Ransomware Payments and Sanctions: OFAC, UK Ban, Reporting

Paying a ransom is no longer only a business decision: it can breach sanctions law, trigger mandatory payment reports within 24 or 72 hours, and, for UK public bodies and critical infrastructure, may soon be banned outright. The rules come from different places: US sanctions enforced by the Treasury's Office of Foreign Assets Control (OFAC), financial crime reporting through FinCEN, Australia's Cyber Security Act 2024, the US CIRCIA statute and the UK Home Office's legislative proposals. This guide sets out who each regime covers, what it requires, where each one stands as of October 2026 and how to build a payment decision process that can withstand scrutiny. It is written for incident commanders, legal and compliance teams, CISOs and the executives who would authorise or refuse a payment. Technical response is covered in the Ransomware Response and Recovery Guide; this page covers the legal and reporting layer only.

Key takeaways

Sanctions risk attaches to the payment, not the intent. OFAC's updated advisory of 21 September 2021 warns that facilitating a payment to a sanctioned person can create liability, and it strongly discourages paying at all.
Reporting earns mitigation. OFAC treats prompt reporting to US law enforcement and full cooperation as significant mitigating factors if a sanctions nexus is later found.
Australia already requires payment reports. Since 30 May 2025 businesses with turnover above A$3 million and critical infrastructure entities must report a ransomware payment to the ASD within 72 hours.
The UK ban is still a proposal. The Home Office confirmed in July 2025 it will pursue a public sector and CNI payment ban, a payment prevention regime and mandatory reporting, but no bill had been introduced by the sources read in October 2026.
CIRCIA's 24 hour ransom report is not yet in force. The statute requires it, but the duty only starts when CISA's final rule takes effect, which was still pending in October 2026.

Scope: who and what is covered

Regime	Who is covered	What triggers it
US OFAC sanctions (IEEPA and TWEA based programmes) and the 2021 ransomware advisory	US persons, and non-US persons who cause US persons to violate sanctions; the advisory names victims and the firms that help them, such as financial institutions, cyber insurers and incident response firms	Any payment or other dealing involving a person or wallet on the SDN List or a sanctioned jurisdiction
US FinCEN Advisory FIN-2021-A004	Financial institutions, including virtual currency exchanges	Transactions involving ransomware that meet SAR criteria ($5,000, or $2,000 for money services businesses)
Australia Cyber Security Act 2024, Part 3	Responsible entities for critical infrastructure assets under Part 2B of the SOCI Act, and businesses in Australia with annual turnover above A$3 million	Making a ransomware or cyber extortion payment, or becoming aware one was made on your behalf
US CIRCIA (6 U.S.C. 681b)	Covered entities in critical infrastructure sectors, as the final rule will define	A ransom payment made as a result of a ransomware attack, even if the incident is not a covered cyber incident
UK Home Office proposals (consultation January to April 2025)	Ban: public sector bodies, including local government, and owners and operators of regulated CNI; prevention regime and reporting: everyone else	Proposed: any ransomware payment (ban), an intention to pay (prevention regime), any ransomware incident (reporting)

The payment itself is usually made in cryptocurrency, so the people who move the money are as exposed as the victim. Insurers, negotiators and incident response firms acting on the victim's behalf need their own screening process. See the Cyber Insurance Guide for policy terms and the Ransomware Negotiation Guide for the conduct of negotiations.

Key obligations

United States: OFAC and FinCEN

Do not deal with blocked persons: US persons must not make payments to persons on the Specially Designated Nationals (SDN) List or to entities owned 50 per cent or more, in aggregate, by blocked persons (OFAC FAQ 560). OFAC obligations are the same for virtual currency as for fiat.
Screen wallets, not only names: OFAC lists digital currency addresses on SDN entries, as it did for the SUEX OTC exchange designated on 21 September 2021, but notes such listings may not be exhaustive (FAQ 562).
Block and report: if blocked virtual currency comes into your control, deny access and report it to OFAC within 10 business days, then annually while it stays blocked (FAQ 646).
Licences: a payment involving a sanctioned party needs an OFAC licence; the 2021 advisory says such applications are reviewed case by case with a presumption of denial.
Report to law enforcement early: Treasury's announcement of the advisory says prompt reporting to US government agencies and cooperation can earn significant mitigation and voluntary self-disclosure credit.
Suspicious activity reports: FinCEN asks financial institutions to use the key term "CYBER-FIN-2021-A004" in SAR field 2 and the narrative, select field 42 (cyber event) and add technical indicators in fields 44(a) to (j) and (z). Red flags include rushed large crypto purchases by customers with little crypto knowledge, mixers, and transfers between high-risk sectors and incident response or insurance firms known to facilitate payments.

Australia: ransomware payment report

Deadline: within 72 hours of making the payment or becoming aware it was made.
No minimum amount: non-monetary benefits, such as services or data, also count.
Recipient: the Australian Signals Directorate through the Australian Cyber Security Centre portal.
Contents: the paying entity, the incident and its impact, the demand, the payment, and communications with the extorting entity, to the extent known after reasonable enquiry.
Limited use: designated Commonwealth bodies may use the report only for permitted purposes, such as helping the entity respond, and not for civil or regulatory action outside those purposes except in narrow cases.

United States: CIRCIA ransom payment report

Deadline: within 24 hours after the ransom payment, separate from the 72 hour covered incident report.
Not yet mandatory: CISA states that reporting is not required until the effective date of the final rule, and until then encourages voluntary reports to [email protected] or (888) 282-0870. Who counts as a covered entity, and how payments made by third parties are handled, will be set by the final rule: check current text. See the CIRCIA Incident Reporting Guide.

United Kingdom: the three proposals

Proposal	What it would require	Open questions in the government response
1. Targeted payment ban	Public sector bodies and regulated CNI owners and operators must not pay	Exemptions (the Security Minister said in December 2025 there will be national security exemptions), supply chain reach, extraterritorial effect
2. Payment prevention regime	Organisations outside the ban report an intention to pay before paying, through a central mechanism, and the government assesses the payment	Whether it covers other extortion, alignment with the Cyber Security and Resilience Bill, penalties
3. Mandatory incident reporting	Report ransomware incidents whether or not payment is considered, with a 72 hour initial report under consideration	Thresholds, report content, penalties

Timeline and current status

Status as checked on 24 October 2026. These rules are moving, so confirm with the primary source before acting.

21 September 2021: OFAC publishes the updated ransomware advisory and designates SUEX OTC.
8 November 2021: FinCEN publishes Advisory FIN-2021-A004 on ransomware and ransom payments.
15 March 2022: CIRCIA enacted; CISA must publish the proposed rule within 24 months and the final rule within 18 months after.
13 January to 8 April 2025: UK Home Office ransomware consultation.
30 May 2025: Australian ransomware payment reporting starts, with no grace period according to the law firm summary read.
22 July 2025: UK government response: it will proceed with all three proposals and develop scope with industry.
3 December 2025: UK Security Minister says the ban will include national security exemptions and will be legislated "when parliamentary time allows".
2026: the US regulatory agenda projected the CIRCIA final rule for September 2026, already past the statutory deadline of 4 October 2025. As of the sources read, no final rule was in force and reporting remained voluntary. In the UK, no ransomware bill had been introduced in the sources read (February 2026 commentary still described the measures as in policy development); check Parliament's bills site for current status.

Enforcement and penalties

Regime	Exposure
OFAC	Civil penalties for sanctions violations, assessed under OFAC's Enforcement Guidelines; the advisory's mitigating factors are a strong compliance programme, prompt reporting to law enforcement and cooperation. Check current text for penalty amounts, which are inflation adjusted
FinCEN	Bank Secrecy Act penalties for failing to file required SARs: check current text
Australia	Civil penalty of up to 60 penalty units (A$19,800 at the time of the summary read) for failing to report
CIRCIA	Statutory enforcement through CISA information requests and subpoenas once the final rule applies: check current text of 6 U.S.C. 681d
UK proposals	No penalty structure set; the government response notes concern that penalties could revictimise victims

The Colonial Pipeline ransomware attack shows why early law enforcement contact matters: the company paid about 75 bitcoin on 8 May 2021, and the US Justice Department seized 63.7 bitcoin of it on 7 June 2021. Recovery of that kind depends on investigators knowing about the payment quickly.

What it means for AI agents and non-human identities

Initial access is often a machine or dormant credential: Colonial Pipeline's attackers used an unused VPN account with no MFA, and cloud ransomware cases such as the Codefinger S3 ransomware used stolen AWS keys to encrypt data (ATT&CK T1486 Data Encrypted for Impact). Identity evidence is what lets you show the incident report what happened.
Agentic extortion is here: the JADEPUFFER agentic ransomware case involved an AI agent using harvested and default credentials to destroy a production database; the encryption key was printed once and never stored, so paying could not have restored the data. Payment reporting rules apply the same way whether the extortion was run by people or agents.
Payment rails are non-human identities too: the wallets, exchange API keys and treasury accounts used to buy and move cryptocurrency must be controlled, logged and dual-authorised, or the payment itself becomes a fraud and insider risk.
Do not automate the decision: response automation and AI assistants can draft reports and gather facts, but the decision to pay, the sanctions screen and the regulator filings need a named human approver.
Revoke before you pay: rotating compromised keys, tokens and service account passwords is containment work that reduces the attacker's leverage regardless of the payment decision. See the Ransomware Groups Guide for actor behaviour.

Compliance steps

Set the policy in advance: the board approves a ransom payment policy that states who can authorise a payment, the default position (most organisations: do not pay) and the conditions for exception, such as threat to life.
Map the obligations: for each country of operation, record whether a ban, pre-payment notice or post-payment report applies, the deadline and the portal. Revisit when the UK and CIRCIA rules are finalised.
Contact law enforcement first: report to the FBI, NCSC, ACSC or your national authority early, and keep the reference number. It supports OFAC mitigation and is required in practice by most insurers.
Run the sanctions screen: screen the actor name, known aliases and every wallet address against the SDN List and other applicable lists (UK, EU, Australia). Use threat intelligence to assess links to designated groups, and document the result and the date.
Take legal advice on licences: if a sanctions nexus is possible, stop and seek advice; an OFAC licence is unlikely to be granted.
Record the decision: keep a decision log with the options considered, recovery alternatives tested (backups, decryptors), approvers and timestamps.
File the reports: 24 hours for CIRCIA once in force, 72 hours for Australia, data protection notifications as required (see the Breach Notification Laws by Country Guide), and SARs by the financial institutions involved.
Exercise it: run a tabletop that includes the payment decision and the reports, and test that the payment approver can be reached out of hours.

Measuring it

Time from incident declaration to law enforcement contact.
Percentage of payment reports filed within the statutory deadline (target 100 per cent).
Sanctions screens completed and documented before any payment decision (target 100 per cent).
Restore time from backups in the last test, which shapes whether paying is ever necessary.
Days since the obligations map was last reviewed.

Framework mapping

Framework	Reference	Relevance
NIST CSF 2.0	GV.OC-03, RS.CO-02, RS.CO-03, RS.MA-01, RC.RP-01	Legal obligations, notifying authorities, coordinated recovery
NIST SP 800-53 Rev. 5	IR-4 Incident Handling, IR-6 Incident Reporting, IR-8 Incident Response Plan	Reporting and decision procedures
MITRE ATT&CK	T1486 Data Encrypted for Impact, T1490 Inhibit System Recovery, T1657 Financial Theft	Behaviours that drive extortion and payment pressure
CIS Controls v8.1	Control 11 Data Recovery, Control 17 Incident Response Management	Recovery capability and reporting contacts

Common failure patterns

Screening only the group name: ransomware brands change; wallets and affiliates link to designated persons. Screen addresses and document the intelligence used.
Delegating the payment to a third party and assuming the risk moves: a negotiator or insurer paying on your behalf does not remove your own exposure or reporting duty.
Missing the 72 hour Australian report because the payment was made by a parent company or an insurer: the duty also applies when you become aware a payment was made for you.
No pre-approved decision process: boards debating policy in the middle of an incident lose the time needed for screening and reporting.
Treating a decryptor as recovery: paying without verified backups and rotated credentials often leads to re-extortion or reinfection.
Waiting for the UK law to plan: public bodies and CNI operators should already plan to recover without payment, since that is the stated policy direction.

Practitioner checklist

Have a board-approved ransom payment policy with named approvers and a default position.
Keep a current map of bans, pre-payment notices and payment reports by country.
Pre-register with law enforcement and reporting portals (ACSC, CISA) and keep contact details in the runbook.
Screen actor names, aliases and wallet addresses against the SDN List and local sanctions lists before any payment.
Log every payment decision with options considered, approvers and timestamps.
Calendar the 24 hour CIRCIA and 72 hour Australian deadlines from the payment time.
Require insurers, negotiators and incident response firms to share their sanctions screening evidence.
Control crypto wallets and exchange API keys used for any payment with dual authorisation.
Rotate compromised machine credentials as part of containment, whatever the payment decision.
Check UK bill and CIRCIA final rule status quarterly and update this process.

Standards and references

Related NHI Mgmt Group resources: Ransomware Response and Recovery Guide · Ransomware Groups Guide · Ransomware Negotiation Guide · Ransomware Playbook Template · Cyber Insurance Guide. This guide summarises ransomware payment, sanctions and reporting rules as checked in October 2026 and is not legal advice.

Ransomware Payments and Sanctions Guide: OFAC, UK Payment Ban Proposals and Reporting