Who has it will depend on the business. For example a big company like TUI will most likely be on 3 day settlement of funds, so they get your money 3 days after the card transaction takes place. Smaller businesses may be on deferred settlement with a delay of 30, 60, maybe 90 days. For example they receive 80% of the value in 3 days and the remainder in 30 days. The acquirers all mark risk limits against tour operators and in some circumstances may take security, guarantees etc, but they won't hold onto all the cash else the business wouldn't be able to operate. The tour operator should segregate those funds, but don't. It's like a business taking payment for a pair of shoes, the price includes VAT and the business accounts to HMRC for the VAT usually quarterly. Some don't though and sometimes HMRC lose out. That's business.