FinCEN’s ransomware analysis turned well-written SARs into threat intelligence

The week

On October 15, 2021, the government showed what banks’ suspicious activity reports can reveal when they are read together. Every bank in the United States files such reports when it sees something that looks like financial crime. Most are written by investigators, read by few people and filed away.

That day the Financial Crimes Enforcement Network, known as FinCEN, published a financial trend analysis of ransomware. FinCEN is the Treasury Department bureau that collects and analyzes the reports banks and other financial institutions file to fight money laundering. Ransomware is malicious software that locks up an organization’s computer files, usually by scrambling them with encryption, so that criminals can demand payment to unlock them. Most of those payments are made in cryptocurrency.

The report was issued under a provision of the Anti-Money Laundering Act of 2020 that requires FinCEN to publish threat patterns and trends drawn from the reports it receives. It drew on suspicious activity reports, or SARs, filed under the Bank Secrecy Act. FinCEN counted 635 ransomware-related SARs filed in the first half of 2021, describing about $590 million in suspicious activity. That was more than the roughly $416 million reported for all of 2020, in only six months. FinCEN was careful to say the data covered only what institutions had reported, not every attack or payment.

The detail is where the argument of this article starts. FinCEN said it reviewed each SAR by hand to strip out unrelated amounts and extract technical indicators. It identified 68 ransomware variants in the filings, with REvil/Sodinokibi, Conti, DarkSide, Avaddon and Phobos reported most often. A variant is a particular strain of ransomware, often associated with a specific criminal group. Ninety SARs did not name a variant at all. Bitcoin was the most common payment method, and a small number of filings described demands for Monero, a cryptocurrency designed to be harder to trace.

FinCEN found 177 unique wallet addresses tied to the ten most commonly reported variants. A wallet address is a string of letters and numbers that identifies where cryptocurrency is sent, a bit like an account number, and it can be traced. Using commercial blockchain analytics, FinCEN followed those addresses and associated clusters to about $5.2 billion in outgoing bitcoin transactions potentially tied to ransomware. It also noted, in a footnote, that most of the SARs it examined did not report the attacker’s wallet address.

Who filed mattered too. About 63 percent of the ransomware SARs came from digital forensic and incident response firms, the companies that negotiate with attackers and make payments on victims’ behalf. Cryptocurrency exchanges filed about 19 percent and banks and other depository institutions about 17 percent. Of the 458 transactions reported, 335 SARs used the key term FinCEN had asked for in its October 2020 advisory. Some of them got the term slightly wrong, which FinCEN flagged as a typographical error.

The report ended with practical recommendations. Institutions should feed indicators of compromise from threat sources into their detection systems and contact law enforcement immediately about ransomware activity. They should contact OFAC if an attacker might have a sanctions nexus. They should report indicators in the SAR form, along with variant names, the cryptocurrencies demanded, wallet addresses and transaction hashes. FinCEN also noted that attackers often charged a surcharge of 10 to 20 percent for paying in bitcoin rather than Monero. The report followed FinCEN’s first government-wide anti-money laundering priorities, issued on June 30, 2021, which named cybercrime as a priority and singled out ransomware.

The timing was not an accident of the calendar. On September 21, 2021, Treasury’s Office of Foreign Assets Control updated its advisory on the sanctions risks of facilitating ransom payments. On October 13 and 14, the White House convened more than 30 countries for a virtual meeting of what became the Counter Ransomware Initiative. On October 15 itself, OFAC also issued sanctions compliance guidance for the virtual currency industry. FinCEN followed with an updated ransomware advisory on November 8, 2021, which asked filers to use specific SAR fields for cyber indicators.

Suspicious activity reports are usually discussed as an obligation: a filing due within set deadlines, with a narrative that will satisfy an examiner. Compliance teams measure them by timeliness and defensibility. FinCEN’s October 2021 analysis used them as something else. It aggregated hundreds of filings into a picture of who was being paid, how and through which channels.

That only worked to the extent that filers had written their reports in a form a machine could join. The same choice decides how useful the data is inside the institution that wrote it. We start with the vocabulary. Then come FinCEN’s side of the story, what made the aggregate useful and what limited it, and the institution’s side: what it controls in its own records, how a case moves through a bank, why the design choice matters, and the fixes.

Ransoms, wallets, reports and case files

Ransomware. Ransomware gets into an organization’s systems, often through a phishing email or a weakly protected remote access point, and scrambles its files so they cannot be read. The criminals then demand payment for the key, and often threaten to publish stolen data as well. FinCEN’s 2021 advisory called this double extortion.

Cryptocurrency and wallet addresses. Ransom demands are usually paid in cryptocurrency. Cryptocurrency moves between wallet addresses, long strings of characters that act like account numbers. Every bitcoin transfer is recorded on a public ledger called a blockchain, and each transfer has its own identifier, called a transaction hash, a bit like a receipt number. Criminals can hide who controls an address, but the address itself and its movements can be followed. That is why recording the exact address matters so much.

Suspicious activity reports. Under the Bank Secrecy Act, banks, credit unions, broker-dealers, money transmitters, cryptocurrency exchanges and other financial institutions must file a SAR when they see activity that may involve crime. For banks, the general threshold is $5,000; for money services businesses it is generally $2,000. A SAR has structured parts, boxes for amounts, dates and parties, and a free-text narrative where the investigator explains what happened. SARs are confidential by law. Even telling a customer that a SAR has been filed is prohibited outside narrow channels.

Case management systems. Inside a bank, investigators work alerts and cases in a case management system, software that records what was flagged, what was found and what was decided. The SAR is often produced from that record. How that system is designed, which fields it has and how they are filled in, determines much of what later analysis can do.

How a ransom payment crosses the financial system

FinCEN’s advisories described the usual path. A victim receives a demand. It wires money, sends an automated clearinghouse payment or uses a card to buy cryptocurrency at an exchange. The victim, or a response firm acting for it, then sends the cryptocurrency to the address the attacker specified. The attacker moves the funds through further addresses, mixing services or exchanges with weak controls, and eventually converts them to cash.

Each regulated institution along that path may notice and file. The victim’s bank sees an unusual wire to an exchange. The incident response firm, if it handles the payment, may be acting as a money transmitter with its own SAR duties. The exchange sees the purchase and the outbound transfer. Whether those filings can be stitched together depends on what each investigator typed.

Who files, and what each one sees

Each type of filer sees a different slice. A bank or credit union sees fiat money leaving a customer’s account, usually with a destination exchange and an amount, and sometimes the customer’s explanation. It rarely sees the attacker’s wallet address unless the customer volunteers it. A cryptocurrency exchange sees the on-chain side: the purchase, the destination address and the transaction hash. An incident response firm sees the most: the ransom note, the variant, the negotiation and the final payment details.

That division explains a striking feature of the 2021 data. Incident response firms, a small number of them, filed most of the ransomware SARs. Banks filed a minority. A bank’s best contribution is therefore the link between a named customer and a payment route, recorded consistently enough to match the richer filings from other parties.

What made the aggregate useful

The analysis depended on specific, structured details. Wallet addresses, variant names, transaction hashes and dates can be matched across reports from different institutions. A single bank sees one customer wiring funds to an exchange. FinCEN, with reports from many filers, could see the same addresses recurring, the same intermediaries and the rough scale of payments. FinCEN’s October 2020 advisory had asked for exactly these indicators, and the October 2021 analysis was the first visible return on that request.

Overlap and deduplication

The second ingredient was overlap. A ransom payment often touches several regulated parties: the victim’s bank, a negotiation or incident response firm that makes the payment, and the exchange that receives it. Each may file. Linked properly, overlapping reports give a fuller view than any one of them. They also help separate one large payment reported three times from three separate payments.

Deduplication is harder than it sounds. Three reports of the same payment may give slightly different amounts, because one records the dollar wire, one the bitcoin purchase and one the value at the time of transfer. Dates differ by a day or two. Only a shared identifier, such as the destination address or the transaction hash, lets an analyst say with confidence that the three describe one event.

Key terms and consistent names

Linking works only if each filer uses identifiers consistently. That means the full wallet address rather than a truncated one, and the variant’s common name rather than an internal nickname. A wallet address with a few characters missing is, for a computer, a different address. A variant called by three different names looks like three different gangs.

The advisory key term served the same purpose at a coarser level. A short code in a designated field let FinCEN pull ransomware filings out of millions of SARs without reading every narrative. Most of the relevant filings in early 2021 used it. Some used a slightly wrong version, which a human reviewer could spot but a simple search would miss. The difference between a useful filing and a useless one can be a few seconds of care.

From addresses to clusters

The wallet addresses that filers did supply had outsized value. Blockchain analytics firms group addresses into clusters believed to be controlled by the same party, using patterns in how funds move. One address from a SAR can therefore open up a much larger cluster. FinCEN’s 177 addresses connected, through commercial tools, to roughly 423,000 addresses associated with the same variants. That is how a modest number of good filings produced a picture of flows worth billions.

What the aggregate gave back

The analysis also returned something to filers. It described laundering patterns: cashing out at foreign exchanges with weak controls, converting between cryptocurrencies to break the trail, and using mixing services and decentralized exchanges. Each pattern can become a monitoring rule or an investigator prompt. A bank whose customer buys cryptocurrency and immediately sends it to an exchange in a high-risk jurisdiction now had a documented typology to compare against.

This is the feedback loop that makes structured reporting worth the effort. Filers supply identifiers, FinCEN aggregates them, and the published typologies improve the next round of detection. The loop is slow, measured in months, but it is one of the few channels through which a community bank learns what a national view of the same crime looks like.

What limited it

SAR data reflects what institutions noticed and chose to report. A rise in filings can mean more attacks, better detection, or more attention after an advisory. FinCEN said explicitly that its 2021 increase might reflect both more ransomware and better detection and reporting. It described its figures as reported suspicious activity, not a census of ransom payments, and that caution matters for anyone citing them. Payments made outside the regulated system, or by victims whose banks did not recognize the pattern, never appear.

Timing and lookbacks

Timing is a further constraint. A SAR is generally due within 30 days of initial detection, and analysis of a half-year of filings takes months more. Some SARs are lookbacks, reporting payments from earlier periods once an institution reviews its history. FinCEN noted that many filings in January 2021 were of this kind. Lookbacks improve completeness but blur trends, since a spike in filings may reflect a review project rather than a spike in attacks.

By the time an aggregate is published, the groups it describes may have rebranded or dispersed. The aggregate is therefore better at showing structure, such as which exchanges and intermediaries recur, than at giving early warning about a live campaign. Institutions that want early warning need their own internal view, built from the same fields and refreshed daily rather than twice a year.

Narrative quality

Narrative quality was the other limit. Much of a SAR’s value is in free text, and free text aggregates poorly. A narrative that says “customer sent funds related to a cyber incident” contributes almost nothing. One that names the variant, gives the address and amount, and states whether the payment went through a third-party negotiator contributes a lot. Investigators are rarely trained to write for aggregation. Their quality reviews tend to check whether the filing is defensible to an examiner, not whether it is useful to an analyst.

FinCEN’s own method shows the cost. Its analysts reviewed each ransomware SAR by hand to extract amounts and indicators. That is feasible for a few hundred filings on one topic. It does not scale to every typology across millions of reports, which is why structured capture at the source matters.

Medical notes behave the same way. Suppose a thousand doctors each see a patient with an unusual fever. If half write “patient unwell” and the rest use their own shorthand, a public health team cannot spot an outbreak. If they all record the same few facts in the same way, the pattern jumps out.

Attacker countermeasures

Attackers adapt as well. FinCEN reported that ransomware actors avoided reusing wallet addresses, layered funds through many addresses and sometimes demanded Monero, offering a discount or imposing a surcharge on bitcoin. Each of these reduces the value of a single address. They do not eliminate it. A fresh address still links to a cluster, a negotiator, an exchange and a date, and those links remain the most reliable way to connect one incident to another.

What an institution controls in its own records

The structured details that made FinCEN’s analysis possible are just as useful inside the bank. An institution that captures wallet addresses, variant names and counterparties in discrete fields can search its own history when a new advisory arrives. It can link a new alert to an earlier case. It can tell its board how often customers have paid ransoms, through which channels, and whether any of its commercial clients are repeat victims. That last point matters for credit risk as well as fraud, since a business hit twice is a weaker borrower.

The data model

Getting there is a data-model change, about the shape of the forms investigators fill in rather than about buying clever software. Case management systems need fields for cyber indicators, with validation, so an address is stored in full and in the right format. Bitcoin addresses follow a few defined formats with built-in checksums, so software can reject a mistyped one immediately.

Investigators need a short controlled vocabulary for variants and payment routes, meaning an agreed pick-list of names. The financial intelligence unit should maintain it and update it when advisories change. Investigation templates should mirror the indicators regulators have asked for, so details are captured once and flow to both the filing and the internal record.

Aligning with the SAR form

The SAR form itself has structured slots. FinCEN’s November 2021 advisory asked filers to select the cyber event category, add the advisory key term in the note to FinCEN, and put technical indicators in the form’s structured cyber indicator fields. Those fields cover network indicators such as suspicious IP addresses, domains, email addresses and file hashes, with an “other” option. FinCEN also asked for virtual currency addresses and transaction hashes.

An internal case system that captures the same items in matching fields can populate the form automatically. That removes retyping, the most common source of truncated or mistyped addresses. It also means the internal record and the filing never disagree, which helps when law enforcement asks a follow-up question months later.

Getting the address in the first place

A field is useless if nobody collects the fact. Banks rarely see the attacker’s address on their own; the customer or its response firm has it. Front-line staff who take the customer’s call are therefore the first link. A short script helps: ask whether the payment relates to a ransomware incident, which response firm is involved, and what destination address and variant the ransom note gives. The relationship manager records the answers or passes them to the investigator the same day.

Customers are often willing to share in the moment, because they want the payment to go through and want help. Weeks later, during an investigation, the details are harder to recover. Capturing them at the first conversation costs minutes and saves the investigator hours.

Confidentiality and access

Two constraints shape the design. SAR information is confidential by law, and even its existence cannot be disclosed outside narrow channels. Internal reuse therefore needs role-based access, where only people in specific roles can see the data, along with logging and a clear purpose, reviewed with counsel.

A practical pattern separates the indicator from the filing. A wallet address or variant name, stored as an indicator linked to a case, can be shared with security staff without disclosing whether a SAR was filed. The case record and the SAR remain restricted. Counsel should approve where that line falls.

Security and financial crime

The second constraint is organizational. Indicators of compromise, the technical traces an attack leaves behind, usually belong to the security team, while payment details belong to financial crime. When a customer, or the institution itself, is extorted, each team holds half the case. A standing exchange between the two, with agreed fields and a named contact on each side, closes that gap without exposing SAR content beyond those entitled to see it.

Differences by institution

The right design varies by institution. A large bank typically has a financial intelligence unit, its own case management platform and data engineers who can add fields and build searches. A community bank or credit union usually runs case management supplied by its core processor or a specialist vendor. Adding a field may need a vendor change request, and the institution may share a template with hundreds of others. That makes the vendor’s design choices decisive, and it is a reason to raise the issue through user groups rather than alone.

A broker-dealer or wealth manager sees ransom payments less often, but its clients include businesses and individuals who may be extorted. It files SARs under the same Bank Secrecy Act framework and benefits from the same fields. A cryptocurrency exchange already holds rich on-chain data and usually uses blockchain analytics tools. Its challenge is linking that data to customer identity and to the variant, which often comes only from the customer or a response firm.

A hypothetical example shows the payoff. A manufacturing client calls its relationship manager at a regional bank: it has been hit by ransomware and needs to wire funds to a cryptocurrency exchange today. The payments team processes the wire. A financial crime investigator later opens a case. If the case system has a validated field for the wallet address and a pick-list for the variant, the investigator records both in a minute. Six months later, a new advisory names that variant. The bank runs a search, finds the client, and its credit team learns the client has been extorted before. Without those fields, the same answer would require someone to read hundreds of narratives, and nobody would.

How a ransomware case moves through a bank

The design choices bite at specific points in a typical case. The details vary by institution, but the outline is common.

Signal and triage

It begins with a signal. Sometimes the customer tells the bank directly. Sometimes an automated monitoring system flags a large, first-time wire to a cryptocurrency exchange. Sometimes a payment comes in the other direction, from an exchange or a negotiator, and the bank wonders why. FinCEN’s advisories listed red flags of this kind, such as a customer with little cryptocurrency knowledge suddenly buying a large amount in a hurry.

An analyst triages the alert, deciding quickly whether it needs a closer look. FinCEN said in its November 2021 advisory that it treats suspicious transactions involving ransomware attacks as situations requiring immediate attention. Institutions reporting a recent or ongoing attack were asked to call FinCEN’s hotline before filing. That pushes the bank to capture key facts early, while the payment may still be traceable.

Investigation and the fork

If the alert becomes a case, an investigator gathers what the bank knows: account history, the customer’s explanation, the destination of the funds. Where the customer has disclosed a ransomware attack, the investigator may have the variant name, the wallet address from the ransom note, and the name of any incident response firm involved.

The case then reaches a fork. If the case system offers a field for each of those facts, the investigator fills them in, and the system checks the format. If it does not, the facts go into a running narrative, written under time pressure and in the investigator’s own words. Both routes can produce an acceptable SAR. Only one produces data the bank can search later.

Review, filing and afterward

The case then goes to a reviewer, who checks that the decision to file is sound and the narrative is clear. The SAR is filed, and the case is closed. The bank must keep the SAR and its supporting documents for five years. In many banks, nobody looks at it again unless an examiner samples it or law enforcement asks a follow-up question. If new facts emerge, the advisory asked for an amended filing, which is easier to produce when the original facts are in fields.

Sanctions screening before the wire

One check belongs before the payment leaves. OFAC’s updated advisory of September 2021 reminded companies that facilitating a ransom payment to a sanctioned person can violate sanctions rules. Since 2018, OFAC has listed digital currency addresses in some entries on its sanctions list. A bank that captures the destination address before sending the wire can screen it, along with the destination exchange, against that list.

Screening does not settle every question. An unlisted address can still belong to a sanctioned group, and blockchain analytics may show links the list does not. The advisory said OFAC would weigh a victim’s prompt reporting to law enforcement and its cooperation as mitigating factors. The bank’s role is to screen what it can and to make sure the customer understands the issue. Counsel should be involved in any case with a possible sanctions nexus.

The parallel security case

If the bank itself was the target, or if the customer’s attack touched the bank’s systems, the security team runs a parallel investigation. It collects its own evidence: suspicious internet addresses, malicious files, the email that started it all. That evidence lives in different software, under different rules, managed by people who may never have spoken to the financial crime investigator working the same incident.

The flow meets deadlines and satisfies reviewers, so it is compliant. The problem is that it treats each case as a finished piece of paperwork rather than as a data point that might matter later. The changes in the previous section add a few fields, a pick-list and a standing conversation, so that the same work leaves a reusable trail.

Sharing with peers

The case can also reach other institutions lawfully. Section 314(b) of the USA PATRIOT Act gives financial institutions a safe harbor to share information with each other about suspected money laundering and related crimes, after registering with FinCEN. FinCEN’s November 2021 advisory reminded institutions that extortion and computer fraud fall within the crimes covered. A bank that has recorded a destination address cleanly can ask a peer, or an exchange, whether it has seen the same address. A bank that buried the address in narrative text has nothing to ask about.

Why the design choice matters

This is a management issue rather than compliance housekeeping, for four reasons.

Cost. Banks already spend heavily on investigators and filings. Capturing the same facts in a reusable shape adds little to that cost and turns a sunk expense into an asset.

Risk visibility. A bank that can count how many of its clients have paid ransoms, and through which channels, understands a slice of its credit and operational risk that is otherwise invisible.

Regulators. FinCEN explicitly asked for these indicators. An institution whose filings supply them in usable form is meeting the spirit of the request as well as the deadline. The same advisory reminded filers that SARs must be complete and accurate and include all relevant information available, cyber information included.

The institution’s own defense. Banks are ransomware targets too. The same fields and the same link between security and financial crime teams help when the bank itself is the victim.

What credit and relationship teams need

The credit point deserves care. A commercial client that pays a ransom has suffered an operating loss, possibly a data breach with legal costs, and sometimes lasting disruption. Those facts bear on its ability to repay. A relationship manager who learns about the attack informally may never tell the credit team, and the financial crime record is confidential.

The workable design separates the business fact from the SAR. The customer’s disclosure that it suffered a ransomware attack is ordinary customer information, which the relationship team can record and share with credit. The SAR and its contents stay within the restricted group. Counsel should confirm the boundary, but most banks can give credit teams the business fact without touching SAR confidentiality. Without a deliberate process, that fact tends to stay in one person’s inbox.

The case against

The strongest counter-argument is that ransomware cases are a small share of any bank’s SAR volume. Building fields for one typology looks like over-engineering, especially for a community bank whose investigators handle a handful of such cases a year. Analytics firms and law enforcement, the argument goes, are better placed to do the joining.

There is force in this. A small institution should not build a bespoke ransomware module. But the design principle applies across typologies: identifiers that can be matched belong in fields, not prose. Elder fraud, business email compromise and scams all have their own identifiers, such as account numbers, email addresses and phone numbers. A case system built to capture identifiers well serves all of them. Ransomware simply made the point vividly in 2021.

Data for analytics and models

Structured fields also matter for the analytics banks increasingly run on their own data. A model that scores alerts, or links cases to each other, needs features it can rely on. A validated address field is a clean feature. An address that must be extracted from free text by pattern matching or language models introduces errors, and those errors are hard to see. Model risk management expects banks to understand their data inputs. Inputs captured in fields are far easier to validate than inputs inferred from prose.

The same holds for reporting to the board. A count of ransom-related cases by quarter, variant and payment route is a simple query on structured data. On narrative data it becomes a manual review project, repeated each time someone asks.

Trade-offs in the design

Structured fields carry costs. Every mandatory field adds time to an investigation, and investigators under volume pressure will fill fields with placeholders if forced. Pick-lists go stale when new variants appear, and an out-of-date list pushes investigators toward “other.” Validation rules can block a legitimate entry in an unusual format.

The answer is restraint. A handful of optional but validated fields, reviewed in quality checks, works better than many mandatory ones. The pick-list needs a named owner and a quick route to add entries. The measure of success is whether searches return answers, not whether every field is filled.

Fields, pick-lists and a standing conversation

The fixes are modest and concrete:

• Case systems have validated fields for wallet addresses, variant names, transaction hashes and payment intermediaries.
• A short, maintained pick-list of variant names and payment routes, updated when advisories change.
• Templates that mirror regulators’ requested indicators and the SAR form’s cyber fields, so details are entered once.
• SAR quality reviews that score usefulness for aggregation as well as defensibility to an examiner.
• A named contact in security and in financial crime, with agreed fields they exchange, under access controls reviewed with counsel.

The usual failures:

• Burying key identifiers in narrative text where they cannot be searched.
• Truncating wallet addresses or using internal nicknames for variants.
• Treating every new advisory as a reading exercise rather than a query against existing records.
• Keeping security and financial crime findings in separate silos when the same incident spans both.
• Citing aggregate SAR figures as if they were a full count of ransom payments.

Owners, sequence and measures

The BSA officer owns the templates and quality standards. The financial intelligence unit owns the pick-list. Technology owns the fields and validation, often through a vendor. The CISO’s team owns the indicator exchange. Counsel approves the access model. Internal audit tests the result.

A sensible sequence starts with the five or six fields that matter most, then a one-quarter pilot on ransomware and business email compromise cases. Quality review criteria come next, then the security exchange. Useful measures include the share of relevant cases with a validated address and the time taken to answer a new advisory from existing records. A third is the number of 314(b) requests made possible because identifiers were captured.

Working with vendors

For institutions that rely on vendor case management, the path runs through the vendor. Many vendors already offer configurable custom fields; the work is agreeing what to configure and enforcing its use. Where the platform is shared across many clients, a user group can ask for standard cyber indicator fields that map to the SAR form. That benefits every client and, through better filings, the wider system. Contract renewals are a natural moment to ask for field validation and export of structured indicators.

Testing your own records

• If a regulator published a new ransomware advisory tomorrow, could we say by the end of that week how many of our customers paid, to which addresses and through which intermediaries?
• Do our case management forms have dedicated, validated fields for wallet addresses and ransomware variants, or is that information buried in free text?
• Do our SAR quality reviews check whether a filing would be useful to an analyst, or only whether it would satisfy an examiner?
• When one of our commercial clients pays a ransom, does our credit team find out?
• How do our security and financial crime teams share what they know about an extortion case, and has counsel reviewed the access rules?

Behind all five is a smaller question that is easy to skip: who maintains the list of variant names investigators use, and when it was last updated. The reports are already being written. What matters is whether they are written in a way that lets the institution, and the wider system, learn from them.

With hindsight

FinCEN continued the series. A second analysis, published on November 1, 2022, put ransomware-related activity reported in Bank Secrecy Act filings for 2021 at close to $1.2 billion. It found that about three-quarters of the incidents reported in the second half of 2021 involved variants that appeared to be connected to actors in Russia. That figure is a reminder of the caution in the original analysis: these numbers measure what institutions noticed and reported, and changes in reporting habits move them as much as changes in crime.

The regulatory pressure on payment channels grew in parallel. Treasury had designated a virtual currency exchange, SUEX, in September 2021 for facilitating ransomware proceeds, and another, Chatex, on the day of the November 2021 advisory. In March 2022, Congress passed the Cyber Incident Reporting for Critical Infrastructure Act. Once CISA’s implementing rule takes effect, it will require covered critical infrastructure entities to report ransom payments to CISA within 24 hours. That will create a second, non-bank stream of payment data.

Banks’ own reporting duties also changed. In November 2021, the federal banking agencies adopted a rule requiring banks to notify their primary regulator of significant computer-security incidents within 36 hours, with compliance from May 2022. It did not change SAR rules, but it pushed security and compliance teams in banks to coordinate on incident facts, which is the same link this article argues for.

Law enforcement disrupted several of the largest groups. The FBI took down the Hive ransomware operation’s infrastructure in January 2023. An international operation disrupted LockBit in February 2024. Blockchain analytics firms, which trace cryptocurrency movements across public ledgers, published estimates showing ransomware payments peaking in 2023 and then falling by about a third in 2024. They attributed the decline to more victims refusing to pay and to those law enforcement actions. The fact that bank reports and blockchain tracing told broadly consistent stories strengthened confidence in both.

The policy debate over payment itself moved too. The Counter Ransomware Initiative, which grew out of the October 2021 meeting, continued to meet. In late 2023 its members issued a statement that their central governments should not pay ransoms. Private victims remained free to decide for themselves, subject to sanctions law.

The core finding of October 2021 held. The financial system’s reporting data is one of the few sources that sees payments directly, and its value depends on what filers record. FinCEN’s own footnote, that most of the SARs it examined lacked the attacker’s wallet address, turned out to be the most durable line in the report. A wallet address typed in full in a dedicated field is worth far more than a paragraph of description.

Structured cyber fields in case management systems have become more common at larger institutions, and joint work between fraud, anti-money laundering and security teams is now a standard expectation. Smaller institutions still vary widely, largely because they depend on vendor templates. What we would revise is the bank-centered framing. The 2021 data showed that incident response firms and exchanges supplied most of the payment detail. A bank’s most useful contribution is clean linkage between its customer and the payment route, which the richer filings from others can then complete.

The broader matter is data design. Compliance work produces information whether or not anyone plans to use it. Deciding up front what shape that information takes, which fields, which names, which checks, costs little. It determines whether the information becomes intelligence or simply a record that a deadline was met.