In part one of our travel payment compliance series, we looked at payment security at the transaction level, including PCI DSS, PSD2 and PSD3. Now, we're covering the other half of travel payment compliance: navigating anti-money laundering (AML) regulations and finding the right merchant account provider.
Key Takeaways
- In travel, many payment compliance requirements ultimately fall on your merchant account provider, making choosing the right one business-critical.
- Your provider runs the AML checks (KYC, CDD and EDD) on the businesses it works with (including yours), both during the onboarding process and over time.
- You have AML responsibilities, too, including sharing information during onboarding and following sanctions law.
- A travel-specific merchant account provider manages regulatory compliance, fraud, chargebacks and insolvency protection to keep your business on the right side of the law.
What Travel Businesses Need to Know About Anti-Money Laundering (AML) Regulations
Anti-money laundering rules exist to stop criminal money from moving through legitimate businesses, following international standards set by the Financial Action Task Force (FATF). The travel industry is exposed to money laundering for several reasons:
Anti-money laundering rules are tightening. In the EU, for example, a new anti-money laundering package is replacing the older, country-by-country rules with a single set of requirements that apply consistently across the Member States. The new Anti-Money Laundering Regulation (AMLR) isn't in effect just yet, but it'll apply from the 10th July 2027.
- Bookings are high-value and cross-border.
- Funds are taken months in advance with several third-party suppliers in between the customer and the service, making funds harder to trace.
- The high volume of transactions makes it hard to spot ones that aren’t legitimate.
- Most sales come through digital channels.
What are the New Anti-Money Laundering Rules for Obliged Entities?
As obliged entities, payment providers will be legally obliged to follow the EU's new anti-money laundering rules when they come into effect:
- Customer due diligence will apply from a lower level: it'll be triggered on transactions of €10,000 or more, and on smaller amounts where the risk is deemed as high.
- Obliged entities need to keep customer information current by refreshing it at least every five years, and every year for higher risk customers.
- When obliged entities look into who owns a business they're dealing with, the beneficial ownership threshold has moved from above 25% to 25% or more, which brings a few more part-owners into scope.
- The penalties for non-compliance have increased to as much as €10 million or 10% of annual turnover.
How AML Checks Work for Travel Businesses
As the regulated party, the merchant account provider you choose runs a series of checks on the businesses it works with to confirm their funds are legitimate and not tied to crime.
Know Your Customer (KYC)
Know Your Customer (KYC) is the process of confirming that a business is who it claims to be. When you sign up with a payment provider, it verifies your company's registered details against a public register (in the UK, Companies House) and identifies the people who own or control it. This is why, during onboarding, you'll be asked for your incorporation details and identity documents for directors and owners.
Customer Due Diligence (CDD)
Customer Due Diligence (CDD) is how a provider judges the level of risk a business brings. It involves understanding the nature of your business and the payments it expects to handle, screening against sanctions and watchlists.
A travel firm's profile, with high-value, cross-border and advance payments, might mean travel businesses are scrutinised more closely than a standard retailer, for example. However, the level of scrutiny required is assessed on a business-by-business basis.
Enhanced Due Diligence (EDD)
Enhanced Due Diligence (EDD) is a deeper investigation reserved for the highest-risk situations, including:
- Dealing with a politically exposed person (PEP)
- A customer or partner based in a high-risk jurisdiction with weak anti-money laundering controls
- Entities with complex ownership structures (e.g., multi-layered corporate or trust arrangements) that hide the Ultimate Beneficial Owner (UBO)
- High-value, complex or atypical transactions lacking an obvious economic or lawful purpose
- Discovering the customer provided false or stolen identification documents
In those cases, the provider looks beyond confirming identity to establish where money comes from by asking for evidence such as bank statements.
What's expected of you
Because most travel businesses aren't regulated for AML in their own right, what's expected of you is narrower than the full set of checks your payment provider runs. However, you will need to follow sanctions laws. You can't take a booking from, or make a payment to, a person or a company on a sanctions list. You will also need to make sure the onboarding process is accurate by providing correct information, and update your payment provider if your details change.
Why Payment Compliance Comes Down to Choosing the Right Travel Payment Provider
As a travel business, the rules around card data, payment authentication and money laundering checks fall mainly on the regulated business that processes your payments, not on you. However, that makes choosing the right travel merchant account provider a really important decision. And we specifically say ‘travel’ here, because standard merchant accounts won't cut it.
Standard processors weren't built for the way travel works. Payments are taken months before the trip happens, booking values are typically high and revenue rises and falls with the seasons. Generic merchant accounts built for retailers view those situations as warning signs. A busy week, a flurry of high-value bookings or sudden burst of international sales might be enough for a hold to be placed on your funds or even a dreaded account freeze.
A merchant account provider built for travel works differently, because it expects those payment patterns instead of flagging them as suspicious. It holds the acquiring relationships and takes on the checks the card networks and regulators expect, so your payments run through a setup that already meets those requirements without you having to build it yourself.
What a Travel-Specific Merchant Account Provider Helps You Manage
Staying compliant means choosing the right provider to process your payments. A payment solution built for travel is designed around how trips are sold, fulfilled and paid for, so it can manage the security, fraud and financial risks that come with them:
Regulatory Compliance
Payment compliance involves keeping card data secure and checking payments are genuine, and a travel-specific merchant account provider does just that. With Repayd, for example, card data is protected in PCI DSS Level 1 compliant systems and stored safely using tokenization.
Payments are verified with Strong Customer Authentication through 3D Secure 2, applied according to the risk of each transaction. This means genuine bookings are accepted without sending the customer through unnecessary authentication hurdles that might cost you a booking.
As the rules around payment security and compliance continue to change, a reliable travel merchant account provider keeps your setup in line with regulations at all times, so the arrival of new rules (like PSD3 in the future) won't cause any problems.
Fraud Prevention
Travel is one of the most heavily targeted sectors for payment fraud. The problem with standard fraud tools is that a perfectly normal travel booking, particularly a high-value, last-minute booking from abroad, is flagged as suspicious.
Travel-specific fraud detection and prevention tools screen payments against how travel is actually booked and paid for, with 3D Secure 2, rule-based filters and machine learning accepting real bookings and stopping fraudulent ones.
Chargeback Management
In travel, chargebacks are both more frequent and more expensive than in most sectors. Trips are booked long before they happen, experiences are subjective, and bookings often pass through several suppliers, so customers have more reasons to challenge a charge than they would with a retailer.
Each chargeback a travel provider receives has a high cost: the average travel chargeback costs $120. Once you add the associated fees, staff time spent fighting the chargeback and the mark it leaves against your merchant account, a single dispute costs well beyond the sale it reverses.
A travel-specific merchant account provider helps you keep chargebacks down by using real-time monitoring, pattern analysis and automated representment to help you win more disputes.
Insolvency Protection
Your customers pay well before they travel, so their money often sits with you weeks, often months. A travel-specific merchant account provider can offer integrated insolvency protection, where funds are kept in separate accounts away from the provider's working capital. If an operator experiences financial difficulties, the money is there for refunds, alternative arrangements or repatriation.
The right merchant account provider carries most of the compliance load for you, from PCI DSS and PSD2 compliance to AML checks. Talk to the Repayd team today to find out how we can keep your payments compliant.
