Ransomware Payment and Reporting Laws Compared: US vs UK vs Australia vs EU

For a multinational hit by ransomware, whether it may pay, who it must tell and how fast depend on which country each part of the group sits in, and the answers do not line up. Paying is generally lawful in the US, UK, EU and Australia unless the money reaches a sanctioned person, but the sanctions tests differ: the US applies strict liability, the UK treats a breach as a criminal offence with civil penalties alongside, and the EU cyber sanctions regulation protects those who had no reason to suspect. Two US states already ban public bodies from paying, and the UK has decided to ban payments by its public sector and regulated critical infrastructure. Reporting is just as uneven: Australia requires a payment report within 72 hours today, while the US CIRCIA 24 hour payment report and the UK reporting duty are not yet in force. This page puts the regimes in one jurisdiction table for legal, incident response and risk leads in multinational groups. Status checked on 14 November 2026.

Key takeaways

• Sanctions are the universal limit. In all four jurisdictions it is unlawful to make funds available to a designated person, so wallet and actor screening before any payment is the common control.
• The liability standards differ. OFAC can penalise on strict liability; OFSI can impose penalties of up to the greater of GBP 1 million or 50% of the breach value and breaches are also criminal offences; the EU regulation shields those who did not know and had no reasonable cause to suspect.
• Bans are targeted, not general. North Carolina and Florida ban payments by state and local public bodies; the UK ban for the public sector and regulated critical infrastructure is policy, not yet law.
• Only Australia has a payment report in force. Businesses with turnover above A$3 million and critical infrastructure responsible entities must report within 72 hours of paying; CIRCIA's 24 hour report waits for a final rule.
• Early law enforcement contact earns credit everywhere. OFAC treats a prompt, complete report to law enforcement as a voluntary self-disclosure factor, and OFSI lists NCSC and law enforcement engagement as mitigating.

Regulations and frameworks at a glance

Is it legal to pay? Sanctions regimes compared

United States: OFAC

OFAC's updated advisory of 21 September 2021 states that it "may impose civil penalties for sanctions violations based on strict liability", so a company can be penalised even if it did not know the recipient was sanctioned. Licence applications for ransomware payments are "reviewed by OFAC on a case-by-case basis with a presumption of denial". The advisory is aimed at the firms that help victims pay as well as victims: financial institutions, cyber insurers and digital forensics and incident response providers. Its mitigating factors are meaningful steps taken to reduce extortion risk, such as offline backups, incident response plans and training, and a self-initiated, complete and prompt report to law enforcement, which OFAC can treat as a voluntary self-disclosure. It points victims to CISA, the local FBI field office or IC3, and asks that payments be reported to Treasury's Office of Cybersecurity and Critical Infrastructure Protection. The single-regime detail, including FinCEN reporting, is in the Ransomware Payments and Sanctions Guide.

United Kingdom: OFSI

OFSI's financial sanctions guidance for ransomware, first published on 7 May 2024 and last updated on 28 January 2026, states that "Breaches of financial sanctions are a serious criminal offence", carrying possible imprisonment and fines. OFSI can also impose civil monetary penalties under the Policing and Crime Act 2017 of up to the greater of GBP 1 million or 50% of the value of the breach. The UK cyber sanctions regime runs under the Cyber (Sanctions) (EU Exit) Regulations 2020. Ransomware payments "are unlikely to be considered appropriate for an OFSI licence". The guidance lists mitigating factors: reporting through the NCSC incident reporting portal, prompt and complete voluntary disclosure of a payment to OFSI, engagement with the NCSC and law enforcement, and voluntary disclosure by any third party that facilitated the payment. It adds that an NCA investigation is very unlikely for victims who engage proactively. Suspected payments to a designated person should be reported to OFSI as soon as practicable, with ICO and sector regulator reports where those duties apply.

European Union: Regulation (EU) 2019/796

The EU cyber sanctions regulation of 17 May 2019 covers "cyber-attacks with a significant effect, including attempted cyber-attacks with a potentially significant effect". Article 3 freezes the assets of listed persons and provides that "No funds or economic resources shall be made available, directly or indirectly" to them. Derogations are granted by Member State competent authorities, not by Brussels. Two features matter for ransomware. Article 10(2) says a person is not liable if they did not know, and had no reasonable cause to suspect, that their action would breach the measures, which is a different standard from OFAC's strict liability. Article 18 extends the regime to EU nationals anywhere in the world, to entities incorporated in a Member State and to any business done in whole or in part in the Union, so a non-EU group paying through an EU subsidiary or EU bank is in scope. Screening should cover all EU sanctions lists, not only the cyber annex.

Australia: the significant cyber incidents framework

Australia established its thematic cyber sanctions framework on 21 December 2021. DFAT states that it is "prohibited to directly or indirectly make an asset available to, or for the benefit of, a designated person or entity", and designated persons face travel bans. Names are published on the DFAT Consolidated List, which payment screening must include. Reporting a payment under the Cyber Security Act does not make an unlawful payment lawful. See the Australia Cyber Security Act 2024 Guide.

Public sector bans: North Carolina, Florida and the UK proposal

• North Carolina, G.S. 143-800: state agencies, including the University of North Carolina, and local government entities such as cities, counties, school administrative units and community colleges must not pay a ransom or communicate with the threat actor. They must consult the Department of Information Technology when they receive a ransom request.
• Florida, s. 282.3186: a state agency, county or municipality experiencing a ransomware incident "may not pay or otherwise comply with a ransom demand". The statute lists no exceptions. It was created by chapter 2022-220, Laws of Florida.
• UK proposal: the July 2025 government response confirmed a ban for public sector bodies and regulated critical national infrastructure, a payment prevention regime for everyone else and mandatory reporting. The consultation page still names no bill. See the UK Ransomware Payment Proposals Guide.

Reporting obligations compared

These sit on top of general breach duties such as personal data breach notification to data protection authorities within 72 hours under GDPR Article 33 and UK GDPR, and listed company disclosure. See the Cyber Incident Reporting Requirements Map and Cyber Disclosure Rules for Listed Companies Compared.

Threat model and failure modes per regime

• US sanctions: the risk is paying an actor who is designated, or whose wallet is linked to a designated exchange, without knowing it. Strict liability means good faith is not a defence. Control: documented screening by a qualified intermediary, a law enforcement report before any payment, and counsel sign-off.
• UK sanctions: the same screening risk, plus criminal exposure for individuals. Control: a written decision record showing what was checked, OFSI disclosure where any doubt exists, and NCSC engagement on record.
• EU sanctions: the knowledge standard rewards diligence, so the record of what was checked is the defence. Control: screening against all EU lists and evidence of the "no reasonable cause to suspect" basis.
• Australia: the common failure is missing the 72 hour report because an insurer or incident response firm paid. The obligation stays with the victim. Control: a contract clause requiring paying third parties to notify you at once.
• Public sector bans: the risk is an unauthorised negotiation by a contractor or an insurer on behalf of a covered body. Control: written instructions to suppliers that no contact or payment is permitted, and recovery plans that assume no decryption key.

Worked scenario: one attack across four jurisdictions

A logistics group headquartered in the UK, with a US subsidiary, a Dutch subsidiary in a NIS2 sector and an Australian subsidiary with turnover above A$3 million, has servers encrypted across all four. The threat actor demands payment for a decryptor and to delete stolen data.

1. Hour 0: the group incident lead reports through the NCSC portal and the US team contacts the FBI and CISA. These steps create mitigation credit under OFSI guidance and the OFAC advisory before any decision on payment.
2. Hour 0 to 24: the Dutch subsidiary submits its NIS2 early warning. Counsel commissions sanctions screening of the actor, its known aliases and the wallet against the OFAC SDN List, the UK sanctions list, EU lists and the DFAT Consolidated List.
3. Day 2: screening finds no designation. The board decides recovery from backups is viable for most systems and refuses to pay. No Australian report is due because no payment was made; the Dutch 72 hour NIS2 notification is filed.
4. Alternative: if the board had paid through its insurer, the Australian subsidiary would have had to report within 72 hours of becoming aware of the payment, and OFSI disclosure would have been considered. If the actor had been designated, payment would have been unlawful in all four jurisdictions.
5. Public bodies: had the US subsidiary been a Florida county, payment would have been barred outright and a report would have been due within 12 hours of discovery.

Decision guidance and trade-offs

• Screen first, decide second: no payment decision is lawful in any jurisdiction until the recipient has been screened against every relevant list.
• Report early even where reporting is voluntary: the US and UK regimes both reward early engagement, and it costs little.
• Use the strictest clock as the group standard: design the process around 12 to 24 hour reporting so that 72 hour duties are met with margin.
• Treat public sector and critical infrastructure subsidiaries as no-pay entities now: the UK ban is coming, and planning for it matches the North Carolina and Florida position.
• Smaller organisations: Australian businesses at or below A$3 million turnover are outside the payment report, but not outside sanctions law; a simple screening step through counsel is still needed.
• Insurers and negotiators: contracts should require prompt notice of any payment made on your behalf and cooperation with sanctions screening. See the Ransomware Negotiation Guide and the Cyber Insurance Guide.

Detection and measurement

Detecting ransomware precursors early buys the time these regimes require. Watch for the techniques defenders see before encryption, including ATT&CK T1490 Inhibit System Recovery, which often precedes T1486 Data Encrypted for Impact. Track these process metrics:

• Time to law enforcement contact: hours from declaration to the first FBI, CISA or NCSC report.
• Screening completion time: hours to a documented sanctions screening result across all lists.
• Reporting timeliness: share of mandatory reports (Australia, NIS2, Florida) filed inside the deadline.
• Third-party notice coverage: share of insurer, negotiator and incident response contracts with a payment notice clause.
• Recovery without payment: share of critical services restorable from protected backups within the tolerated outage.

Framework mapping

Common failure patterns

• Delegating the payment and the duty: letting an insurer or negotiator pay without telling the victim in time to report, which still leaves the Australian duty with the victim.
• Screening names, not wallets: an actor's brand name is rarely on a list; the wallet or exchange may be.
• Screening one list: a multinational that checks only the OFAC list can still breach UK, EU or Australian sanctions.
• Assuming reporting makes a payment lawful: neither the Australian report nor an OFSI disclosure authorises a prohibited payment.
• Inconsistent public statements: after the Caesars Entertainment breach the company's SEC filing said it had taken steps to ensure stolen data was deleted, which press reports read as implying a payment. Statements about deletion or payment must be consistent across every regulator and market.
• No plan for a ban: public bodies that rely on payment as a fallback have no recovery route once a ban applies.

Practitioner checklist

• Map every group entity to its jurisdictions, sanctions regimes, public sector status and reporting duties.
• Pre-arrange sanctions screening across OFAC, UK, EU and DFAT lists, including wallet screening.
• Write a payment decision procedure that requires screening, counsel sign-off and a board decision record.
• Report to law enforcement and national cyber centres at declaration, before any payment discussion.
• Build report templates for Australia s 27, NIS2 and, where relevant, Florida, and a CIRCIA template ready for the final rule.
• Add payment notice clauses to insurer, negotiator and incident response contracts.
• Flag public sector and critical infrastructure entities as no-pay and test recovery on that basis. See the Backup Security and Immutable Backup Guide.
• Review the UK bill status, the CIRCIA final rule and sanctions lists at least quarterly.

Standards and references

• OFAC: Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments
• CISA: Cyber Incident Reporting for Critical Infrastructure Act of 2022
• OFSI: Financial sanctions guidance for ransomware
• Home Office: Ransomware proposals to increase incident reporting and reduce payments to criminals
• EUR-Lex: Council Regulation (EU) 2019/796 on cyber-attacks threatening the Union
• Department of Home Affairs: Ransomware payment reporting fact sheet
• North Carolina General Assembly: G.S. 143-800
• Florida Senate: Florida Statutes s. 282.3186

Related NHI Mgmt Group resources: Ransomware Payments and Sanctions Guide · UK Ransomware Payment Proposals Guide · Australia Cyber Security Act 2024 Guide · CIRCIA Incident Reporting Guide · Ransomware Response and Recovery Guide. This guide summarises ransomware payment and reporting laws in the US, UK, EU and Australia and is not legal advice.