iquota

Card guarantees, no-shows and cancellations when guests pay at the property: what the EBA, PCI and EU law say in 2026

Updated: 9 November 2026

Many independent hotels charge at the property and take a card only as a guarantee. That works, but three sets of rules matter: payments (strong customer authentication), card security (PCI DSS) and consumer law (disclose and do not over-penalise). This is what the official sources say (listed at the end). This is not legal or financial advice: confirm details with your bank or payment provider.

Charging a no-show later: the key is the 'mandate'

According to the European Banking Authority's official answers, a charge initiated by the hotel without the guest's involvement does not need strong customer authentication (the bank code or app confirmation) if the guest gave a prior mandate for it. Setting up that mandate online, however, must be authenticated. In practice: the card is registered on your website or payment gateway with the bank's check (3-D Secure) and acceptance of your cancellation policy; the no-show charge is then made without the guest present.

'Just process it as MOTO' is not a way out

In 2021 the EBA answered a question about hotel use cases (deposits, cancellations, no-shows, post-checkout charges): only transactions genuinely made by mail or telephone order can fall outside strong authentication. A card transaction is electronic, so labelling it a phone order is not enough.

Card security: what you must not do

What guests must know before booking

Directive 2011/83/EU requires the total price and payment arrangements to be given before the contract, and any extra payment needs the guest's express consent. Because accommodation for specific dates has no 14-day right of withdrawal, the cancellation policy you publish is what applies: write it clearly, with dates and amounts. A disproportionately high penalty may be an unfair term (Directive 93/13/EEC).

Country rules

Will the new payments law change this?

On 29 October 2026 the EU Council adopted its position on the new Payment Services Directive and Regulation, which are not yet published in the Official Journal. Until then, PSD2 still applies.

How iQuota helps

Bookings through iQuota do not ask for card details: the traveller pays at the property and sees your cancellation policy before confirming. If you want a guarantee, use your payment gateway and these rules.

Want an official booking page AI can read and a connector with your real prices, commission-free? The first 30 hotels join free until 30 June 2027.

See the Founding Hotels programme

Frequently asked questions

Can I charge a no-show to the card Booking.com gave me?

It depends on the platform's terms and your bank; the authentication and security rules in this guide still apply.

How much can I charge for a no-show?

What you published before the booking, as long as it is not disproportionate; in Andalusia, within Decree-law 13/2020's limits.

Can a guest email me their card if they ask to?

Better not: send them a secure link from your payment gateway.

Sources

More guides for hotels

More guides for hotels →

Español · Italiano · Português · Ελληνικά