Travel & Hospitality Compliance in the United States

The United States market is open to online travel businesses without a federal operating licence. The rules that matter sit with the carrier, the border and the payment: aviation security data collection by airlines, document acceptance at the airport checkpoint and the border, cash reporting, and price disclosure for lodging.

The principal federal authorities are the Transportation Security Administration, U.S. Customs and Border Protection (CBP) and the Federal Trade Commission (FTC), with the Financial Crimes Enforcement Network (FinCEN) and the IRS where cash or currency exchange is involved. The biggest practical obstacle for a new entrant is building booking and check-in flows that collect exactly the passenger data the carrier must transmit, and that keep the traveller's name consistent with the identity document presented at the airport.

1. Who regulates this sector

Travel identity rules are split between federal security and border agencies, federal consumer and tax authorities, and state and local governments. There is no single travel regulator.

2. Licensing and authorisation

Federal law does not license online travel agencies, metasearch sites, hotels or short-term rental platforms as such. Authorisation questions arise in three places.

Airlines

The Secure Flight rule applies to "covered aircraft operators", meaning carriers that operate under a TSA full security program or a foreign air carrier security program. Booking sites that sell those carriers' seats inherit the data requirements but not the security program.

Currency exchange

A business that exchanges more than $1,000 of currency, or instruments denominated in currency, for any one person on any day is a "dealer in foreign exchange" under 31 CFR 1010.100(ff)(1) and becomes subject to FinCEN's money services business rules in 31 CFR Part 1022.

Lodging and travel sellers

Hotel, short-term rental and seller-of-travel licensing is a state and local matter. Requirements differ by city and state, and meeting one jurisdiction's rules does not satisfy another's.

3. Identity framework (AML rules do not apply)

Travel and hospitality businesses are not, as a category, financial institutions under the Bank Secrecy Act, so there is no customer identification programme, beneficial ownership rule or general suspicious activity reporting duty for booking platforms or hotels. Identity is governed instead by aviation security, border and tax rules. Two financial-crime obligations do reach the sector.

Currency exchange at a desk, counter or kiosk

A dealer in foreign exchange must keep a record of each exchange over $1,000, including the customer's name, address and taxpayer identification number and the number and description of the government document used to verify identity. FinCEN ruling FIN-2014-R003 (11 March 2014) allows a non-resident alien's alternate entry document issued by a U.S. federal or state agency to stand in for a passport. The same ruling records that the record does not need the identity document or taxpayer number where the transaction is received by mail or common carrier, and it leaves the suspicious activity reporting duty under 31 CFR 1022.320 untouched.

Cash for trips and stays

Any trade or business that receives more than $10,000 in cash in one transaction or related transactions must file Form 8300 within 15 days. The IRS reference guide treats travel as a "designated reporting transaction": where the total price for one trip or entertainment event exceeds $10,000, cashier's checks, bank drafts, traveller's checks and money orders of $10,000 or less count as cash. Payments by the same payer within 24 hours are related, and so are payments further apart that the business knows are connected, such as a top-up to add a second traveller. Personal checks and wire transfers are not cash. The business must collect the payer's taxpayer identification number; for a non-resident it must instead verify name and address from a government photo document, and it must send each named person a written statement by 31 January of the following year.

4. Identity verification and onboarding

At booking: Secure Flight data

Under 49 CFR 1560.101, a covered aircraft operator must request each passenger's full name, sex, date of birth and Redress Number, and may also request a Known Traveler Number. For reservations made more than 72 hours ahead, full name, sex and date of birth must be collected at booking or no later than 72 hours before departure; inside 72 hours they must be collected at the time of reservation. The carrier may not transmit Secure Flight Passenger Data for anyone who has not supplied all three, and that person cannot be cleared to fly. The duty sits with the airline, so any channel that takes reservations for a covered flight has to pass these fields to the airline in time.

International flights: manifests and document validation

For flights to and from the United States, carriers transmit passenger data drawn mainly from the passport data page to CBP's APIS. Under the 2007 APIS final rule (72 FR 48320), batch manifests are due no later than 30 minutes before the aircraft doors are secured, or passenger by passenger up to door closing, and a carrier may not issue a boarding pass to a passenger who has not been cleared. A boarding pass issued after early online check-in is provisional until the carrier swipes or inspects the travel document and confirms it matches the data sent.

At the checkpoint: accepted documents

Since 7 May 2025, 6 CFR 37.5 bars federal agencies, including TSA, from accepting a state driver's licence or identification card for official purposes unless it is REAL ID-compliant. Agencies running a phased enforcement plan must reach full enforcement by 5 May 2027. A traveller can instead present a passport or another document on TSA's accepted list.

A mobile driver's licence is accepted only if TSA has granted the issuing state a temporary waiver, the agency reads it with a reader that validates the data under ISO/IEC 18013-5:2021, and the credential is flagged as based on a REAL ID-compliant card. Waivers last three years (89 FR 85340, effective 25 November 2024).

No accepted ID: TSA ConfirmID

A traveller without an accepted document may pay a non-refundable $45 fee to attempt alternative identity verification, covering a 10-day period (90 FR 55754, effective 3 December 2025). Payment does not guarantee verification or entry to the sterile area, and the traveller may face additional screening and delays.

Lodging

No federal regulation requires hotels or short-term rental hosts to verify guest identity. Guest registers, identity checks at check-in and retention periods, where they exist, come from state and local law.

5. Digital channels: what's different

Bottom line: booking data rules are channel-neutral, but the credentials and checks downstream are increasingly digital: visa waiver authorisation is online only, mobile driver's licences are accepted only from waiver states, and online currency exchange and card payments fall outside two cash-era identity rules.

Electronic travel authorisation

Visitors under the Visa Waiver Program must obtain an ESTA authorisation before travel by air, sea or land. Public Law 119-21 raised the fee to $40 from 30 September 2025 (CBP notice, FR Doc. 2025-16453). CBP has proposed making the ESTA mobile app the only way to apply, adding mandatory social media identifiers for the last five years and further "high value" data fields [Proposed, comments closed 9 Feb 2026]. The proposal notes that third parties may apply on a traveller's behalf, which matters to travel sellers that offer to file applications.

Digital credentials at the checkpoint

The mobile driver's licence waiver is a federal acceptance rule, not a standard that private businesses must follow, but it sets the reference model: cryptographic validation of the issuing state's signature under ISO/IEC 18013-5 rather than visual inspection. A future rule is expected to replace the waiver with comprehensive requirements.

Biometric facial comparison

From 26 December 2025, DHS may require all noncitizens to be photographed on entry and exit at any authorised departure point, with no age exemption for photographs (90 FR 48604). U.S. citizens may opt out and request manual document checks. Airline and airport partners using CBP's Traveler Verification Service must purge images immediately after sending them to CBP and may not keep them for their own purposes.

6. Data protection and biometrics

There is no single federal data protection statute or authority in the United States. For travel businesses, identity data is shaped mainly by the rules that require it to be collected: Secure Flight and APIS fields go to TSA and CBP under the carrier's transmission duties. Photographs captured at a boarding gate for CBP's facial comparison service are subject to CBP's partner business requirements, which prohibit retention for the partner's own use and allow CBP to audit compliance; CBP itself discards photographs of U.S. citizens within 12 hours of verifying citizenship. Businesses that run their own facial recognition, for example for contactless hotel check-in, fall outside that federal regime and are governed by state privacy and biometric laws, which vary by state. Form 8300 records must be kept for at least five years.

7. Sector-specific obligations

Total price for short-term lodging

The FTC Rule on Unfair or Deceptive Fees, 16 CFR Part 464, effective 12 May 2025, makes it unfair and deceptive to offer, display or advertise a price for short-term lodging without clearly, conspicuously and prominently disclosing the total price, and to misrepresent any fee. It covers hotels, motels, inns, short-term and vacation rentals, and third-party platforms, resellers and travel agents. Optional add-ons may be excluded from the total price; mandatory fees may be itemised but the total must be most prominent. Airfare and other travel services are outside this rule.

Visa waiver and border data for travellers

Travel sellers do not file ESTA or APIS data as a legal duty, but their flows determine whether the traveller's data reaches the carrier and CBP correctly. Name order, spelling and document number must match the document presented, because a mismatch produces a "not cleared" result and no boarding pass.

Currency exchange at hotels and airports

A front desk or airport kiosk that exchanges more than $1,000 for one customer on one day is a money services business, with recordkeeping, suspicious activity reporting and the related FinCEN obligations. Keeping exchanges under the threshold by design, and logging aggregation across a day, is the practical control.

8. Risk indicators and red flags

Travel and hospitality indicators from official sources

• Split cash payments: a trip paid in cash instalments that together exceed $10,000, including top-ups to add travellers.
• Small money orders: several cashier's checks or money orders under $10,000 used for one trip or event.
• Structuring: a customer breaking a large cash payment into smaller ones to avoid Form 8300.
• Refused taxpayer number: a payer declining to give a taxpayer identification number on a reportable cash transaction.
• Data mismatch: booking name or date of birth that does not match the travel document at validation.
• Imposter use of documents: a traveller who fails facial comparison against the photograph tied to the passport.
• Fee-driven complaints: pre-selected optional charges or totals that change at checkout, a pattern the FTC has pursued against travel apps.

9. Enforcement and penalties

FTC civil penalties for knowing violations of a trade regulation rule such as the fee rule are assessed per violation, up to $53,088 each (16 CFR 1.98, as adjusted on 17 January 2025 and unchanged in the current text). In July 2026 the FTC announced that the operators of the Hopper travel apps agreed to pay $35 million to settle allegations that they charged pre-selected, hidden fees and misstated total prices, including violations of the fee rule for short-term lodging bookings made since 12 May 2025 [Proposed order, pending in court].

Form 8300 penalties are set per return and per payee statement, with annual ceilings that are lower for businesses with average gross receipts of $5 million or less, reduced amounts for prompt correction, and a higher penalty for intentional disregard equal to the greater of a fixed amount or the cash received, subject to a cap. Willful failure to file is a felony punishable by fines of up to $25,000 ($100,000 for a corporation) and up to five years in prison; filing a materially false Form 8300 carries fines of up to $100,000 ($500,000 for a corporation) and up to three years.

10. Recent changes and what to watch

• August 2026: the 2026 Unified Agenda lists a TSA procedural final rule to allow remote application for and issuance of REAL ID cards [Planned, not yet published]. Remote issuance would make compliant IDs easier to obtain.
• July 2026: FTC settlement with the Hopper travel apps over hidden fees [Proposed order]. Expect scrutiny of pre-selected add-ons in booking flows.
• 26 December 2025: biometric entry-exit rule allows facial photographs of all noncitizens at entry and departure [In force]. Gate partners must purge images.
• 10 December 2025: CBP proposed app-only ESTA applications and mandatory social media [Proposed, comments closed 9 Feb 2026]. Travel sellers that help with ESTA should plan for an app-only flow.
• 3 December 2025: TSA set the ConfirmID fee at $45 per 10-day use [In force]. Booking confirmations should remind travellers to carry accepted ID.
• 30 September 2025: ESTA fee rose to $40 [In force].
• 5 May 2027: last date for federal agencies to finish any phased REAL ID enforcement [Adopted, deadline 5 May 2027].

11. What this means for identity verification

Build booking capture around the carrier's data rules: full name exactly as on the travel document, date of birth and sex for every passenger, collected by the 72-hour point, with Redress and Known Traveler Numbers as optional fields. For international itineraries, capture passport data in a structured way, ideally by reading the machine-readable zone or chip, so the APIS record matches the document the carrier will validate. Expect the document mix at the checkpoint to shift: REAL ID cards, passports and state mobile driver's licences validated cryptographically, with paid ConfirmID as the fallback. Re-verification triggers in travel are document-driven rather than periodic: a name change, a new passport or a mismatch at validation. Where the business takes cash or exchanges currency, add threshold aggregation over 24 hours and 12 months and capture taxpayer or document numbers. Where it uses biometrics itself, design retention to the strictest applicable state law, since no federal rule covers private use.