UK BOARDROOM BRIEFING / RANSOMWARE
Ransomware payments
and sanctions.
When recovery is urgent,
legal judgement still matters.
A practical guide to the decisions, reporting routes and sanctions questions that belong in your response.
UNDER PRESSURE
Do not let the attacker’s deadline become your decision process.
THE ESSENTIAL POINT
A ransom demand is not a recovery plan.
An attacker may present payment as the quickest way to restore operations. A leadership team still needs to establish what has happened, what recovery options exist and which legal constraints apply. Those decisions need evidence, clear ownership and an incident record.
The UK government does not condone ransom payments. The NCSC’s payment guidance also warns that payment does not guarantee recovery. Keep restoration work moving while the response team assesses the wider implications.
IN THIS BRIEFING
PRIMARY RESOURCE
Start with the official OFSI guidance.
Financial sanctions guidance for ransomware
Updated by OFSI on 28 January 2026
THE RESPONSE BRIEF
Four priorities for the response team.
Work through these alongside technical containment and recovery. Involve the people authorised to make operational, legal and financial decisions; an attacker’s demand should not determine who is consulted.
01
Establish the impact.
Identify the services affected, the information at risk and the recovery options being tested. Separate confirmed facts from the attacker’s claims and make critical uncertainties visible.
02
Bring in the right expertise.
Engage incident responders and independent legal advisers. Notify your insurer or broker where relevant, and understand the conditions of your cover before making commitments.
03
Assess the payment risk.
Do not assume a payment is permissible because the named group is unfamiliar. Ask for a case-specific sanctions assessment, including the proposed recipient, intermediaries and relevant jurisdictions.
04
Keep a decision record.
Record evidence, advice, alternatives considered, reporting and the reasons for decisions. Keep that record somewhere the incident has not compromised, with a named person responsible for maintaining it.
This is a briefing for decision-makers, not a payment authorisation or a substitute for incident-specific legal advice.
THE LEGAL CONSTRAINT
The recipient matters.
So does who benefits.
OFSI’s ransomware guidance explains that making or facilitating a payment to a person subject to an asset freeze can expose those involved to civil or criminal penalties. The obligation is relevant to victims and to organisations helping process a payment.
A search against a group name is only one part of the work. OFSI’s general guidance explains that restrictions also extend to entities owned or controlled by designated persons, including entities not separately named on the list.
SCREENING IS AN ASSESSMENT
A name check is not
a legal conclusion.
Ask what has been checked, which connections remain uncertain and what further evidence or advice is needed.
Use the current source.
The UK Sanctions List became the sole source for UK sanctions designations on 28 January 2026. Replace references to the closed OFSI Consolidated List in your procedures.
Do not assume a licence will be available.
OFSI says ransomware payments are unlikely to be appropriate for a licence. Seek independent legal advice rather than treating an application as a routine route to payment.
KEEP THESE DISTINCT
Sanctions guidance and ransomware proposals are different things.
FINANCIAL SANCTIONS
Assess the restrictions that apply.
Use current OFSI guidance, the relevant legislation and specialist advice for the circumstances. Reporting an incident or contacting an authority does not itself establish that a payment is lawful.
2025 CONSULTATION RESPONSE
Read proposed measures in context.
The Home Office’s response, updated September 2025, describes a targeted payment ban, a payment prevention regime and incident reporting proposals. It presents a policy-development package; it is not, by itself, evidence that a particular duty has commenced.
Do not treat the proposed 72-hour and 28-day reporting periods in that response as a universal rule for every incident. Check the legislation, commencement dates and sector obligations that apply at the time.
REPORTING & OFFICIAL HELP
Use the right route for the issue.
An incident may involve several reporting duties. Sending one report does not necessarily meet the requirements of another authority.
Cyber incident
Use the government signposting service to identify the relevant reporting organisations.
Suspected sanctions breach
OFSI advises prompt disclosure if you suspect a payment has reached a designated person. Cooperation may mitigate enforcement; it does not guarantee an outcome.
Personal data breach
Assess the risks to people and the reporting obligations that follow. The ICO provides a reporting assessment and guidance.
BEFORE AN INCIDENT
Make the difficult decisions easier to govern.
CyberSolace’s focus is on ransomware preparedness, tested recovery and clear response arrangements. A workable plan gives leaders more options when an incident occurs.
- Test restoration of the services the business most needs.
- Agree who can authorise decisions and obtain urgent legal advice.
- Keep responder, insurer and reporting contacts available offline.
- Exercise a scenario in which data is stolen as well as encrypted.
Prepare the response.
Protect the decision.
If your incident plan needs clearer responsibilities, recovery priorities or a practical exercise, talk to CyberSolace.
SOURCES & REVIEW
OFSI ransomware guidance · OFSI general guidance · UK Sanctions List · NCSC payment guidance · Home Office consultation response · ICO breach reporting
Originally published 11 May 2023. Reworked and references reviewed 20 October 2026. This briefing provides general information; obtain advice on the laws and obligations applicable to your incident.