In late January 2025, city workers and Roma Capitale police walked into the Monti district with bolt cutters and started removing keyboxes from railings, gates, drainpipes, and building façades. The city said it intended to take down around 200 a week. Within a few months, hundreds were gone.
Then, four months later, something that looked like the opposite happened. On 27 May 2025, the Regional Administrative Court of Lazio struck down the Interior Ministry directive that had effectively required in-person identification of every short-term rental guest.
Both of those things are true, and Roman operators have spent the time since trying to work out what they mean together. The answer is more specific and more useful than most of the panic suggested:
The keybox bolted to a wall on public property is finished in Rome. Self check-in is not.
The distinction is identity verification, and once you see that, the operational path forward is clear.
What is actually prohibited
Precision matters here, because a lot of the coverage collapsed several different rules into one.
Rome has not banned self check-in. What the Comune has done is enforce its urban decorum regulations against the physical devices themselves. The removal campaign targets keyboxes installed on public land and public property, on street furniture, railings, poles, gates, and on protected façades. Fines of around €400 per device have been applied, and in some cases directed at the building administrator rather than the individual host.
Areas covered by the Carta della Qualità and the UNESCO-listed historic centre draw the tightest enforcement, but resident complaints have pushed inspections outward into peripheral neighbourhoods with high tourist density.
The security question is separate. The November 2024 Interior Ministry circular argued that keyboxes made guest identification impossible, because nobody ever meets the guest. TAR Lazio disagreed with the blanket approach and struck the directive down. What survives is the underlying obligation: you have to identify your guests, and you have to report them to the authorities through Alloggiati Web within 24 hours of arrival. The court's position, in effect, was that this identification can happen digitally and remotely, provided it genuinely happens.
So the requirement is not "meet the guest at the door." It is "know who the guest is, verifiably, before they get in."
A mechanical keybox with a shared four-digit code cannot satisfy that. It has no idea who opened it.
Why this is a strategic opening, not a problem
Rome's short-term rental supply has grown fast. Estimates put the number of holiday flats, guesthouses, and B&Bs in the city at roughly 38,500, up from around 32,700 the year before, heavily concentrated in the centre. A large share of that supply has been running on cheap mechanical keyboxes and shared codes.
Those operators now face a choice, and many haven't made it yet. The ones who move to a verifiable, logged, properly sited access system get three things at once: they stop losing devices to removal crews, they can demonstrate identification, and they keep the round-the-clock arrival flexibility that Roman tourism actually runs on. Guests arrive at Termini at all hours. The city does not organise itself around a 3 p.m. check-in window.
There's a real operational risk in doing nothing, too. A removal crew doesn't check whether a guest is currently mid-stay. Losing the box during an occupied booking means a guest locked out, an emergency call-out, and often a refund.
Where a SmartBox can actually go in Rome
This is where Rome differs from every other city in this series. The constraint isn't distance or building height. It's what you are permitted to attach to a Roman building, and who owns the wall.
Not on the façade. External walls in the historic centre are frequently subject to heritage protection through the Soprintendenza or the Carta della Qualità. Drilling into them is not a grey area.
Not on public land or street furniture. This is exactly what's being removed.
Inside the portone. The entrance hall behind the main door is private condominium property. A wall-mounted unit inside the entrance, past the street door, sits outside the public-land prohibition entirely. This is the most common solution for centre properties and it requires condominium approval.
In the courtyard. Many Roman buildings have an internal cortile with sheltered wall space and existing power. Weather resistance is rated IP52, which suits a covered courtyard position.
In a leased ground-floor space. Operators managing a cluster of flats in Trastevere, Monti, or around Termini sometimes take a small commercial space and install there, which removes the condominium question completely.
At a partner business. The model Keycafe originally built in Rome with businesses near Termini still works for operators who don't want hardware of their own, though it means depending on someone else's opening hours and location.
The condominio conversation
Installing inside a shared entrance means going to the condominium, and Roman condominium assemblies have not been friendly to short-term rentals lately. Several building administrators have been fined for keyboxes on their walls, which has hardened attitudes.
The argument that works is that you are proposing to solve the problem they're angry about. You're removing devices from the street front, moving key handling inside and out of sight, ending the situation where unidentified people arrive at the building with a code found in an email, and creating a record of who entered and when. Administrators exposed to fines for devices on the exterior have a direct interest in a compliant alternative existing.
Bring a written proposal with the exact position, dimensions, mounting method, power and network requirements, and an undertaking on maintenance and reinstatement. Check your building regulation for existing restrictions on alterations to common parts.
Identity verification and the documentation chain
Rome's compliance picture is a chain, and access control sits in the middle of it.
The CIN. Every short-term rental in Italy needs a Codice Identificativo Nazionale, issued through the Ministry of Tourism's BDSR database, displayed in every listing and at the property. Non-compliance carries fines that reach into the thousands of euros and removal from booking platforms.
Guest identification. You must establish who is staying, and following the TAR Lazio ruling this can be done digitally and remotely.
Alloggiati Web. Guest details go to the police within 24 hours of check-in.
Tourist tax. Rome's contributo di soggiorno is collected per person per night and remitted to the Comune.
Keycafe's role sits at the access point. Identity verification features, including photo ID verification, tie the person collecting the key to a verified identity rather than to a code that could have been forwarded to anyone. The MS5 unit carries a camera and records the interaction. Each collection and return is written to an exportable log against the individual who performed it, with the time it happened.
To be direct about the limits: this is not a substitute for CIN registration, Alloggiati Web submission, or tax remittance, and no access system performs those obligations for you. What it does is close the specific gap the Interior Ministry raised, which is that nobody could say who actually collected the key. It also produces documentation you can hand over if anyone asks.
Running a Roman portfolio around the constraint
The practical model most centre operators are landing on looks like this:
One access point per building where the condominium allows it, or one shared point serving a walkable cluster where it doesn't. Rome's centre is dense and walkable, so a single well-placed unit near Termini, in Monti, or across Trastevere can realistically serve a set of flats without asking guests to cross the city.
Capacity grows with the cluster rather than requiring a new install each time you take on a flat. A base unit starts at 9 key bins, and expansion modules daisy-chain on, so an operator with six flats in Trastevere today and fourteen in two years adds bins rather than boxes.
Access codes generate automatically through integrations with Airbnb, Guesty, Hostaway, and Res:harmonics, or through the API for Italian PMS platforms, and guest instructions can be delivered in multiple languages, which in a city with Rome's visitor mix is not a minor detail.
Cleaners, maintenance staff, and the building's own portiere each get their own permissions and their own windows. In a market where cleaning teams often serve several operators across the same few streets, individual credentials rather than a shared code are the difference between an audit trail and a guess.
Working with the city rather than against it
Rome spent 2025 removing several hundred small metal boxes from its walls, and the message was not subtle. The city objects to unregulated devices on public surfaces and to guests entering buildings without anyone knowing who they are.
Neither of those objections is an argument against automated key exchange. They are arguments against a specific cheap implementation of it. Move the hardware inside, tie every access to a verified person, and keep a record, and you have something that satisfies the city's concerns while keeping the arrival flexibility your guests booked for.
Configure a SmartBox deployment or speak with our team about siting an install in a Roman building.
Regulatory details in this article reflect publicly available information at the time of writing and are provided for general guidance only. Italian national rules and Roma Capitale ordinances on short-term rentals, guest identification, and key storage devices have changed repeatedly and remain subject to appeal. Confirm current requirements with Roma Capitale, the Ministry of Tourism, and qualified Italian counsel before making operational decisions.
