Agency Model in Travel: Payment Flows and Revenue Streams

A travel agency can make money mainly in two ways: the agency and merchant models. Booking.com, one of the largest OTAs, primarily follows the first approach, while one of its biggest competitors, Expedia.com, favors the second.

This article will explore how the agency model operates in the travel industry, its benefits, and its limitations. We’ll also compare it to the merchant and hybrid models. By the end, you’ll have a clear understanding of which types of businesses thrive under the agency model.

What is the agency model in travel?

The agency model in travel involves a travel agency acting as a storefront for service providers, such as airlines, hotels, and car rental companies. Under this model, the revenue is commission-based: Travel agencies earn commissions (typically 10-15 percent) from service providers for every booking made through their platform.

Money from the traveler's card goes directly to the hotel, airline, or other travel service provider. The commission is accrued and paid to the agency later.

Various businesses adopt this model, including:

• brick-and-mortar and online travel agencies (OTAs),
• destination management companies (DMCs),
• tour operators,
• travel management companies (TMCs), and more.

The agency model is quite simple and perfectly suited for a small business or start-up since it requires no huge upfront investments. However, industry leaders also find it advantageous.

TL;DR: key things to know about the agency model in travel

Here is the "too long; didn't read" summary in case you are thinking about opening the agency but not in the mood to read the whole article right now.

You don’t collect payments. The supplier is a merchant of record who does that. You just pass customer card details.

Instead, you receive agent commissions. The commission percentage or rate should be negotiated with a supplier before contracting.

Since you still pass customer card details, you must be PCI DSS compliant and secure traveler payment data. PCI DSS (Payment Card Industry Data Security Standard) is a set of security requirements for businesses handling card payments.

To meet these requirements, you’ll have to use a tokenization service. Tokenization means replacing sensitive financial data, such as card numbers, with unique identifiers (tokens), reducing fraud risk. Payment processors decrypt tokens only when needed.

On top of that, you’ll need IATA/ARC accreditation or a certified partner to sell flights. This accreditation lets you book air inventory from hundreds of airlines in a global distribution system (GDS), pay multiple carriers in a centralized way, and issue tickets on their behalf.

You don't need industry certifications to sell hotels. On the dark side, the hospitality segment is much more fragmented than aviation, meaning you must reconcile transactions with various suppliers—both direct (hotels) and third-party (bed banks, GDSs)—individually.

Now, we’ll examine these statements in detail and will give recommendations for implementing the agency model in your business.

Supplier is a Merchant of Record (MoR)

When a traveler books through an OTA working on an agency model, their payment information is passed to the airline, hotel, or tour operator. In this case, the supplier is a merchant of record (MoR)—the business entity responsible for processing customer transactions.

In this scenario, the supplier debits customer cards, handles refunds and chargebacks, and implements fraud prevention measures. The client’s credit card statement will display the supplier's name, not the agency's.

Agent commissions

Since a supplier charges a traveler, it has to reward an agent for selling its services and products by paying a commission. It can be a flat amount or, more often, a percentage of the gross price. If a hotel room's gross price is $200 and the commission rate is 15 percent, the hotel's net price is $170, and the agency earns $30.

An average commission rate for selling hotel inventory ranges from 15 to 30 percent, depending on the OTA's market share and exposure, hotel size, and location. OTAs usually take a higher percentage from small hotels and less from branded chains. For example, a standard Booking.com commission for major hotels is 15 percent.

Cruises may pay up to 25 percent; car rentals—10 percent. For instance, Hertz’s commissions are 5-10 percent for US and Canadian travel agencies, depending on the terms of rentals.

Airline commissions are more complicated. Over the years, the numbers fluctuated, ranging from 5 to 10 percent of the total airfare. However, the rise of online booking and direct airline sales has significantly changed the situation. Many airlines have entirely removed commissions in specific regions, such as Europe and the US. Still, some airlines pay OTAs small commissions on ticket sales for their international flights.

For instance, American Airlines offers zero commissions for flights to the Middle East, from 0 to 1 percent for flights to European countries (depending on the country), but 7 percent to Fiji, Benin, Cameroon, and Ghana. Porter Airlines, the third biggest carrier in Canada, pays commissions only on tickets bought from Canada through GDS (e-ticketed via BSP), 0-5 percent, depending on the fare.

The agency should negotiate commission before entering into a contract with the supplier.

PCI DSS compliance

Although, within the agency model scenario, a travel agency doesn't process payments, people still enter card details on your website, so you should maintain PCI DSS compliance. The Payment Card Industry Data Security Standard, established by major credit card companies (such as Visa, MasterCard, and American Express), protects cardholder data from breaches and fraud.

Even though an agency doesn’t store the card data in its database, it comes in contact with this information, albeit for the shortest time. If a breach occurs due to your non-compliance, remediation costs can range from a few thousand dollars to as much as $500.000, depending on the severity and number of affected customers.

Compliance starts by determining a business's PCI level based on annual transaction volume. There are four levels (from less than $20,000 to more than the $6 mln). An agency must complete an Attestation of Compliance and undergo security scans. The more card transactions you outsource, the lower your compliance requirements and the less you have to spend on related processes.

Watch our video on PCI DSS compliance to understand why it’s important for travel agencies.

Tokenization and payment form

So, how can you minimize the hassle of handling customer data? Use tokenization services. They secure payment processing by replacing sensitive card details with encrypted tokens—unique, randomly generated identifiers that have no value if intercepted. The tokenization provider stores the actual payment data in the PCI-compliant vault and forwards it to the travel service supplier.

Some tokenization platforms are, among others, PCI Proxy and PCI Vault. These services also provide ready-made payment forms to capture card details safely, so they never touch the agency’s website backend.

Let's trace the flow of funds once a traveler visits an OTA platform, selects a flight or a hotel room, and initiates the booking process.

• A traveler enters payment details in the ready-made payment form that forwards the card data to a tokenization service.
• The tokenization service passes the data to the supplier.
• The supplier processes the transaction.
• The supplier remits to the agency (within weeks).

The token itself may be sent back to the agency as a key for potential transactions down the line, such as if you need to use a client’s card details for later payments.

Selling flights: IATA BSP and ARC

If you plan to sell flights, you must have the blessing of one of the two major regulators of commercial aviation: the International Air Transport Association (IATA), which operates worldwide, or the Airlines Reporting Corporation (ARC), supervising air transactions in the US. Airlines consider an agency accredited by IATA or ARC a reliable partner and allow it to issue tickets on their behalf.

Besides confirming credibility, both regulators run platforms orchestrating financial operations between carriers and certified travel agencies. Over 400 carriers rely on IATA’s Billing and Settlement Plan (BSP) and ARC services to get paid for flight products they sell through global distribution systems.

Businesses working on an agency model can tap into BSP/ARC via a so-called customer card payment flow. Here’s how it works.

1. The agent collects the traveler’s card details and forwards them to the GDS via a tokenization service.
2. The GDS validates the transaction with the card-issuing bank to ensure funds are available on the customer's account.
3. Upon authorization, the GDS sends transaction details to the airline via BSP/ARC rails.
4. The airline charges the customer’s card and authorizes ticketing.
5. The agency issues a ticket on behalf of the airline.
6. Later, the airline pays the agency commissions — if they’ve been negotiated.

Pay attention to the fact that in the customer card payment flow, the card authorization is decoupled from the payment itself. The issuing bank validates the card on the GDS's request, but it’s the airline that charges money. That's why the agency must ensure in advance that the airline accepts card payments and supports the specific card brand.

Selling hotel rooms

Selling hotel inventory is both easier to start and harder to manage than selling flights. There are no regulators with strict accreditation requirements. At the same time, the lack of payment and settlement centralization makes things more challenging since you need to handle financial transactions with each inventory provider—be it a hotel or an aggregator like a bed bank and GDS—separately.

Collecting commission from hotels can become an issue, as it is often paid only upon a guest’s check-in or even checkout, which can happen months after the reservation. But for larger and more financially robust agencies, delayed payment is not as critical as for smaller ones. Plus, big players like Booking.com (which gathers commission on a monthly basis) can easily control the accommodation providers by adjusting their ranking.

To work directly with hotels, an agency needs either an extranet—a private platform where hotels independently update their inventory, pricing, and availability—or an integration with a channel manager that pulls data directly from hotels' central reservation systems (CRSs). Bigger OTAs operate this way because accommodation providers are interested in partnering with them.

For smaller agencies, there are two main options: GDSs or bed banks. GDSs typically authorize customer payment details with a card-issuing bank and forward them to a hotel which charges the traveler.  

Bed banks are wholesalers that purchase rooms at discounted rates in bulk and then resell them to travel agencies and other retailers. This scenario fits perfectly into a merchant model when a business can mark up prices. But bed banks can have separate offerings for companies operating on an agency model, acting as a merchant of record for them instead of hotels.

Benefits and limitations of the agency model

The agency model is a popular approach in the travel industry for a good reason. It offers businesses a low-risk way to sell travel products. However, it also has drawbacks, such as lower profit margins and limited payment options. Understanding the pros and cons is key to determining whether this model aligns with a company's strategy.

Benefits of the agency model

Let’s see what the advantages of the agency model are besides relative simplicity.

Minimal investment in infrastructure. You don’t need to open a merchant account, integrate with a payment gateway, and build complex travel payment integrations and flows for different suppliers. Also, security requirements will be minimal as long as you pass sensitive financial information to suppliers without storing it.

There is no customer service responsibility. The supplier has to manage any problems with the travel product, such as flight delays and cancellations, overbooked hotels, poor customer support, last-minute itinerary changes, etc.

“From the customer's perspective, to address an issue, you first go where you have a touch point – to OTA. And this creates a bit of a grey area. But in legal terms, if you are an intermediary, all the liability for handling the issues with the service falls on the supplier,” - says Sandra Mianda, a payment strategist and a founder of the payments consultancy, Paypr.work.

Limitations of the agency model

While the agency model offers flexibility and low upfront costs, it also comes with significant limitations.

Slow commission payments and cash flow issues. Agencies receive commissions weeks or months after service delivery. While airlines charge customer cards almost immediately, hotels typically do it only upon check-in. Even bigger payment delays and errors may occur when remitting money to the agency. Sometimes, agencies even have to turn to special firms that collect commissions. And if a traveler cancels the reservation, the agency receives no commission at all.

Limited payment options. Agencies can only accept individual or corporate cards, restricting flexibility for both leisure and business travelers. 

There is no control over pricing. Agencies must adhere to rates set by a supplier and cannot mark them up. In an agency model, reacting to falling or rising demand and ensuring competitiveness is problematic.

Inability to create travel packages. Agencies cannot bundle flights, hotels, and transfers into a single package with a markup. For example, if an agency were to buy discounted rooms from bed banks, it could create a package that includes accommodation, flight, and transfer and add a margin. Due to a low hotel rate, the overall package price would be competitive, making the agency profit.

No flexibility in building relations with the customer. Since the traveler pays the supplier directly, it is much harder for the agency to gain the client’s devotion. If you don't determine the price, there is little room for loyalty or reward programs.

While the agency model has constraints, it still remains a viable option for smaller businesses. However, those looking to scale may benefit from transitioning to the merchant model.

Agency vs merchant model

If an agency acts as a merchant of record (MoR), it handles the full transaction flow—it accepts payment from a traveler and then remits suppliers their share, keeping the margin. The customer’s credit card statement will display the name of the MoR agency rather than of the original seller.

How the merchant model addresses the agency limitations

Cash flow improved. The agency receives money from clients soon after purchase rather than waiting for suppliers to reimburse service fees weeks later.

Greater control over pricing.The agency can add markups to a net price set by a hotel or bed bank and bundle services.

Various payment options. A merchant of record can accept payments not only by credit or debit cards and cash but also by any form of payment, including digital wallets, bank transfers, or even crypto.

However, the merchant model involves significant challenges. Agencies must set up merchant accounts, integrate payment gateways, and assume responsibility for taxes, chargebacks, refunds, and fraud. They also must ensure they have enough money to pay a supplier before traveler payments become available for business usage.

How to become a merchant of record

Let's understand what creating a merchant of record involves and what requirements must be met.

Opening a MoR account. This is a special account for electronic payments that works 24/7. It can be opened in an acquiring bank (acquiring means a financial institution can process electronic transactions on behalf of a merchant) or a payment aggregator like Stripe, PayPal, Adyen, or Square—the latter act as payment providers for smaller businesses and deal with banks on behalf of agencies.

Due to the high-risk nature of travel (frequent fraud, high chargeback rate, and vulnerability to external factors like epidemics or natural disasters), banks aren't too eager to open merchant accounts for travel agencies, especially small and new ones.

That’s why you must prove your financial stability first and explain your business model to the bank. It’s easier to deal with payment aggregators. But keep in mind that they may block your account without any notice if, after a couple of months, your transaction volume isn’t high enough or for some other reason.

Established OTAs have better chances of securing favorable terms. Anyway, merchant bank services for travel come with higher fees and more restrictions than those for other businesses.

Integrating with a payment gateway. This payment technology connects merchants to card networks, captures customer card details, and securely sends them to an acquiring bank for further processing.  Note that some payment service providers offer both a merchant account and a gateway.

To better understand how these services work, read our articles on payment gateway integration and online payment processing.

Maintaining PCI DSS compliance at the highest level. In the case of a data breach, the fine for leakage cannot be avoided. But if you take all the required measures properly, the amount won’t be astronomical.

Taking care of timely payouts to suppliers. The problem with a merchant account is that the money received is not immediately available to the agency. First, the acquiring bank (or payment aggregator) checks its legality, which takes three or more days. Only then is the money transferred to the business account at the full disposal of the agency. Therefore, the agency needs surplus capital or a credit line to pay suppliers while the funds are blocked in the merchant account.

So is it worth moving from the agency model to MoR? The short answer is—not always, and not for any business. “The merchant model is not necessarily a model any agency would flip to. The advantage is here, but it comes with due diligence and assessment in terms of the operating model, resources, and cost implication to be able to branch into a merchant of record model fully,” says Sandra Mianda.  

Alternative setups and additional revenue streams

A travel business can boost revenue without moving entirely to a merchant model. For instance, Booking Holdings leverages several approaches: In 2023, it generated $21.4 billion in revenue by mixing agency and merchant models with advertising and other sources of income.

Their flagship OTA, Booking.com, initially operated on the agency model, earning commissions on reservations. But gradually, the company has versioned its revenue streams, balancing between the two models. Its merchant/agency revenue ratio is approximately about 1:1 nowadays. Merchant revenue includes premium hotel listing features, credit card processing rebates, customer processing fees for travelers, and ancillary earnings such as selling travel insurance.

So, what can a smaller agency do to follow the giant’s path?

Split payments

Travel resellers operating on an agency model can open a merchant account to charge customers a booking fee  (2-5 percent)  and ensure an additional income stream. In this case, there’s no risk of chargeback—clients cannot change their minds afterward because the agency has already fulfilled its obligations by assisting in booking the service. If, in the end, the traveler doesn’t go on the planned trip, the flight is canceled or delayed, or the hotel is overbooked, it is not the fault of the agency.

Under these conditions, banks are much more willing to open a merchant account, which will have lower processing fees, more favorable contract terms, and simpler approval processes than when you’re going to sell travel.

If you impose a booking fee, the customer's card will be charged separately for your and the supplier's services. For instance, if a traveler buys an air ticket for $1000, you take $20, and the final price will hit $1020.

What about a booking fee for hotel reservation? Doesn’t raising the price violate rate parity, an industry law in hospitality? The answer is no: During the booking, a customer sees the room rate separately, and your portion is indicated as an additional charge.

ARC Pay, Duffel, and other MoR middlemen

Split payments have one drawback: Customers don't really like them. But there is a way around it if you use ARC Pay, Duffel, or another middleman serving as a merchant of record instead of a supplier.  There are only a few platforms in this niche, predominantly focused on airlines rather than hotels. They debit customer cards and distribute funds between the agency and airline accounts.

ARC Pay also allows travelers to use multiple payment options, including credit and debit cards, Apple Pay, Google Pay, and buy-now-pay-later (BNPL) through Flex Pay (formerly Uplift), a major BNPL provider in travel.

GDS and airline incentives

There are also some extra incentives that an agency can enjoy, no matter what its business model.

GDSs pay agencies part of the commission received from airlines as incentives for ticket sales. It’s a long-standing industry practice. For instance, one of the biggest digital TMCs in the US, AmTrav, receives 14 percent of its revenue as GDS incentives.

In addition, some airlines reward travel agents for purchasing tickets through NDC (New Distribution Capabilities) channels, which were created to bypass GDSs. For example, American Airlines pays 10 percent for NDC fares of select bundles, while Air Canada pays $2 for each NDC booking.

Some carriers, like the Turkish low-cost airline Pegasus, offer bonuses for ancillary package sales. Each package has a certain number of points; the agency can use earned points to buy tickets.

As you can see, the agency model provides agencies with quite a few ways to make money. If you consider switching to the merchant model with all its costs, it might be worth exploring potential additional revenue streams from the agency model first.