Hotel Front Office SOP Template

Hotel front desk procedure: roles, check-in flow, room keys, card payments kept out of the desk (PCI DSS v4.0.1), guest data, check-out, night audit, incidents, checks

酒店与餐饮标准PCI DSS v4.0.1front office sop更新于 2026年10月29日

在编辑器中打开下载 .md

使用方法: Use it to write down how a hotel front desk checks guests in and out and handles money and data. Fill roles and local legal registration rules first, then payment steps with your acquirer. The main pitfall is staff copying card numbers onto paper or email to help a guest.

预览

Front Office Standard Operating Procedure: [Property name]

The standard operating procedure (SOP) for a hotel front office: check-in, room keys, payments and deposits, guest data and privacy, check-out, night audit and incident handling. Payment steps are written to keep card data out of the front office as far as possible, in line with PCI DSS v4.0.1 (PCI Security Standards Council, June 2024). Based on common hotel front office practice. Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice: check the current official rules where you operate and a qualified professional.

Document control

Field	Value
Document ID	[HOS-FO-SOP-001]
Version	[1.0]
Property	[Example: Corvelle Quay Hotel (fictional), 180 rooms]
Systems	[PMS name, payment terminals, key encoder]
Owner	[@front-office-manager]
Approved by	[@general-manager]
Effective from	YYYY-MM-DD
Next review	YYYY-MM-DD

Revision history

Version	Date	Author	Change
1.0 (Example)	2026-10-30	Front office manager	First issue

1. Scope and roles

Role	May	May not
Front desk agent	Check in and out, take payment on terminal, issue keys to verified guests	Override rates beyond [10]%, refund above [100.00], disclose room numbers
Supervisor	Approve overrides and refunds up to [500.00], re-issue keys after ID check	Change night audit figures
Duty manager	Approve exceptions, handle incidents and complaints	Waive policy without recording why
Night auditor	Run night audit, post room and tax charges	Edit closed folios without approval

2. Check-in

Greet the guest and find the reservation by name and arrival date.
Look at a photo ID and confirm the name matches the booking. For bookings made by a third party, follow the third-party authorisation on the reservation.
Complete registration fields required by local law [list them]. Do not scan or copy IDs unless the law requires it; if it does, store the copy in the PMS, not on desktops or email.
Take the payment guarantee on the terminal (section 4).
Assign the room, encode [2] keys and write the room number on the key wallet. Never say the room number aloud where others can hear.
Note special requests, accessibility needs and allergies (passed to food and beverage with the guest's agreement).

3. Room keys

Re-issue a key only after the guest shows ID or answers [two] verification questions recorded at check-in, and only for a guest registered to that room.
Calls asking for a room number or for a guest's presence: do not confirm. Offer to connect the call or take a message.
Lost key reports: cancel the old key in the encoder and record it.

4. Payments and deposits

Card present: the guest inserts or taps the card on the terminal. Staff do not handle or key in card numbers.
Card not present (phone, email): send the guest a secure payment link from the payment provider. Do not accept card numbers by email, chat or note; if a guest sends one, do not reply with it, delete it as section 7 describes and ask the guest to use the link.
Pre-authorisation: [Example: room and tax for the stay plus 50.00 per night for incidentals]. Tell the guest the amount held and when it is released.
Displays and printouts show the card number masked (Example: last four digits only).
Cash: count in front of the guest, issue a receipt, keep the float at [amount], drop excess in the safe with a second signature.
Refunds go back to the original payment method.

5. Guest data and privacy

Collect only the data needed for the stay, the law and the guest's requests.
Guest requests to see, correct or delete their data go to [@privacy contact] within [1] working day; do not handle them at the desk.
Registration records are kept for [period required by law] and then deleted by [process].
Lists of guests are never given to callers, visitors or other guests. Police requests go to the duty manager, who records the legal basis and what was disclosed.

6. Check-out and night audit

Check-out:

Confirm minibar, restaurant and other charges; ask about the stay.
Print or email the folio (email only to the address on the reservation).
Settle on the terminal, release unused pre-authorisation, collect keys.
Late check-out: approve per policy and record the fee.

Night audit:

Post room and tax charges for every in-house room.
Check no-shows against the guarantee policy and post charges.
Balance payments in the PMS against terminal and cash totals; record and report any difference over [5.00].
Run the end-of-day report and back-up as the PMS requires.

7. Incidents and escalation

Situation	First action	Record
Medical emergency	Call emergency services [number], then duty manager	`hospitality/guest-incident-report`
Theft or lost property claim	Duty manager, security; police if the guest asks	Guest incident report
Card data received in readable form	Do not copy it; delete it as IT instructs; tell the duty manager	Security incident log
Unwelcome visitor asking for a guest	Do not confirm; call security	Shift log
Complaint that staff cannot resolve	Duty manager within [15] minutes	Complaint log

8. Training and checks

Check	Frequency	Owner
New agent trained on this SOP and signed	Induction	Front office manager
Key re-issue test call	Monthly	Supervisor
Desk check: no card data on paper, screens locked	Weekly	Duty manager
Payment terminal inspected for tampering	[Daily]	Opening agent

Standard and licence note

Based on common hotel front office practice. Payment steps follow the data protection aims of PCI DSS v4.0.1 (PCI Security Standards Council, June 2024), cited by name and requirement number only (official text: PCI Security Standards Council, free with licence agreement: https://www.pcisecuritystandards.org/document_library/). Privacy laws are named as examples only. All text and the fictional property are original. Check the current official versions before use. Template licence: MIT.