Sanctions Screening for Travel Agencies and Tour Operators

The person booking a holiday, the traveller and the person paying may be different people. A corporate trip can also involve a reseller, a destination-management company and several suppliers. Sanctions screening for travel agencies and tour operators needs to connect those roles, with checks at the points where the business accepts an agreement, provides a service or moves money.

Start with the parties in your bookings and supplier relationships. Define who enters screening, which sources apply and who investigates possible matches. Revisit the relevant checks when a traveller, payer, supplier or refund recipient changes. Check destination and service restrictions separately: a booking can involve a prohibited activity even when no name returns a candidate.

Define the business and the rules before setting the checks

Identify the legal entity entering the booking contract, collecting funds and arranging services. A travel group may have companies, branches and agents in different countries. Record which sanctions frameworks apply to each activity and which team decides difficult cases.

UK financial sanctions apply within UK territory and to UK persons abroad. This is separate from AML-regulated status.¹ Do not infer either a full bank-style KYC programme or an exemption from sanctions simply from the label “travel agency”. Assess the actual activities and applicable legal categories, including any separately regulated payment or currency-exchange business.

Assign operational responsibility as well as legal escalation. Booking staff need a clear way to refer a candidate before ticket issuance; finance needs instructions before releasing a supplier payment or refund. A manager should own unresolved cases and time-sensitive departures. Record an internal processing hold separately from a legal asset freeze, while ensuring any required legal action happens without delay.

Who should a travel agency screen?

Use the roles in the contract, booking record and payment instructions. A third-party payment can have a legitimate explanation, but checking only the lead traveller can miss the payer or contracting company. Likewise, screening a hotel brand may not identify the legal entity receiving your payment.

This matrix suggests how to organise checks. Set the precise population and timing under your applicable rules and documented policy.

For broader supplier controls, use the supplier sanctions-screening guide. The aviation guide addresses aircraft, owners, leasing and maintenance; passenger bookings need the role mapping above.

When to repeat checks during a booking

A booking is not static. A customer can add a traveller, replace a hotel or ask another company to settle the balance. Build the relevant review into the change itself, rather than leaving staff to remember a separate task.

Set review timing around applicable requirements, open commitments and source changes. An annual supplier review alone may leave a newly designated provider attached to tomorrow's departure. Equally, repeating unchanged searches does not resolve missing payer information or an unreviewed candidate.

Corporate customers, intermediaries and ownership

For a corporate client or supplier, distinguish the company from its trading name, booking contact, directors and owners. Ask for the information needed to resolve the relationship. A director is not automatically the beneficial owner, and a listed director does not by itself establish that the whole company is subject to an asset freeze.

Unlisted entities can still be affected by ownership or control rules. UK guidance includes more-than-50% ownership tests and separate control criteria.¹ Apply the relevant jurisdiction's rules rather than using one percentage as a global shortcut. Record the supplied ownership evidence and escalate complex chains or control rights through the ownership and related-party review process.

Name screening does not discover every owner. If ownership is the unresolved question, another search of the company's name alone will not answer it.

Check destinations and services as well as names

For EU operations, Russia-related restrictions illustrate why list checks are only one part of booking review. Article 5n(2) of Regulation 833/2014 prohibits services directly related to tourism activities in Russia. The Commission's January 2026 guidance covers travel-agency and tour-operator services, ticket arrangements, relevant online booking services and visa facilitation when directly related to that tourism.²

The same guidance distinguishes private visits and business visits from tourism. That distinction does not clear them under every other restriction or permit circumvention. Establish the actual purpose, service and applicable provisions; renaming a holiday as a business trip does not change its substance.

Keep destination/service decisions separate from immigration eligibility and entry or travel bans. Nationality can be relevant to a particular rule or identity check, but is not evidence that someone is designated. A clear name result is also not permission to sell a restricted itinerary.

Apply the relevant UK, German, Spanish or UAE framework

Use the current UK Sanctions List for UK designations. The former OFSI consolidated list closed on 28 January 2026.³ A multinational group's source configuration should reflect the regimes relevant to its actual business, rather than assuming one country's list covers all operations.

In Germany, the Bundesbank explains the financial-sanctions framework and the authority of the published legal texts.⁴ In Spain, the Treasury describes freezing, non-availability and authorisation procedures.⁵ Identify the competent authority for the particular funds or services question; sanctions reporting is not automatically an AML suspicious-activity report to a financial intelligence unit.

For UAE operations, identify the applicable federal and free-zone requirements and the relevant authority. UN and UAE local designations are central to the UAE targeted-financial-sanctions framework. CBUAE's detailed instructions, including procedures for potential matches, address licensed financial institutions; do not copy their reporting channel or supervisory duties into a travel business without establishing scope.⁶

Do not assume that being outside an AML-supervised category removes sanctions duties, or that every agency in mainland UAE, DIFC and ADGM has identical reporting obligations. Establish the applicable process before an incident, including who can obtain instructions on funds already received.

What the Sabre enforcement case shows

On 26 May 2026, OFSI imposed a £1,000,920.59 penalty on Sabre Global Technologies Limited. Its notice, published on 17 June, concerned dealings with Ural Airlines after the airline's designation on 19 May 2022. OFSI found breaches involving payment arrangements, continued access to its global distribution system and circumvention through alternative payment routes.⁷

This was a travel-technology provider case, not a ruling that every passenger booking is prohibited. It shows why a business must review its services and contractual relationships as well as incoming transfers. Bank intervention did not resolve the company's separate conduct. A blocked payment should prompt investigation, rather than an attempt to find another route.

Review a possible match before the next booking action

Use a documented sequence that staff can follow:

1. Confirm the input and role. Check the spelling, person or legal entity, source and booking reference. Establish whether the candidate concerns a traveller, payer, intermediary or supplier.
2. Compare available identifiers. Read the source entry and relevant names, dates of birth, registration numbers, addresses or other identifiers. A spelling or address difference alone may not settle identity.
3. Escalate unresolved facts promptly. Assign a reviewer and obtain proportionate additional information. Control the next booking or payment step while the issue is assessed.
4. Determine the applicable measure and action. Assess the relevant legal threshold, ownership/control, funds or service involved, exceptions, licences and reporting requirements. Follow any required potential-match procedure.
5. Record the outcome and authority to proceed. Preserve the reasoning, open questions, reviewer and instructions for reservations, supplier management and finance.

OFSI distinguishes a name match from a target match. Its asset-freeze guidance also uses knowledge or reasonable cause to suspect: do not wait for absolute certainty where the applicable threshold for action has already been met.¹ A similarity score alone does not determine identity or legal effect.

Do not automatically cancel, refund or file an AML report because a name looks similar. Equally, do not use “unconfirmed” as a reason to ignore a required hold, freeze or report. Decisions about customer communications should follow the applicable confidentiality rules and approved process, without assuming that every sanctions enquiry creates the same AML tipping-off restriction.

Treat refunds as a new payment decision

Link a refund to the original payer, contractual entitlement and proposed recipient. Confirm a changed instruction through established channels; a message naming a new account does not prove the requester controls it. Screen a new recipient within your process, alongside account verification and fraud controls.

If a restriction may affect money already received, obtain the required assessment before using, transferring or returning it. Sending the money back or to an apparently unlisted alternative does not necessarily resolve the restriction. Record why a refund is permitted and who approved it, including any applicable authorisation.

Three hypothetical booking scenarios

A traveller's employer pays for the trip

A customer books a holiday and asks an employer to pay. Reservations records the traveller and booking customer; finance identifies the company payer and its relationship to the invoice. The supplied company details leave an ownership question unresolved.

The responsible team obtains relevant evidence and assesses any ownership/control restriction before the affected payment or service decision. A clear company-name search does not settle that question. Staff neither accuse the traveller nor assume that returning the payment would resolve the issue.

A group booking changes its local supplier

A corporate group has booked through an intermediary. Before departure, the destination-management company replaces the local transport provider and supplies new payment instructions.

Operations identifies the replacement legal entity and finance confirms the payee through its supplier-verification process. Relevant supplied parties are checked, and any candidate is reviewed before the next affected action. A listed director would require assessment of the person's role and applicable rules; it would not automatically prove the supplier is frozen.

A cancellation names a different refund recipient

A customer paid by card but asks for the refund to go to a relative's account. Finance records the reason and verifies the request and entitlement. The proposed recipient produces a possible sanctions candidate.

The reviewer investigates identity and applicable obligations while finance controls release under the established process. A fuzzy match is not a final prohibition, and switching back to the original payer is not an automatic workaround. The final record includes the permitted recipient, verification, review and approval.

Keep a useful decision record

A compact record can sit alongside the booking file:

Collect enough information to answer the question without making passport copies or full ownership files a universal minimum. ICO guidance requires personal data to be relevant and limited to the purpose.⁸ Set access and retention rules under the applicable requirements; there is no single retention period for every travel business and booking.

Booking and refund checklist

Evaluate screening software with real booking cases

Test a screening portal, CSV batches or an API against your booking workflow. Use representative names and entity records, ambiguous candidates and changed parties. Establish how relevant updates reach the responsible team and who acts before payment or service delivery.

Checklynx screens supplied parties against configured sources. Compare coverage, identifiers and review evidence with your requirements. Keep document authentication, payment fraud, ownership research and final legal decisions with the appropriate controls and decision owners.

Frequently asked questions

Must every travel agency screen every traveller in the same way?

Define your population and timing under the applicable rules and business activities. The role matrix is an operating model, not a universal legal requirement to apply identical checks to every enquiry. A general sanctions obligation and a specific AML customer-due-diligence duty are different questions.

Does our bank or payment gateway handle this for us?

Do not assume that its checks cover your booking contract, services, intermediaries and suppliers. Ask what it actually checks and keep your own responsibility and information needs clear. A processed payment does not approve the whole trip.

Does a PEP result mean we must refuse the booking?

Political exposure alone is not a sanctions designation. Apply any relevant due-diligence framework and policy separately. FATF describes its PEP measures as preventive, rather than an assertion that all PEPs are involved in crime.⁹

Is a passport check enough?

Identity verification and sanctions screening answer different questions. Available identity information can help resolve a candidate, but authenticating a document does not assess every applicable sanctions restriction.

Is this the same as the Travel Rule?

No. The financial-sector Travel Rule concerns information accompanying transfers, including relevant virtual-asset transfers. It is separate from screening parties in a holiday or business-travel booking.