1. The pax. Otherwise, in the case of business travel, it would be the business which seeks and keeps the compensation.

2. Until you know what's on the debit card, you have no way of knowing what the pax received. Perhaps it's loaded with their EU compensation? Perhaps it's the correct amount?

I'd get the facts first.