Guides
Paying a ransom: sanctions risk and reporting rules
No federal law bans a business from paying a ransom, but OFAC sanctions liability is strict. What the rules say, how payments are screened and who must be told.
No federal law prohibits a private U.S. business from paying a ransom, but a payment that reaches a sanctioned person or an embargoed jurisdiction can violate U.S. sanctions law, and the Treasury Department's Office of Foreign Assets Control (OFAC) can penalize it even if you did not know. The government strongly discourages paying, and a cyber insurer will not fund a payment until counsel has documented a sanctions check and the insurer has consented. Separate reporting rules may apply depending on your industry, and one federal regime is still waiting on its final rule.
What OFAC's advisory says
OFAC's Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (September 21, 2021) is the main guidance. The advisory itself says it is explanatory and does not have the force of law; the binding rules are the sanctions statutes and regulations behind it. Its main points:
- Who is exposed. U.S. persons are generally barred from dealing, directly or indirectly, with people on the Specially Designated Nationals and Blocked Persons (SDN) list, other blocked persons, and comprehensively embargoed jurisdictions. The advisory names companies that facilitate payments for victims, including financial institutions, cyber insurance firms, and forensic and incident response firms. A victim who pays is itself a U.S. person subject to the same prohibitions.
- Strict liability. OFAC may impose civil penalties on a strict liability basis, meaning a person can be liable without knowing or having reason to know the transaction was prohibited.
- Mitigating factors. OFAC says a meaningful cybersecurity program before the attack, such as offline backups, incident response plans, training and authentication controls, is a significant mitigating factor. So is a complete, self-initiated report to law enforcement or CISA as soon as possible after discovery, and ongoing cooperation. OFAC says it is more likely to resolve apparent violations with a non-public response, such as a cautionary letter, when these steps were taken.
- Licenses. License applications for ransomware payments are reviewed case by case with a presumption of denial.
- Where to report. OFAC encourages reports to CISA, the local FBI field office, the FBI's Internet Crime Complaint Center (IC3) or the Secret Service, and says victims should contact OFAC if they suspect a sanctions connection.
The same document explains why the controls in MFA, EDR and backups: the controls cyber insurers now require matter twice: they lower the chance of an attack and they count in your favor if a payment goes wrong.
What the penalties are
OFAC's Sanctions Penalties Regulations, published in the Federal Register on September 25, 2026 (31 CFR 505.401), restate the penalties under the International Emergency Economic Powers Act (IEEPA). The maximum civil penalty is the greater of $377,700 or twice the value of the transaction. Willful violations can be prosecuted, with fines up to $1 million and, for individuals, up to 20 years in prison. OFAC halves base penalties when it learns of a violation through a voluntary self-disclosure. Those amounts are adjusted for inflation over time, so confirm the current figure with counsel.
Whether insurance would pay such a penalty is a separate question; fines and penalties are often uninsurable by law or excluded by policy wording. See are fines, penalties and punitive damages insurable?.
Sanctions are not hypothetical
Treasury keeps adding ransomware-related names. On July 13, 2026, Treasury sanctioned a VPN provider that served ransomware groups, its administrator and a seller of tools that disguise malware. The 2021 advisory recounts earlier designations, among them Evil Corp, the developer of Cryptolocker, and the SUEX virtual currency exchange. The SDN list changes, so a check done at the start of an incident may be stale by the time of payment. OFAC publishes a free Sanctions List Search tool, and incident response firms typically run blockchain analysis on the criminals' wallet addresses as well.
How insurers and counsel handle a payment decision
The step order varies, but a disciplined process looks like this:
- Counsel directs the work. A breach coach (privacy attorney) retains the forensic firm and negotiator so the analysis is documented under privilege.
- Identify the attacker. Forensics matches the ransom note, malware and tactics against known groups. Attribution is often imperfect, because groups rebrand and affiliates change.
- Screen the group and wallet. The team checks the group's known identities, the payment address, and any link to a designated person or embargoed country.
- Consider alternatives. Can systems be restored from backups? Is there a decryptor? Has law enforcement released one? What does the stolen data include?
- Record the decision. The file should show who decided, on what information, and why.
- Insurer consent. The policy usually conditions payment on prior written consent.
- Pay through a specialist and report. Payments go through an experienced vendor, and the required notices follow.
A payment also does not end the problem. Coveware, an incident response firm, said in its Q2 2026 report that it has seen cases where promised data deletion did not happen after payment. The duty to notify affected people under data breach notification laws and what they cost continues whether or not you pay.
What the policy says
A cyber policy's cyber extortion coverage typically pays ransom "where insurable by law," and subject to conditions: the insurer's prior consent, use of its approved negotiator, a sanctions check, and in many forms notice to law enforcement. Look also for a sanctions clause that suspends coverage when payment would breach sanctions law (sanctions clauses in insurance policies). Two practical consequences follow:
- The policy never obliges you to pay, and the insurer is not obliged to fund a payment that counsel thinks is unlawful. Decide with counsel, not on the clock the criminals set.
- A ransomware sublimit or coinsurance may cap the payment well below your policy limit (ransomware sublimits and coinsurance in cyber policies). A separate kidnap, ransom and extortion policy is a different product with its own wording, and some forms limit cyber-driven demands; see kidnap, ransom and extortion insurance.
Reporting rules by audience
| Audience | Rule | Status as of October 2026 |
|---|---|---|
| Any victim | OFAC and the FBI encourage prompt reports to CISA, the FBI or the Secret Service; OFAC treats this as mitigating | Voluntary, but strongly encouraged |
| Banks, money transmitters and similar | Suspicious activity report (SAR) rules apply; FinCEN's advisory FIN-2021-A004 (November 8, 2021) asks filers to flag ransomware SARs with a key term, and says forensic firms or insurers that move payments may be money transmitters depending on the facts | In force for financial institutions |
| Entities licensed by New York's DFS | 23 NYCRR 500.17(c): notice within 24 hours of an extortion payment, and within 30 days a written description of why payment was necessary, the alternatives considered and the OFAC diligence performed | In force |
| Critical infrastructure "covered entities" | CIRCIA: 72 hours for a covered cyber incident, 24 hours for a ransom payment | Not required until CISA's final rule takes effect; CISA's page says it continues to work on the rule |
| Public companies | Form 8-K disclosure of material cyber incidents (The SEC's cyber incident disclosure rules) | In force |
| State and local governments | North Carolina and Florida bar such bodies from paying; other states restrict or are considering it | Does not apply to private businesses |
For CIRCIA, check CISA's own CIRCIA page for the final rule before relying on any date. The North Carolina and Florida laws are covered by Hunton Andrews Kurth summaries of North Carolina and Florida; see also North Carolina and Florida.
A hypothetical decision
Say a 70-person manufacturer's backups are corrupted and production is down. The negotiator reports that the group's wallet has no match on the SDN list, but the group is new and its links to older, sanctioned crews are uncertain. Counsel advises that the risk is real but not clearly prohibited, the insurer consents in writing to a payment up to the sublimit, and the company decides based on a documented comparison of downtime cost with the demand. The company also reports to the FBI. If OFAC later asked questions, the file would show screening, consent, reporting and the security measures already in place. This is an illustration, not a prediction; sanctions advice depends on facts and belongs to counsel.
Key takeaways
- A private U.S. business is not barred by federal law from paying a ransom, but sanctions liability is strict and can reach victims, insurers and incident response firms.
- Prompt reporting to law enforcement and a documented sanctions check are what OFAC treats as mitigating, so do both before paying anything.
- Cyber policies pay extortion "where insurable by law," with consent, a sanctions check and often law enforcement notice. Read the sanctions clause and the ransomware sublimit.
- Reporting duties vary: New York DFS licensees have a 24-hour payment notice, CIRCIA's 24-hour ransom payment report awaits a final rule, and public companies have SEC rules.
- Paying does not guarantee deletion of stolen data or remove notification duties.