# Who actually regulates a hotel or an airline
A family in Manchester books a package: flights on a UK airline, four nights at a Spanish beach hotel, and a transfer, all through one online travel agent. The airline cancels the outboundoutboundProactive outreach that pushes your message to targeted audiences through advertising, email, or direct prospecting, initiated by the seller rather than the buyer.View full definition → flight two days before departure. The family wants a refund, not vouchers. Who is legally on the hook, and which regulator can actually force payment?
The honest answer: it depends which piece of the trip broke, because travel and hospitality is regulated in slices, not as one industry.
Unlike banking, where one or two bodies dominate (the Federal Reserve and OCC in the US, the PRA and FCA in the UK), travel sits across multiple regimes stacked on top of each other. A single booking can touch:
No agency owns all five. That fragmentation is the first thing a finance professional entering this sector must internalize: due diligence means checking each layer separately.
Airlines need an Air Operator Certificate (AOC) plus an operating licence. In the US, the Federal Aviation Administration (FAA) issues safety certification, while the Department of Transportation (DOT) governs economic licensing and consumer rules. In the EU/UK, the European Union Aviation Safety Agency (EASA) and the UK Civil Aviation Authority (CAA) split similar roles.
Hotels have no equivalent single licence. They're regulated locally: fire safety, food hygiene, alcohol licensing, and building codes are issued by municipal or state authorities, not a national "hotel regulator." A hotel's financial risk profile is therefore harder to benchmark than an airline's; there's no central register comparable to an AOC.
Financial angle: lenders and investors doing due diligence on a hotel asset check local licence status directly with the municipality, not a national database. For airlines, the FAA registry (faa.gov) and CAA's public register both let you verify a live operating certificate before signing a codeshare or financing deal.
This is the layer that matters most in finance terms, because it's about counterparty risk on prepaid travel.
ATOL (Air Travel Organiser's Licence), run by the UK CAA, protects customers who buy flight-inclusive package holidays from UK-based sellers. If the tour operator collapses, ATOL's fund repatriates stranded travelers and refunds unused bookings. It's financed by a small per-passenger levy (around £2.50 per protected booking, CAA figure, subject to change) paid into the Air Travel Trust.
The Package Travel Regulations 2018 (UK, implementing the EU Package Travel Directive) require organizers of packages, flight-inclusive or not, to hold insolvency protection: bonding, insurance, or trust accounts. In the US there's no federal equivalent; protection is patchier, relying on state seller-of-travel laws (California, Washington, Florida, Hawaii have specific statutes) and card chargeback rights under the Fair Credit Billing Act.
This is why the Manchester family's outcome depends entirely on how the trip was sold. If it was booked as a package through a UK operator holding an ATOL certificate, ATOL protection applies and refunds are backstopped even if the seller fails. If they booked flights and hotel separately themselves, no package protection exists at all, and they're relying on the airline's own refund obligation under UK/EU Regulation 261/2004 (compensation and refund rights for flight disruption).
Worked example: a UK tour operator sells 10,000 flight-inclusive package holidays at an average £900 each, total exposure £9 million. At an ATOL levy of £2.50 per passenger across those 10,000 bookings, that's £25,000 into the Trust from this one operator's volume, a small fraction of the exposure it's meant to backstop system-wide (the Trust pools levies across the whole market, not per operator).
Even outside package rules, general consumer law applies. In the UK, the Consumer Rights Act 2015 and enforcement by the Competition and Markets Authority (CMA) cover misleading drip pricing (resort fees added late in a US-style booking flow, hidden charges) and unfair contract terms like non-refundable clauses that don't reflect genuine costs.
In the US, the Federal Trade Commission (FTC) polices deceptive pricing, and the DOT separately enforces airline-specific consumer rules (full-fare advertising, tarmac delay rules, automatic refund requirements introduced in 2024 for cancelled or significantly changed flights).
Hotels face resort fee scrutiny from the FTC directly. This has been an active enforcement area: several major hotel groups have faced state attorney general actions over undisclosed mandatory fees.
Resorts with casinos (Las Vegas Strip properties, Macau integrated resorts, UK licensed casinos attached to hotels) answer to gambling regulators, not travel ones. In the US, gaming is licensed state by state: the Nevada Gaming Control Board, the New Jersey Division of Gaming Enforcement. In the UK, the Gambling Commission licenses operators and enforces anti-money-laundering controls specific to gaming floors, separate from the hotel's own hospitality licensing.
For finance professionals, this matters because gaming revenue is often the dominant profit line in an "integrated resort" (think Marina Bay Sands or Wynn Macau), meaning the gaming regulator, not any hospitality body, is the one whose licence renewal risk actually moves the valuation.
Knowledge check
1. What is the central regulatory challenge illustrated by the Manchester family's cancelled package trip?
2. Why is banking regulation used as a contrast to travel regulation in this lesson?
3. A finance professional is conducting due diligence on a travel company that operates flights, owns hotels, and runs a resort casino. What does the lesson imply is the correct approach?
4. Select ALL correct answers about how airlines versus hotels are regulated for the right to operate.
Select all the correct answers.
5. Select ALL correct answers about the regulatory regimes that could apply to a single package travel booking.
Select all the correct answers.
One more slice: how the money itself moves. Online travel agents (OTAs) like Expedia or Booking.com act as payment intermediaries in many transactions, and depositing customer funds can trigger safeguarding requirements under payment services law (the UK's Payment Services Regulations 2017, implementing EU-derived standards) if they hold client money before passing it to the hotel or airline.
Card networks add another practical layer: Visa and Mastercard chargeback rules are often the fastest real-world remedy a consumer has, faster than waiting on a regulator, which is why travel companies watch chargeback ratios closely as a financial risk metric, not just a customer service one.
For anyone assessing a travel or hospitality counterparty (as an investor, lender, partner, or corporate travel buyer), the finance-relevant checks are:
1. Verify licence status directly: ATOL number on the CAA register, AOC on the FAA/EASA registry, state gaming licence status.
2. Check insolvency protection structure: is customer money held in trust, bonded, or insured? Under-protection is a red flag for balance sheet fragility.
3. Review chargeback and refund exposure: high chargeback ratios often precede visible distress before financial statements catch up.
4. Confirm which consumer law regime applies: package vs. non-package bookings carry fundamentally different refund liabilities, and this changes provisioning and contingent liability estimates.
5. Separate gaming and hospitality risk where relevant: a casino-hotel's earnings quality depends on gaming licence renewal cycles as much as occupancy rates.
🎬 [VIDEO: "How ATOL Protection Actually Works" - youtube.com/results?search_query=how+atol+protection+works - search for CAA or consumer-finance explainer content walking through what triggers a payout when a UK tour operator collapses]
For a primary source on package protection scope, see the UK government's own guide: gov.uk Package Travel Regulations guidance.