you as a CAV without your intending it. If you want to offer more than a bare rental, decide the structure deliberately and take advice, because the SCIA route and the tax treatment change together.

7. When it becomes a business

Alongside the services test, there is a numbers test. As a general rule, if you let more than four apartments short-term in a year, the activity is presumed to be entrepreneurial (in forma imprenditoriale). That presumption changes everything downstream: you open a partita IVA, file a SCIA with the comune, typically move off cedolare secca into a business tax regime, and may pick up social-security registration and VAT considerations along the way. Up to four properties can usually be run as ordinary short leases eligible for cedolare secca. Where exactly you fall, and everything the threshold triggers, is worth confirming professionally before you scale beyond a handful of units, because crossing the line mid-year has consequences you would rather plan for than discover.

8. Safety requirements

The national framework attached to the CIN sets a safety baseline, and the self-declarations you make when applying for the code commit you to meeting it. In practice a compliant short-let should have working fire extinguishers in appropriate number and placement, and detectors for combustible gas and carbon monoxide, sensibly located near a boiler or a gas hob. Beyond those specific devices, the property should meet general building-safety standards: electrical and gas installations that are conformant (with the relevant dichiarazione di conformità where applicable) and in good order. None of this is expensive to fit, and inspectors expect it, so treat the safety kit as part of the cost of listing rather than an optional upgrade.

9. Your building's rules

Do not overlook the regolamento condominiale, your building's own set of rules. Some Milan condominiums restrict or prohibit short-term tourist letting, and where the prohibition is properly written into the building's binding regulation it applies to you regardless of the national rules that would otherwise let you host. This is a document to read carefully before you list, not after a neighbour complains. If the regulation is silent, or only advisory, the position can be more nuanced, and it is another point on which advice pays for itself. There is more on this in our guide to letting a company sublet your apartment.

10. Keeping records

Good record keeping is what turns all of the above from a source of anxiety into a routine. Keep, in one organised place: your CIN certificate and the details you submitted for it; confirmation receipts from Alloggiati Web for each stay; your Ross1000 or ISTAT statistical submissions; your tourist-tax declarations and proof of payment to the comune; guest data held securely and only for as long as required; every booking-platform payout statement; and your annual tax filings. Retain tax-relevant documents for the period Italian rules require, which for tax matters is typically several years, and confirm the exact retention window with your commercialista. When figures are asked for at return time, or if an authority ever queries a stay, a tidy paper trail resolves in minutes what a missing one can turn into a problem.

11. Penalties

It is worth being clear-eyed about what non-compliance risks, without treating any single figure as precise, because amounts are set by law and revised over time. Operating without a valid CIN, or failing to display the code on your listings and at the property, can attract financial penalties reported to run into the thousands of euros per breach. Failing to report guests through Alloggiati Web is a public-security matter and is treated more seriously than a simple administrative slip. Collecting the tourist tax and not remitting it means holding public money you were obliged to pass on, which authorities pursue firmly. The theme across all of these is that the obligations are cheap to meet and comparatively costly to ignore, so the sensible posture is to set the system up correctly once and then simply keep it running.

12. A step-by-step compliance timeline

Here is the whole thing sequenced, so the order is obvious:

• Before you list. Read your regolamento condominiale to confirm short lets are allowed, gather the property's cadastral data, and set up a digital identity (SPID or CIE) if you do not already have one.
• Step 1. Apply for your CIN through the national BDSR portal, then place the code on every listing and at the property.
• Step 2. Register with the local Questura for Alloggiati Web credentials so you can report guests from your first booking.
• Step 3. Register with the Comune di Milano for the tourist tax, and with the region for Ross1000 statistical reporting.
• Step 4. Fit the required safety devices and confirm your electrical and gas installations are in order.
• Step 5. Decide your tax treatment (cedolare secca versus ordinary IRPEF) with a commercialista, and confirm you are within the four-property, no-services limits for a simple lease.
• Step 6. Arrange insurance appropriate to short-term letting.
• Ongoing. Report each guest within 24 hours, remit the tourist tax on schedule, file your statistical returns, keep your records current, and settle the income in your annual tax return.

A simple starting checklist

• Confirm your regolamento condominiale allows short lets.
• Obtain your CIN and display it on listings and at the property.
• Register for Alloggiati Web guest reporting with the Questura.
• Register for Ross1000 / ISTAT statistical reporting in Lombardy.
• Set up tourist-tax collection and payment to the Comune di Milano.
• Decide your tax treatment (cedolare secca vs ordinary IRPEF) with a commercialista.
• Confirm whether you are a simple lease or a casa vacanze / CAV needing a SCIA.
• Fit the required safety devices.
• Sort insurance appropriate to short-term letting.
• Keep records of every registration, report, payment and filing.