Travel & Hospitality Compliance in the United Kingdom

The UK market is open to online travel and hospitality businesses, and no general travel licence exists. Identity duties arise at three checkpoints: the carrier's pre-boarding check of permission to travel, the accommodation keeper's guest record, and customer due diligence for currency exchange. Package organisers selling flights need an Air Travel Organiser's Licence (ATOL) from the Civil Aviation Authority.

The Home Office (through UK Visas and Immigration and Border Force) sets the border and accommodation rules, HMRC supervises currency exchange for AML purposes, and the Information Commissioner's Office (ICO) regulates the personal and biometric data these checks generate.

The biggest practical obstacle for a new carrier or booking platform is the digital permission-to-travel check: a passenger without an ETA or eVisa linked to the passport they travel on now costs the carrier money, not just a refusal at the border.

1. Who regulates this sector

Immigration, carrier and accommodation-record rules apply across the whole of the UK, as do the AML regime and data protection law. The ETA also covers travel to Jersey, Guernsey and the Isle of Man.

Police constables also inspect guest records under the hotel records order.

2. Licensing and authorisation

There is no UK-wide licence to operate a hotel, booking platform or travel agency as such. Authorisation attaches to specific activities.

Selling flights and packages

Under the Civil Aviation (Air Travel Organisers' Licensing) Regulations 2012, only the aircraft operator, an ATOL holder or an exempt person may advertise and sell flight-inclusive packages or flight-only arrangements to UK consumers. The rules apply to businesses established outside the UK that sell to UK consumers, whatever the departure point. Exemptions include agents of ATOL holders, members of accredited bodies and airline ticket agents.

Currency exchange

A business that acts as a bureau de change must register with HMRC before trading. Registration includes a fit and proper test of the business and its beneficial owners, officers and managers, and an applicant registering after 10 January 2020 must not trade until HMRC confirms registration.

Carriers

Carriers of passengers to and from the UK must supply travel document information to Border Force and, where the Authority to Carry Scheme 2023 applies, seek authority to carry passengers and crew. The scheme came into force on 3 April 2023 and is backed by civil penalties.

Operating without the relevant permission has different consequences in each case: the CAA treats unlicensed sales as a breach of the ATOL Regulations, while trading as an unregistered money service business is a breach of the Money Laundering Regulations that HMRC penalises and publishes.

3. AML, KYC and customer due diligence

Hotels, airlines, travel agents and booking platforms are not, by virtue of that activity, relevant persons under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the Money Laundering Regulations, or MLRs). The regime reaches the sector through currency exchange, which is a money service business activity.

The guests-only exclusion

Regulation 15 excludes a business whose currency exchange is occasional or very limited, but only if all of these conditions are met: annual turnover from the activity of no more than £100,000; no more than 5% of total turnover; no more than one transaction over £1,000 per customer, counting linked transactions; the activity is ancillary and directly related to the main business; and it is offered only to customers of the main business, not the public. HMRC's guidance uses a hotel exchanging currency only for its guests as the example. Since 30 June 2026 the per-customer limit is expressed as £1,000 rather than 1,000 euros (SI 2026/621, reg. 10).

Customer due diligence for registered bureaux

A registered bureau must apply customer due diligence (CDD) when it establishes a business relationship, carries out an occasional currency exchange of £12,000 or more in one operation or linked operations, suspects money laundering or terrorist financing, or doubts information it already holds (regulation 27(2), threshold converted from 15,000 euros on 30 June 2026). For an individual, HMRC expects full name, date of birth and residential address, verified by identity documents or electronic verification; without verified identity, the transaction or relationship must not go ahead.

Enhanced due diligence

HMRC's money service business guidance lists enhanced due diligence triggers including politically exposed persons and their family members, customers established in a country on the Financial Action Task Force (FATF) Call for Action list (the narrower test that replaced "high-risk third country" on 30 June 2026), false or stolen identity documents, and transactions that are unusually complex or unusually large given their nature.

Bureaux must also screen customers against the UK sanctions list kept by the Office of Financial Sanctions Implementation, freeze funds of designated persons and report to it, and submit suspicious activity reports where they know or suspect money laundering.

4. Identity verification and onboarding

Carriers: permission to travel and the rightful holder

Border Force's guide for carriers (September 2026) expects a carrier to make sure every passenger has a valid passport or travel document acceptable in the UK, is its rightful holder, and holds any required visa or ETA. A Home Office "0A" board message is satisfactory evidence of a digital permission; a "check" message requires inspection of a physical permission such as a visa vignette, an EU Settlement Scheme biometric card or a Frontier Worker Permit. Expired biometric residence permits issued under the EEA regulations and expired EU Settlement Scheme cards have not been usable for travel since 2 June 2025.

The legal standard for false documents and impersonation is whether the problem was "reasonably apparent" to a trained check-in agent examining the document carefully but briefly, without technological aids. Carriers remain responsible for deciding whether to carry, and a contemporaneous record of document details and the checks made helps in any dispute.

Accommodation: the guest record

The Immigration (Hotel Records) Order 1972 applies to any hotel or other premises, furnished or unfurnished, where sleeping accommodation is provided for reward. Every guest aged 16 or over must give the keeper their full name and nationality on arrival. Foreign nationals ("aliens" in the Order's wording) must also give the number and place of issue of their passport or other document establishing identity and nationality, and their next destination on or before departure. The keeper must require compliance and keep a written record for at least 12 months, open to inspection by any constable or person authorised by the Home Secretary. The Order does not require the keeper to copy or electronically verify the document.

Currency exchange: documents and electronic checks

HMRC accepts a valid passport, photocard driving licence or national identity card, and expects the same document types for non-UK residents, with certified translations where staff cannot read the document. Digital verification services certified against the UK DVS trust framework and listed on the government's DVS register are treated as a reliable, independent source with anti-impersonation assurance; an unregistered provider cannot reliably be deemed suitable. A single-source electronic check is not normally enough on its own.

5. Digital channels: what's different

Bottom line: the travel authorisation itself is now digital-only, and the carrier's check is automated against Home Office records; the accommodation and currency exchange rules are channel-neutral, but remote verification is only treated as reliable when it uses a registered digital verification service.

A digital-only permission with no grace period

The ETA costs £20, is applied for through the UK ETA app or GOV.UK, and requires a passport and a photo of the applicant's face. It is linked to the passport used to apply, so a traveller who renews their passport needs a new ETA. Decisions usually arrive within a day but can take up to three working days. Passengers transiting landside through UK border control also need one. GOV.UK warns that other websites may charge more and imitate government services.

Remote check-in and the guest record

The hotel records order is drafted for arrival at the premises, but it lets information be given by or to any person acting on someone's behalf. Collecting the required data at online booking or pre-arrival is therefore compatible with the Order, provided the keeper ends up with a written record of each guest's arrival date and details.

Remote identity checks for currency exchange

For online currency orders, HMRC describes a customer uploading identity documents and a selfie holding the document as providing a level of assurance, but the business remains liable for its CDD. Version 1.0 of the DVS trust framework, published on 9 June 2026, was due to take effect on 1 September 2026 subject to accreditation of certification bodies.

6. Data protection and biometrics

Guest, passenger and customer identity data is personal data under the UK GDPR and the Data Protection Act 2018, regulated by the ICO across the UK. The angle that matters for this sector is biometrics.

The ICO's guidance on biometric recognition treats biometric data used to identify someone uniquely as special category data. A business using facial recognition for contactless check-in, lounge access or boarding must identify both a lawful basis and a separate Article 9 condition. Explicit consent is likely to be the most appropriate condition, which means a clear statement of agreement and a suitable alternative for people who refuse. The ICO's example of a business replacing swipe cards with facial recognition concludes that explicit consent was the only available condition and that a PIN alternative was needed. Where consent is not appropriate, the prevention or detection of unlawful acts condition requires an appropriate policy document and proof that biometric data is necessary and proportionate.

The ICO states that this guidance is under review following the Data (Use and Access) Act 2025. On retention, the hotel records order sets a minimum of 12 months, not a maximum, and it does not require passport images; storing scans goes beyond what the Order asks for and needs its own justification.

7. Sector-specific obligations

Carriers' liability for documents and ETAs

Section 40 of the Immigration and Asylum Act 1999, as substituted by section 76 of the Nationality and Borders Act 2022 (in force 20 March 2026 under SI 2026/165), lets the Home Secretary charge the owner of a ship or aircraft £2,000 for each person who arrives without a valid immigration document establishing identity and nationality, without a required entry clearance, or without a required ETA. For ETA cases, no charge is payable if the carrier reasonably believed, on Home Office information, that the passenger did not need one or held one, or had a reasonable excuse for being unable to establish it.

Passenger data and Authority to Carry

Carriers must supply travel document information, also called advance passenger information, to Border Force; the Home Office updated its online submission form on 28 July 2026. Carriers within the Authority to Carry Scheme 2023 must request authority for passengers and crew on inbound and outbound journeys, so that individuals can be stopped from travelling where that is necessary in the public interest.

Package travel

ATOL holders selling flight-inclusive packages, as defined in the Package Travel and Linked Travel Arrangements Regulations 2018, must provide the financial protection the scheme requires. The ATOL rules apply irrespective of where the flight departs.

8. Risk indicators and red flags

Travel, border and currency exchange indicators

• Impersonation: a genuine passport whose photo does not match the traveller presenting it.
• No-document arrivals: travellers who board with documents and dispose of them in flight; CCTV links them to a flight.
• Missing board message: no "0A" response for a passenger who claims a digital permission.
• Lookalike ETA sites: third-party websites charging more and imitating GOV.UK.
• Denomination swaps: small notes exchanged for large denominations of another currency.
• Structuring: linked exchanges kept just below £12,000, or repeated guest transactions over £1,000.
• False or stolen identity documents: a mandatory enhanced due diligence trigger and a reason to consider a suspicious activity report.
• Weak reconciliation: no daily cash and currency stock reconciliation at a bureau or hotel desk.

9. Enforcement and penalties

Section 40 charges are per passenger. Border Force serves a notification of potential liability; the carrier has 30 days for representations, 28 days to object after a demand, and may appeal to the county court (sheriff court in Scotland). In "No ETA" cases, liability is normally established from Home Office system checks rather than a physical document. Carriers with Approved Gate Check status at a port receive up to two technical charge waivers per quarter per route.

HMRC publishes AML penalties half-yearly. Its 2025 to 2026 list, updated on 10 September 2026, includes money service businesses penalised for failing to notify material changes and to provide registration information.

10. Recent changes and what to watch

• September 2026 [In force] Border Force reissued its charging guide for carriers, setting out how "No ETA" liability is established from Home Office systems.
• 1 September 2026 [Adopted, effective subject to accreditation] DVS trust framework version 1.0, published 9 June 2026, replaces earlier versions; firms relying on DVS providers should check their certification version.
• 1 July 2026 [In force] Carriers may accept a Form for Accompanying an eVisa linked to a valid eVisa as a physical permission document.
• 30 June 2026 [In force] MLR amendments (SI 2026/621) convert thresholds to sterling, including the £12,000 occasional transaction trigger and the £1,000 guests-only limit, and narrow mandatory enhanced due diligence to FATF Call for Action countries.
• April 2026 [In force] The ETA fee rose from £16 to £20.
• 20 March 2026 [In force] Carriers can be charged £2,000 per passenger who arrives without a required ETA.
• 25 February 2026 [In force] Full ETA enforcement: carriers must confirm digital permission for non-visa nationals before boarding.

Watch the ICO's revised biometric guidance following the Data (Use and Access) Act 2025, and the Home Office's stated aim of a contactless UK border, which has no legislative timetable as of October 2026.

11. What this means for identity verification

For carriers and booking platforms, the key data point is the passport the traveller will actually use: ETAs and eVisas are linked to it, so capturing passport data accurately at booking (ideally from the machine-readable zone or chip) reduces "check" responses and charge exposure. The rightful-holder comparison remains a human, naked-eye standard for liability, so automated face matching is an additional control, not a substitute for the defence.

For accommodation, the legal minimum is narrow: name and nationality for everyone 16 and over, plus passport number, place of issue and next destination for foreign nationals, retained for at least 12 months. Pre-arrival capture is compatible with the Order; document images and biometric matching need their own data protection justification.

For currency exchange, design to the £12,000 occasional transaction trigger and linked-transaction rules, verify name, date of birth and address, and use a DVS-registered provider for remote verification. Re-verify when information is doubted or a customer's risk changes.