To me, the key word in the EU regulation is "passenger." Compensation is due from the airline to "passengers." The tour agent may be the purchaser of the ticket from the airline, but the passenger is the "passenger." That said, for flights arranged by tour companies the airline may not have adequate information about passenger mailing addresses to send compensation directly to them, and it expects (and may legally require) the tour operator to pass on the compensation to the passenger.
Thus, AO should probably do two things. The first is to demand the held money from the tour operator, and if the operator does not comply tout de suite, notify the airline that their agent has pocketed the compensation due to them and demand that the airline remedy this. If no money is provided to the passenger within 7 days, complain to the regulator.