Virtual POS for hotels: applying, holds on funds and why accounts get closed

A virtual POS is a hosted card payment page that lets a hotel take money without a terminal. In Türkiye only banks, payment institutions, electronic money institutions and PTT may provide payment services under Law No. 6493, so a hotel applies to one of them, and the signed contract decides settlement, holds and closure.

A guest books a room in January for July, pays in full, cancels in May and disputes the charge in August. Across those seven months the hotel has to answer to a payment provider that never saw the booking, the cancellation policy or the check-in record. This guide walks through what a virtual POS actually is, who may lawfully provide one in Türkiye, what the application needs, why advance bookings worry providers, why money is sometimes held, why accounts get reviewed or closed, and how to check the whole chain every month.

What is a virtual POS, and what does a hotel actually get?#

A virtual POS is a card payment page hosted by a provider: the guest enters card details on a secure form, the provider asks the card issuer to authorize the amount, and the money later settles to the hotel's bank account. No terminal sits at the desk.

Three parts move separately: the payment page the guest sees, the authorization that reserves the amount on the guest's card, and the settlement that moves money to the hotel minus the provider's fee. A failure in one does not always show in the others, which is why the monthly check later in this article matters.

3D Secure is the step where the guest confirms the payment with a code from their own bank. It reduces fraud losses and moves part of the dispute liability away from the hotel, but it adds a step where guests abandon, so the return page after a failed attempt matters as much as the payment page itself.

A hold, also called a pre-authorization, reserves an amount without taking it; a sale takes it. Hotels use holds for incidentals and no-show security, and an unused hold releases on its own after a period set by the card issuer. A payment link is a URL the reservations team sends by email or message: the practical route for deposits on phone and WhatsApp bookings, and it keeps card details out of the hotel's inbox.

The hotel should never need to see or store a card number. If card numbers reach the hotel's systems, the card schemes' security rules and the bank agreement apply to that storage, which is a much larger obligation than taking a payment. For the underlying vocabulary of virtual POS, 3D Secure, tokens and chargebacks, see our separate guide.

Finally, the virtual POS is not the booking engine. The booking engine holds the calendar and the price; the POS only moves money, and the two are joined by a reference number, not by trust.

Bank or licensed payment institution: what differs for a hotel?#

Both are lawful providers, and the practical difference is not safety but the contract: who carries the risk, how settlement and reserves are written, and whether the provider's permit covers the service you are buying.

Article 13(1) of Law No. 6493 on Payment and Securities Settlement Systems, Payment Services and Electronic Money Institutions lists the payment service providers: banks under Banking Law No. 5411, electronic money institutions, payment institutions and PTT (Posta ve Telgraf Teşkilatı A.Ş.). Article 13(2) says anyone other than a bank or a payment service provider may not provide payment services, and Article 14(1) requires a payment institution to hold a permit from the Central Bank of the Republic of Türkiye (TCMB) before it operates. So the first check is not the sales presentation, it is the permit.

Accepting payment instruments is a payment service under Article 12(1)(c). TCMB notes that a payment institution's permit under that clause covers accepting payment instruments, not issuing them, so read the scope, not just the company name. TCMB publishes a table titled "Faaliyette Bulunan Ödeme Kuruluşları ve Faaliyet İzni Kapsamları", showing which Article 12(1) services each institution may offer, and lists electronic money institutions on a separate page, per the consolidated law text on the Mevzuat Bilgi Sistemi (opens in a new tab) and TCMB's payment institutions page. Match the name on your contract against the list and confirm the scope covers online card acceptance.

A bank usually attaches the POS to the hotel's current account and a relationship manager; a payment institution often specializes in online checkout and integrations. Neither is better in the abstract. Ask both the same six questions in writing, and compare the answers rather than the brochures.

How does a hotel apply for a virtual POS?#

You send the provider a company file and a website that describes a real, identifiable business, and the file is read by two different teams: onboarding, which checks the papers, and risk, which checks whether the business matches them.

Company papers usually include the tax certificate, trade registry gazette, signature circular, identity documents of the signatories and a letter for the bank account that will receive settlement. A hotel also shows its Ministry certification or operating licence where the provider asks; the exact list is the provider's, not a standard.

The website is part of the application, not decoration. Providers look for a contact page with a physical address and a reachable phone number, a clear description of what is sold, prices, a cancellation and refund policy, a distance sales agreement and a privacy notice under KVKK (kişisel verilerin korunması kanunu). Mismatch is the usual cause of delay: the site sells villa rental while the form says hotel, the domain is registered to a different company, the only phone number is a mobile, or the address on the site is a head office in another city.

The merchant entity must be the party that actually sells the stay. Where a management company operates a hotel owned by another company, decide early which one signs, because changing it later means a new application. Most providers run a small live test transaction before opening the account: use it to check the descriptor that appears on the statement, since that name is what a guest will later see and dispute.

Do not plan around a promised number of days. The file moves at the speed of the missing document, and a hotel that sends everything at once is approved faster than one that answers questions one at a time. For the pages themselves, our hotel website checklist lists what a provider looks for before approval.

Why do advance bookings worry a payment provider?#

Because the hotel takes the money months before it delivers the room, and in between the provider carries the refund and dispute risk for a stay it cannot see.

The timeline is the problem. Payment in January, stay in July, and a card dispute that can arrive after checkout. For the whole period the provider has paid out money it may have to take back. Cancellations and refunds are normal in hotels and look like risk volume to a monitoring system, so a generous free-cancellation window, which is good for direct bookings, should be explained in the application rather than discovered later.

A deposit reduces exposure for both sides; full prepayment of a long stay raises it. The prepayment policy is a commercial decision, but it should be a deliberate one, taken with the provider's view in mind. No-show and late cancellation terms need to say clearly when the hotel may keep the money and how that charge appears to the guest, because a charge the guest does not recognize becomes a dispute, not a policy discussion. For the commercial side, see our guide to prepayment, deposits and installment choices for direct bookings.

Send a short written note with the application: booking window, seasonality, deposit percentage, cancellation windows and how refunds are processed. A hotel that explains its terms is easier to underwrite than one that leaves the risk team guessing. And keep the terms identical everywhere: the cancellation policy on the website, in the booking confirmation, in the POS application and in a later dispute reply should be the same text, or the hotel argues against itself.

When does the money reach the hotel's account, and why is some of it held?#

Settlement timing and any hold on the hotel's money come from the contract, not from a market standard, and the provider may pay later than the sale and keep a reserve against future refunds and disputes.

Settlement is the payout of authorized sales, usually batched on a schedule written into the contract. Read that clause rather than the sales summary, and check whether the schedule changes for bookings with distant arrival dates.

Separate two things that share the word "hold". A hold on the guest's card reserves part of the guest's limit and releases on its own. A hold on the hotel's payout delays money the hotel has already earned. Only the second is a contract question. A reserve, or rolling reserve, keeps a share of each sale for a period to cover refunds and disputes; it is common where the delivery date is far from the payment date, which is exactly the hotel case. The percentage and the period are negotiable terms, not fixed rules.

A payout can also be delayed by a change of bank account, a batch of refunds, an unusual run of disputes, a volume jump or a missing document. Most delays are administrative and end when the document arrives. What the hotel controls is keeping company and bank details current, answering provider queries inside the deadline, processing refunds through the POS rather than by transfer, and not changing the merchant entity in the middle of a season.

Plan cash flow as if unsettled money is not yet yours. A hotel that pays suppliers from expected POS money is exposed to a single delayed batch, and the delay usually arrives in the busiest month.

Why do virtual POS accounts get reviewed or closed?#

Most reviews start with a pattern the provider's monitoring did not expect: disputes, refunds, a jump in volume, or a name on the guest's statement that the guest does not recognize.

A chargeback is a guest disputing the charge with their own bank. The provider debits the hotel and asks for evidence, and a rising count or ratio moves the account into review. The evidence that wins is the booking record, the policy the guest accepted, the check-in record and the correspondence, which is why answering a card dispute with the right evidence is a skill worth practicing before the first dispute arrives.

Refunding by bank transfer instead of through the POS breaks the link between sale and refund. On the provider's side it looks like a sale with no refund, which is the shape of a fraud pattern even when it is only convenience. The descriptor matters more than hotels expect: if the statement shows a parent company, a management brand or an unrelated trade name, guests dispute charges they would otherwise accept. Test it with your own card before the season.

Profile changes trigger review: sudden large tickets, a new source market, a new website, or selling something the contract does not cover, such as tours or transfers, without telling the provider. A closure letter usually cites the contract terms, the dispute level, missing documents or suspected fraud. Whatever it cites, the hotel's answer is records, and records kept at the time are worth far more than records reconstructed afterwards. Assume a closed account follows the company: a new provider will ask the same questions, and a previous termination is a fact the next application has to address rather than hide.

How does the POS meet the booking engine, and how do you check it each month?#

The booking engine decides the price and holds the room, the POS takes the money, and the two must agree on the amount, the currency and a reference number, or reconciliation becomes manual work that nobody has time for in August.

There are three common connection types: a redirect to the provider's payment page, a form embedded in the hotel's own page, and a payment link sent by the reservations team. Each fails differently, so test the one you actually use, on a phone as well as a laptop. 3D Secure sends the guest to their bank and back; a failed attempt should return the guest to a page that lets them retry or pay later, not to an empty booking form, and the room should not stay held for a guest who never paid.

The booking number should travel with the payment to the provider and back. Without a shared reference, someone matches payments to bookings by name and amount, and that is where duplicate charges and missed refunds hide. Currency is a quiet source of disputes: if the rate is quoted in one currency and charged in another, say so before payment and record which one was charged, because the guest will compare the two on the statement.

Run the check monthly, not annually. Three lists for the same period, matched by reference and amount, will surface a refund that was never recorded, a cancelled booking still charged, or a duplicate authorization while there is still time to fix it. Keep the signed monthly check: it is the document that shows a risk team the hotel knows its own money, and it is far more convincing than a promise that the numbers are fine.

What to do next#

Open your POS contract and read three clauses before anything else: settlement timing, any reserve or hold on payouts, and termination notice. Then write the cancellation and refund policy once and use that same text on the website, in the confirmation, in the application file and in any dispute reply, and put the monthly three-way check in someone's calendar. The provider's questions and the hotel's answers are the same conversation every year, and the hotel that keeps records wins it.