Marriott Doesn't Run a Loyalty Program. It Runs a Bank It Can Borrow Against.

In May 2020, with hotels emptied by a global lockdown and revenue in freefall, Marriott needed cash fast. It did not go to a bank for a loan against its buildings — it mostly doesn't own the buildings. Instead it called JPMorgan Chase and American Express and, in a matter of days, raised $920 million by selling them something it had never run out of: future loyalty points.⁵ Chase prepaid for revenue not yet earned; Amex bought a pile of Bonvoy points to hand out later. A program that most travelers think of as a way to score a free night turned out to be collateral. That is the tell. Marriott Bonvoy is not a perk department. It is a balance-sheet asset.

The official story is that Marriott Bonvoy is a loyalty program — a thank-you to frequent guests, a points-for-stays scheme like the punch card at a coffee shop. The real story is that it is captive financial infrastructure: a 271-million-person database that funds itself, locks in demand, and can be borrowed against in a crisis.² The free night is the bait. The lock-in is the product.

Two out of three guests walk in already wearing the leash

Start with the number that makes the whole thesis. In 2024, members booked 65% of Marriott's room nights globally and 72% in the U.S.¹ By the close of 2025, those figures had climbed to 68% globally and 75% across the U.S. and Canada.² Read that slowly. Three out of four American room nights are not won by Marriott in the open market — they are pre-committed by people who have already decided, before they ever shop, that they will stay where their points accrue. Marriott's own 10-K says it plainly: the program generates 'substantial repeat business that might otherwise go to competing properties.'⁸ That clause is the entire moat in fourteen words. Every member who chases status is a customer who has agreed, in advance, to stop comparing.

And the leash is tightening. When Bonvoy launched in February 2019 — replacing three separate programs, Marriott Rewards, The Ritz-Carlton Rewards, and Starwood Preferred Guest, under one currency and one tier ladder³ — members drove 58% of room nights. By 2025 that share had reached 68%.⁴ Ten points of penetration in roughly six years, on a base of hundreds of millions of nights, is not a marketing flourish. It is demand quietly migrating from the spot market into a closed loop Marriott controls.

Why the program funds itself, and who actually pays

Here is the mechanism that makes this more than a points giveaway. Marriott is mostly an asset-light franchisor — it manages and brands hotels other people own. So who pays for all those free nights? The franchisees do. Royalty fees are structured to fund the program, typically running 4–7% of room revenue plus up to 4% of food-and-beverage revenue.⁸ The owner of a Courtyard or a Sheraton pays into the Bonvoy pool, and in return receives the one thing they cannot generate alone: a torrent of pre-committed guests. The flywheel turns on its own. More members make the network more valuable to owners; more owners make the program more valuable to members; the franchise fees fund the rewards that recruit the next member. Marriott sits in the middle, taking a cut, owning the database, and carrying almost none of the real estate risk.

Then there is the second revenue stream most travelers never see. Marriott runs co-branded credit cards in 11 countries, with multi-year agreements in the U.S. with Chase and Amex.⁵ Those partners buy Bonvoy points in bulk to dispense to cardholders, and they pay Marriott for the privilege of stamping the brand on a piece of plastic that sits in millions of wallets. That is why the 2020 emergency raise was even possible: the points are a product Marriott can sell forward. A coffee shop cannot mortgage its punch cards. Marriott can — and did, for $920 million, in a single week of a pandemic.⁵

Why a rival can't simply build a bigger Bonvoy

Scale is the part competitors cannot shortcut, because a loyalty network is two-sided in the same way a payment network is. At year-end 2024, Bonvoy led every hotel loyalty program on earth by member count — 228 million, ahead of Hilton Honors at 210 million, Wyndham at 114 million, Choice at 69 million, and Hyatt at 54 million.⁶ But the moat is not the headcount; it is the geometry. A member's points are only worth chasing if there is a Marriott property wherever they happen to travel, and an owner only joins the system if there is a member base big enough to fill rooms. A challenger has to solve both sides at once, against an incumbent that solved both a decade ago and absorbed Starwood's program to widen its lead. You cannot out-recruit a network that already has more members than the next three programs need. Status is sticky in a way a discount never is — because a discount can be matched, and ten years of accrued points cannot.

But the same database that locks them in can also leak

Here is the honest objection, and it is a serious one: the asset is also the liability. The thing that makes Bonvoy a moat — a deep, centralized record of who travels where, with whose passport, on which payment card — is precisely the thing that turns a security failure into a catastrophe. And Marriott has had catastrophes. The FTC documented not one breach but three, spanning 2014 to 2020, exposing more than 344 million customer records globally, including passport numbers, payment cards, dates of birth, and loyalty account data.⁷ In October 2024, Marriott and Starwood settled with the FTC and 49 states for $52 million and accepted a comprehensive security program with biennial third-party audits and annual certification — for twenty years.⁷ A loyalty database earns its lock-in by knowing everything about its members. That knowledge is an asset until the day it becomes a 344-million-record liability with two decades of regulatory supervision attached.

The fair counter to the bears is that none of this dented the lock-in. Membership kept climbing through and past the breaches; penetration rose from 58% to 68% over the same window the FTC was building its case.⁴ Members did not flee — switching costs held, because the alternative was forfeiting a decade of status and points over a breach they could not see. That is the brutal efficiency of the model: the lock-in is strong enough to survive the exact failure the lock-in makes more damaging. But 'survived so far' is not 'immune.' The settlement binds Marriott's security practices until the 2040s, and the next breach lands not on a clean slate but on a company already under a consent order. The crack in the thesis is not that members will leave. It is that the cost of holding the database keeps rising, on a clock Marriott no longer controls.

Marriott figured out the deepest trick in hospitality: stop competing for the booking and start owning the decision before it's made. The free night was never the point. The point was 271 million people who shop with one brand in mind, franchisees who fund the rewards that recruit them, and a points currency liquid enough to mortgage in a crisis.²⁵ It is one of the most durable lock-ins in any consumer business — built on the one asset that, the larger it grows, the more it can cost to keep. Marriott didn't build a loyalty program. It built a bank it can borrow against, sitting on a vault it can't afford to let leak again.