Teletext Holidays faces legal action unless it pays back £7m to customers whose holidays were cancelled owing to the pandemic, a watchdog has said.
Complaints suggested people were not receiving refunds they were owed within 14 days, as required by law, for package holidays that were cancelled.
The Competition and Markets Authority said the delay was "unacceptable".
Teletext Holidays had said it was "extremely disappointed" with the CMA's actions.
Some people who complained about the online holiday firm reported they were promised refunds for package holidays by a certain date, only to have the date pushed back.
CMA chief executive Andrea Coscelli said: "There must be no more delays to Teletext refunding customers for holidays they could not take because of the pandemic.
"It is unacceptable that many have already waited months for the refunds they are legally entitled to. We take very seriously the ongoing failure of Teletext Holidays to meet its obligations.
"The firm must now comply with the law and commit to refunding its customers. If it does not do so, we will not hesitate to pursue this case in court."
Teletext Holidays is the trading name of Truly Travel, a subsidiary of Truly Holdings.
In a statement, the company said: "Teletext Holidays have consistently stated our commitment to refund all customers as quickly and practically as possible.
"We have been in continuous dialogue with the CMA providing evidence of why the refund process has been delayed.
"We have also provided real time plans on how and when we can refund all customers. Therefore, we are extremely disappointed with today's CMA announcement that seemingly ignores the reality of the challenges we face through no fault of our own."
If your travel company cancels a package holiday for any reason, it has to give you a full refund by law within 14 days.
Similarly, if you booked a flight (which was departing or arriving in an EU country or the UK or on an EU or UK airline) through a holiday company and the flight was cancelled, you must be reimbursed.
But many people were been left waiting months for a payout during the pandemic as travel firms faced a cashflow crisis.
Since the start of the pandemic, the CMA has written to more than 100 package holiday firms to remind them of their obligations to comply with consumer protection law.
It has arranged refund commitments from a number of holiday firms, including Love Holidays, Lastminute.com, Virgin Holidays, TUI UK, Sykes Cottages and Vacation Rentals.