From crisis call to compliance record: OFAC’s ransomware advisory

The week

On October 1, 2020, the Treasury Department’s Office of Foreign Assets Control, known as OFAC, issued an advisory on the potential sanctions risks of facilitating ransomware payments. OFAC administers U.S. sanctions: the rules that forbid Americans from doing business with certain named people, groups and countries, such as those tied to terrorism, hostile governments or serious crime. The advisory reminded organizations that paying a ransom to a sanctioned person or jurisdiction could violate U.S. sanctions.

Ransomware is malicious software that scrambles files and systems and leaves a note demanding payment, usually in cryptocurrency, for the key to unlock them. Until that fall, most organizations treated the question of whether to pay as a business continuity decision, taken at 2 a.m. by executives, lawyers and an outside incident response firm on a call. The questions were how fast they could recover, what it would cost, and whether paying would actually work. The advisory added a legal question that many had not been asking.

Public bodies had already learned how costly these attacks could be. Atlanta’s city government was hit by SamSam ransomware in 2018, and Baltimore’s by a ransomware attack in 2019, and both spent weeks restoring services. Attacks on hospitals, school districts and local governments continued through 2020, alongside the strain of the pandemic.

The threat itself was changing that year. Ransomware groups had begun stealing data before encrypting it and threatening to publish it on leak sites if the victim did not pay. That “double extortion” meant a victim with good backups could still face a demand, which made payment decisions more common and harder.

The advisory was grounded in names OFAC had already put on its lists. It cited earlier designations of the developer of the Cryptolocker ransomware and of two Iran-based individuals who helped turn SamSam ransom payments into cash. It also cited the North Korean Lazarus Group, linked to WannaCry, and the Russia-based group known as Evil Corp. A payment to any of them, or to anyone acting for them, would already have been prohibited.

Two features made it bite. First, liability is strict, which means a party can be penalized even if it did not know the recipient was sanctioned. Good intentions are no defense. Second, the advisory said this applied to companies that facilitate payments as well as to victims: financial institutions, cyber insurers and digital forensics and incident response firms. The bank that wires the money, the insurer that reimburses it and the consultant who negotiates it were all on notice.

The advisory also explained how OFAC would treat requests for permission. A license is OFAC’s written authorization for a transaction that would otherwise be prohibited. OFAC said it would review license applications involving ransomware payments case by case, with a presumption of denial. Permission in advance was possible on paper and unlikely in fact.

OFAC also offered a path. It said it would consider self-reporting and cooperation with law enforcement as mitigating factors, meaning organizations that came forward and worked with the authorities would be treated more leniently. It also pointed to the existence and quality of an organization’s sanctions compliance program as a factor in any enforcement response.

The same day, the Financial Crimes Enforcement Network, or FinCEN, the Treasury bureau that collects reports of suspicious financial activity, issued an advisory to financial institutions. It described ransomware trends, red flags and expectations for reporting suspicious activity related to ransom payments.

The FinCEN advisory went into the mechanics. It described how incident response firms and cyber insurers often handle payments for victims. It noted that a firm moving funds for others may need to register as a money services business and meet anti-money laundering obligations. Its red flags included a customer with no history of cryptocurrency suddenly buying it in a hurry, and payments flowing to exchanges in high-risk jurisdictions. It asked filers to tag related reports with a specific key term so FinCEN could find them.

Neither advisory created a new rule. Both described how existing law applied to a fast-growing problem, which is why they took effect at once, without a comment period or a compliance date.

Together, the two documents turned the 2 a.m. decision into something regulators would expect to see written down.

Before October 2020, a ransom decision was usually treated as a continuity call made under pressure by executives, outside counsel and an incident response firm. The OFAC advisory did not make payment generally unlawful. It made clear that payment carries a distinct legal risk, assessed under strict liability, that has to be judged and documented, and that is best prepared for in advance.

For banks, health systems and public agencies alike, the implications fall into three parts: who carries the exposure, what must be known before any payment, and how the decision is governed. Each is easier to follow once the mechanics of a payment are clear. After the three parts, we look at the wider costs, follow one county through two versions of the same night, and close with the preparation that makes the decision manageable.

How a ransom payment actually happens

For most executives the mechanics of a ransom payment are a mystery, and that is part of the risk. A typical ransomware attack proceeds in a recognizable way. Criminals get into a network, often through a stolen password or an unpatched system facing the internet. They spread unnoticed, sometimes copying sensitive data on the way out, and then trigger encryption across as many systems as possible. A note appears with instructions for contacting them, often through a website on the hidden parts of the internet.

The victim then usually brings in a specialist incident response firm. These firms, sometimes called digital forensics and incident response or DFIR firms, investigate what happened, help restore systems and, if the victim chooses, communicate with the attackers. Negotiation can reduce the demand, confirm that the attackers actually hold a working decryption key and buy time.

How negotiation works

Negotiation follows a pattern. The response firm opens contact through the attackers’ portal or email, asks for proof that they can decrypt, usually by sending a few test files, and asks what data they claim to hold. It then bargains over price and time. Every message is a record, and every delay has a cost on the victim’s side. A victim that has not decided its own limits before negotiation starts lets the attackers and the clock set them.

Following the money

If the victim decides to pay, the payment is almost always made in cryptocurrency, a form of digital money that moves between “wallets” identified by long strings of characters rather than names. The victim, or more often an intermediary on its behalf, buys the cryptocurrency through a financial institution or exchange and sends it to the wallet address the attackers provide. If the victim has cyber insurance, the insurer may reimburse some or all of the cost, subject to the policy’s conditions.

Many hands touch the money: the victim, the response firm, a bank or money services business, possibly an exchange, and an insurer. Nobody in that chain can easily see who, in legal terms, is on the other end of the wallet, and that is where sanctions come in.

What the victim receives is uncertain. A decryption tool may be slow, buggy or incomplete, and restoring from it can take as long as rebuilding. A promise to delete stolen data cannot be verified, and the data may already have been copied. Payment buys a possibility, not a guarantee, and that uncertainty belongs in the decision.

How sanctions law reaches the payment

U.S. sanctions work by naming. OFAC publishes lists of sanctioned people, entities and jurisdictions, and Americans are generally barred from dealing with them. The best known is the Specially Designated Nationals list. Entries can include cryptocurrency wallet addresses as well as names, which gives screening tools something concrete to match.

If the criminals behind an attack are on that list, or are acting for someone who is, or are located in a sanctioned jurisdiction, then sending them money can be a sanctions violation. OFAC also treats entities owned 50 percent or more by blocked persons as blocked themselves, even if they are not named. Under strict liability, the fact that the victim did not know, and could not easily have known, does not make the problem go away.

The penalties are civil in most cases. For violations of the main sanctions statute, they can reach the greater of a per-violation maximum adjusted each year for inflation and twice the value of the transaction. Criminal penalties apply to willful violations. OFAC’s published enforcement guidelines then adjust the outcome, distinguishing egregious from non-egregious cases and reducing the base penalty substantially for voluntary self-disclosure. Those mechanics are why the advisory’s mention of self-reporting mattered.

Who carries the exposure

The advisory also named the intermediaries that commonly handle ransom payments: financial institutions and money services businesses that move funds, insurers that reimburse them, and forensic and incident response firms that negotiate and transact. Because sanctions liability is strict, a party can face penalties even if it did not know the recipient was sanctioned.

Banks, credit unions and money services businesses

For financial institutions, the FinCEN advisory issued the same day added a second layer. Banks, credit unions and money services businesses were reminded that ransomware payments, and the patterns around them, can trigger suspicious activity reporting. Those are the confidential reports institutions file with FinCEN when they see transactions that look connected to crime. A bank processing a customer’s ransom payment can face a sanctions screening question and a reporting question on the same transaction, handled by different teams.

The screening question is harder than it looks. A bank usually sees a wire to a cryptocurrency exchange, not a payment to a criminal wallet. The sanctions exposure arises one or two steps later, beyond the bank’s view. Exchanges and other virtual asset service providers that can see the destination wallet carry the screening burden most directly, and blockchain analytics tools that score wallet addresses became a standard part of their controls.

Insurers and response firms

Response firms and insurers carry their own exposure under the advisory, so the diligence they perform is designed to protect them first. A victim that relies entirely on a vendor’s sanctions conclusion should ask what that conclusion covers, what it excludes and whether the vendor will put it in writing. Relying on it is a little like relying on a home inspector hired by the seller: the inspection may be honest, but you should know whose interests it was designed to serve.

The FinCEN advisory added a regulatory point for response firms. A firm that receives a victim’s money and sends it on to attackers may be acting as a money transmitter. Depending on how the arrangement works, that can mean federal registration, an anti-money laundering program and its own reporting duties. Many firms restructured so that a registered payment provider handles the funds, which moved the obligations to a party built to carry them.

How insurers responded

Insurers had both exposure and influence. A policy that reimburses a ransom makes the insurer part of the payment chain, so insurers built their own sanctions checks into the claims process and insisted on consent before any payment. Over time many also reshaped cover, adding separate limits or co-insurance for extortion losses and tightening underwriting questions. For the policyholder, that means the insurer’s requirements can decide the timetable as much as the attackers do.

Victims as decision-makers

Hospitals, public agencies and other victims face exposure as decision-makers. They usually pay through intermediaries and often have no in-house sanctions expertise. A county or a community hospital may never have run a sanctions check before the night it needs one.

Banks and broker-dealers are in a different position when they are the victim. They already run sanctions compliance programs, with screening tools, a designated sanctions officer and procedures for blocked transactions. Their gap is usually connection: the sanctions team is not on the incident call, and the incident team does not know the sanctions team’s procedures. A health system or county has the opposite problem, with the incident muscle but no sanctions function at all.

Multinational groups have a further question. U.S. sanctions bind U.S. persons, including U.S. companies and their employees, wherever they are. Whether a foreign subsidiary is covered depends on the sanctions program involved. A group that might pay from an entity abroad needs counsel’s view on that before an incident, not during one.

What must be known before any payment

A sanctions assessment depends on attribution, the work of figuring out who is actually behind an attack. In a ransomware event, attribution is hard. Groups rename themselves, share tooling and run affiliate programs, a franchise-like arrangement in which one group supplies the ransomware and many independent criminals use it in exchange for a share of the proceeds. Payment addresses change.

How attribution is done

Victims rely on response firms and threat intelligence, the specialist research that tracks criminal groups and their methods, to judge whether a group or wallet is linked to a sanctioned party. The evidence comes from several directions. Analysts identify the ransomware strain from the encrypted files and the note. They compare the attackers’ tools, negotiation style and infrastructure with known groups. Blockchain analytics firms trace the wallet the attackers provide, and its links to wallets seen in earlier attacks or on OFAC’s list.

No single source is conclusive. A rebranded group may use a new strain name while keeping old infrastructure. An affiliate may use one group’s tooling while being someone else entirely. The output is a judgment with a confidence level, and the decision group should see it that way. A finding of “no known link” is weaker than “strong evidence of a different, unsanctioned group.”

Preparation that shapes the judgment

The quality of that judgment depends on preparation done before the incident.

• Which response firm and counsel will be engaged, and what sanctions due diligence each performs and documents.
• How the insurer’s requirements interact with the decision, including consent rights and the insurer’s own sanctions checks.
• When and how law enforcement is contacted. OFAC said it would treat prompt, complete reporting and cooperation as significant mitigating factors.
• What evidence is preserved, so the organization can later show what it knew and when.

These arrangements take weeks to set up and minutes to use. Retainers with response firms and counsel, signed before an incident, can specify the sanctions work in scope. (A retainer is a standing agreement that a firm will be available when called, with terms already negotiated.) Insurance renewals are the moment to clarify consent and reimbursement conditions. Neither conversation goes well at 2 a.m. with systems encrypted.

When the assessment finds a link

If the assessment points to a sanctioned party, the decision changes shape. Payment is prohibited unless OFAC grants a license, and the advisory said applications would face a presumption of denial. The organization’s options narrow to restoring, rebuilding or living with the loss of data, and the decision group’s job becomes managing that recovery. Counsel will also advise on whether to report the contact itself to OFAC and law enforcement. A plan that has never considered this branch will find it at the worst moment.

What to ask the response firm

Before signing a retainer, the organization should ask the firm to set out four things in writing.

• The sources it uses to attribute an attack, and how it expresses confidence in the result.
• Whether it screens wallet addresses against OFAC’s list and against analytics data, and documents the result in writing.
• Who actually moves the funds, and whether that party is registered and runs its own compliance program.
• Whether it has ever declined to facilitate a payment on sanctions grounds, and how it decided.

A firm that answers these clearly before an incident is one whose conclusions will stand up afterward.

Contacting law enforcement

Law enforcement contact is a practical step as well as a mitigating factor. The usual routes are the local FBI field office, the FBI’s internet crime complaint center, CISA and, for some financial crimes, the Secret Service. Agents may already know the group, can sometimes share technical indicators, and in some cases have decryption keys from earlier operations. Knowing in advance which office to call, and having a named contact there, saves hours. Some victims worry that contact means losing control of the response. Counsel can explain what to expect, and the benefit to the sanctions position alone usually justifies the call.

Evidence and the decision record

Evidence preservation deserves a word of its own, because it is easy to neglect in the rush to restore. It means keeping the ransom note, every message exchanged with the attackers, the wallet addresses provided, the response firm’s findings and the notes of every decision meeting, with times. It also means not wiping infected systems before the investigators have captured what they need. Months later, when a regulator, an insurer or a court asks what the organization knew, these records are the only answer that counts. An organization that cannot produce them is asking to be believed on its word.

A short template helps. One page, filled in by the decision group as it goes, should cover what was known about the attackers and what the sanctions assessment found. It should record whether and when law enforcement was contacted, what alternatives to payment were considered and why the group decided as it did. That page will be worth far more than a perfect memo written from memory a month later.

Retention matters too. Sanctions enforcement can come years after the event. The record should be kept under legal hold, with the same retention as the organization’s most sensitive legal files, and stored somewhere the next attack cannot reach.

How the decision is governed

A ransom decision touches legal, compliance, finance and operations. In health care and government it also touches patient or public safety. It tends to arrive at night or on a weekend, under severe time pressure, which is exactly when an unprepared decision is most likely to be poorly documented.

A defensible approach has four elements.

1. A pre-agreed decision group, with named deputies, that includes the general counsel or chief compliance officer.
2. Written criteria covering safety impact, recovery options, sanctions risk and law enforcement engagement.
3. A rule that no payment proceeds without a documented sanctions assessment.
4. A decision record, with rationale, written on the assumption that regulators will read it.

Running the decision meeting

The meeting itself benefits from structure. A chair runs it, a scribe keeps the decision log, and counsel advises on privilege and sanctions. Each meeting opens with what has changed since the last: restore progress, the negotiation, the sanctions assessment and any safety impact. Each closes with decisions, owners and the time of the next meeting. That rhythm keeps a multi-day event from dissolving into calls and texts that nobody records.

Privilege needs care. Many organizations engage the response firm through outside counsel so that its work supports legal advice. Courts have not always accepted that framing. In a 2020 decision involving Capital One’s 2019 breach, a federal court ordered a forensic firm’s report produced because the work was essentially business as usual. The structure of the engagement, and what the firm actually does, should be settled with counsel before an incident.

The board’s part

Boards should settle in calm conditions who has authority to approve a payment, up to what amount, and when the board itself must be consulted. That delegation, recorded in a resolution or policy, lets the decision group act at night without improvising authority. The board should also see the results of the annual exercise, and should know whether insurance terms and retainers have changed since the last one.

How the criteria differ by sector

Sector context changes the criteria. A health system weighing payment has to consider patient safety and the length of any diversion of ambulances to other hospitals. It must also run its own analysis of whether protected health information was compromised, which continues whatever it decides about payment.

A public agency may face statutory limits on spending, procurement rules that never anticipated an extortion payment, and the certainty that the decision will become public. Open records laws can reach the decision record itself, so it should be written with that reader in mind. Some states also restrict or ban payment by public bodies.

A bank or broker-dealer will be asked by its own supervisors how the decision fits its sanctions and anti-money laundering program. A credit union will be asked the same by its examiners. Each of these belongs in the criteria in advance.

Incentives in the room

Every party on the call has interests of its own. The response firm wants the engagement to succeed and may be paid more for a longer one. The insurer wants to limit the claim. Business leaders want operations back. Those interests are legitimate, but the decision group should know whose advice serves which interest. Fee arrangements tied to the size of a payment create the wrong incentive, and many organizations prefer fixed or hourly terms agreed in the retainer.

Rehearsal and proportion

Tabletop exercises test the process cheaply. A tabletop is a rehearsal around a table: the real decision-makers walk through a realistic scenario, step by step, and discover where the plan breaks. Run with the actual decision group, it quickly exposes gaps. Typical ones are an unreachable deputy, an unclear insurer requirement, a missing sanctions step, or a board chair who expects a call and is not on the list.

The governance has a cost. A slower, documented decision can lengthen downtime by hours or days, which is a real harm in a hospital. The decision group should therefore agree in advance on what evidence is sufficient, so diligence is proportionate and does not stall indefinitely.

The case for an outright ban

The strongest objection to this whole approach is that governing payments legitimizes them. Every payment funds the next attack, the argument runs, so the government should ban payments and let the market adjust. The argument has force, and some public bodies have since been barred from paying.

A blanket ban has costs that fall unevenly. A hospital with no way to recover patient records, or a small firm facing closure, would bear them first. Enforcement would push some payments underground, where nobody reports and nobody cooperates with investigators. The advisory’s approach accepts that some victims will pay and tries to make those payments visible, screened and reported. Organizations can still adopt a no-payment policy for themselves, and many should, as long as recovery capability makes that policy credible.

A legal technicality with a long reach

If the attackers turn out to be sanctioned, the organization that paid them can face a penalty on top of the ransom, the outage and the legal bills.

Money. A ransom is only part of the cost of an attack. Sanctions penalties, legal fees, investigation costs and the price of a longer outage while diligence runs all add to it. Insurers, also exposed under the advisory, have every reason to look harder at how their policyholders make these decisions, and that shapes what cover is available and on what terms.

Risk. Strict liability changes the nature of the risk. In most areas of business, a reasonable decision made in good faith is a strong defense. Here it is an incomplete one. The best an organization can do is show that it took sanctions seriously, did proportionate diligence, reported promptly and cooperated, which are exactly the things OFAC said it would weigh.

Customers, patients and residents. The people an organization serves bear the cost of downtime. A hospital that cannot admit ambulances or a county that cannot issue payments is harming its community every hour it is down. Good governance should make a sound decision quickly, without slowing it for its own sake.

Regulators and reputation. Ransom decisions tend to become public, sometimes through mandatory disclosures, sometimes through the attackers themselves, sometimes through reporters. When that happens, the first questions will be who decided, on what basis and with what checks. An organization with a clear record can answer; one without can only apologize.

Staff. The people on that 2 a.m. call are under enormous pressure. A clear process protects them as much as it protects the organization. Nobody should have to improvise a sanctions judgment, alone, on a weekend.

Parallel obligations. The ransom decision runs alongside other duties that do not wait for it. State breach notification laws, HIPAA for covered entities and their business associates, and banking regulators’ expectations for incident notice each have their own triggers and clocks. Paying does not discharge any of them, and a promise from the attackers to delete data does not settle whether a breach occurred.

Contracts. Payment decisions also touch agreements with customers, vendors and lenders. Some contracts require notice of a security incident within a set period, and some loan covenants or service agreements are affected by a prolonged outage. The decision group needs someone who knows which agreements are in play, so that a payment, or a refusal to pay, does not trigger a breach nobody anticipated.

One county, two Saturday nights

Say a county government is hit by ransomware on a Saturday night. Its permitting, payroll and emergency dispatch support systems are encrypted. The note demands payment in cryptocurrency within 72 hours.

In the unprepared version, the county administrator calls the IT director, who calls a response firm found through an internet search. Nobody is sure who has authority to approve a payment. The county attorney is on vacation, and no deputy is named. The insurer is not told for a day, and when it is, its policy turns out to require consent before any payment. The response firm says the group “is not on any list we know of,” but will not put that in writing. By Monday a payment has been made, the paper trail is a handful of text messages, and the local newspaper is asking questions the county cannot answer.

In the prepared version, the administrator opens a two-page playbook. It names a decision group, with deputies, including the county attorney’s office. A response firm is on retainer, with sanctions due diligence written into its scope. The insurer’s consent process is already understood and is triggered within the hour. Law enforcement is contacted early, as the playbook requires. The group works through written criteria: the impact on public safety, whether systems can be restored from backups, what the sanctions assessment says and what state spending rules allow. Whatever the county decides, it can show what it knew, when, and why it chose as it did.

The decision might be the same in both versions. The legal position, the public account and the county’s credibility are not.

The same night in a hospital

A county-owned hospital would face the same steps with a different weight. Patient safety would dominate the criteria: whether the emergency department can stay open, how long ambulances can be diverted before neighboring hospitals are overwhelmed, and whether clinical records can be reached through downtime tools. The HIPAA breach analysis would run in parallel. Because the hospital is public, state rules on payment and open records would apply too. The playbook is the same shape; the criteria list is longer.

The same payment, seen from the county’s bank

If the county does pay, its bank sees the transaction from the other side. On Monday morning a wire goes from the county’s account to a payment provider or exchange, larger than anything the account has sent before. The bank’s sanctions screening finds no listed name on the wire, because the wallet is two steps away. Its transaction monitoring flags the unusual payment, and an analyst who reads the news recognizes a likely ransom.

The analyst now has a suspicious activity report to consider, tagged with FinCEN’s ransomware key term, and possibly information to share with law enforcement. If the county’s own decision record exists, and the county has already contacted the FBI, the bank’s questions are answered quickly. If not, a valued public customer and its bank find themselves in an awkward exchange days after the crisis.

Recovery first, then a rehearsed process

The strongest protection is still the ability to recover without paying. Tested, isolated backups and rehearsed restoration reduce the pressure that makes payment look necessary. “Isolated” matters: backups kept on the same network as everything else are often encrypted along with it. A backup that has never been restored in a test is a hope rather than a plan.

What recovery capability takes

Recovery capability has several parts. Backups need to be immutable, meaning they cannot be altered or deleted for a set period, and held in a location with separate credentials. The identity system needs a clean rebuild plan, because attackers usually compromise it first. Critical systems need a documented restore order and a measured restore time from a real test. Each part has an owner in infrastructure or security, and each produces evidence a board can read: the date of the last full restore test and how long it took.

Insurers came to ask about the same controls. Questions about multifactor authentication, backup isolation and incident plans became standard at renewal. Good recovery capability therefore lowers the odds that payment is needed and can improve the terms of the cover that pays for everything else.

Smaller organizations and their providers

A small credit union, a rural hospital or a town government may have no backup engineer of its own. Its recovery capability lives in contracts with a managed service provider or a hosted platform. Those contracts should say what is backed up, how it is isolated, how fast it can be restored and who does the work during an attack. A provider that has never run a restore test for that client cannot promise one under pressure.

Why recovery takes longer than planned

Restore plans often assume that backups are the bottleneck. In a ransomware event they rarely are. The identity system must be rebuilt or proven clean before anything that depends on it can be trusted. Restored data must be checked for tampering. Applications must be reconnected in dependency order, and each step needs people who are also handling the investigation. A plan that measures only how fast data can be copied back will understate the outage, and with it the pressure to pay.

Measures a board can track

• The date of the last full restore test of each critical system, and the time it took.
• The share of backups that are immutable and held under separate credentials.
• The date of the last tabletop with the actual decision group, and the open actions from it.
• Whether retainers, insurance terms and the decision-group list have been reviewed in the past year.

The playbook, assembled

Beyond that, preparation looks like the county’s second Saturday night. It means a named decision group, written criteria, retainers that include sanctions work and insurance terms clarified at renewal. It also means a standing rule on law enforcement contact, a decision record template ready to fill in, and an annual tabletop with the people who would actually be on the call.

Where it goes wrong

The failures are just as consistent. Organizations treat the decision as purely operational and leave legal and compliance out until after the money has moved. They accept a vendor’s verbal assurance on sanctions without knowing what it covers, and discover their insurer’s consent requirements and exclusions at the worst possible moment. Financial institutions let sanctions screening and suspicious activity review handle the same payment without a shared case record. And with no agreed threshold for “enough evidence,” the assessment drags on while patients or residents bear the cost.

What to settle before the 2 a.m. call

Five questions test whether the preparation is real. Each should have a named owner and a dated answer.

• If we were hit tonight, who would decide whether to pay, who are their deputies, and is our general counsel or chief compliance officer among them?
• Which incident response firm and outside counsel are on retainer, and does their scope include sanctions due diligence in writing?
• What does our cyber insurance policy require before a payment, and when did we last check?
• What evidence would we need to be comfortable that a payment does not breach sanctions, and who decides that it is enough?
• When did we last restore critical systems from isolated backups in a test, and how long did it take?

How the sanctions and reporting rules apply to a particular payment is a question for the organization’s lawyers. After October 2020, a ransom payment had to be treated as a regulated transaction with a paper trail.

With hindsight

A steady tightening followed. OFAC updated the advisory in September 2021, putting more weight on prevention and on reporting to law enforcement. It said that meaningful steps to reduce the risk of extortion, such as the cybersecurity practices CISA recommends, would also count in an organization’s favor. The presumption of denial for license applications stayed in place. FinCEN updated its own advisory in November 2021.

In September 2021, OFAC sanctioned a cryptocurrency exchange, SUEX, for its role in laundering ransomware proceeds, the first action of its kind. Further designations of exchanges, mixers (services that blend many people’s cryptocurrency together to obscure where it came from) and individual ransomware actors followed. The designation of the Tornado Cash mixer in 2022 was challenged in court. After an appeals court ruled against Treasury in late 2024, Treasury removed it from the list in 2025.

Ransomware actors themselves became targets. In 2024 OFAC designated the alleged leader of the LockBit group, and it added further Evil Corp members later that year in coordination with the United Kingdom and Australia. Each new name on the list made screening of ransom payments more consequential, because the chance that a payment would touch a sanctioned party grew.

The stakes of the decision also became visible. Colonial Pipeline paid a ransom in May 2021, and the Justice Department later recovered part of it by tracing the cryptocurrency. In 2024, UnitedHealth Group’s chief executive told Congress the company had paid $22 million after the Change Healthcare attack. Each case showed that payment decisions become public and are examined in detail afterward.

The record-keeping argument grew stronger in 2024, when Congress extended the statute of limitations for civil and criminal sanctions violations from five years to ten. A ransom decision taken today can be examined a decade later, which makes a contemporaneous record more valuable still.

Reporting rules moved too, if slowly. In 2022 Congress passed the Cyber Incident Reporting for Critical Infrastructure Act. It will require covered entities to report ransom payments to CISA, the federal cybersecurity agency, within 24 hours once implementing rules take effect. CISA proposed those rules in 2024. Finalization slipped past the October 2025 statutory deadline, and as of this writing the final rule had not been published. Organizations that already document ransom decisions carefully will find that requirement easy to meet when it arrives.

Sector regulators did not wait. New York’s Department of Financial Services amended its cybersecurity regulation in 2023 to require regulated firms to report an extortion payment within 24 hours and explain within 30 days why it was necessary. The SEC’s 2023 rule on cybersecurity disclosure required public companies to disclose material incidents within four business days of determining materiality.

Some states went further than the federal government. North Carolina, in a law enacted in late 2021, and Florida, in 2022, barred state and local public entities from paying ransoms. For public bodies in those states, the 2 a.m. question about payment has a legal answer before the call begins, and the planning effort shifts entirely to recovery. Internationally, members of the Counter Ransomware Initiative, a coalition launched by the White House in 2021, stated in 2023 that their central governments should not pay ransoms.

The advisory’s core message has held. Payment is not banned across the board, but it is a compliance decision that needs process, evidence and counsel. The time to decide how you would decide is now, while it is calm. A named group, a short playbook, retainers that include sanctions work and backups you have actually tested will serve under today’s rules and under whatever comes next.