OFAC's updated advisory, dated September 21, 2021, says that making or facilitating a ransomware payment can violate U.S. sanctions regulations, and that liability can attach even if the payer did not know the recipient was sanctioned. Strong security practices and fast reporting to authorities count as mitigating factors. This is education, not legal advice.
The core warning
The advisory states that U.S. persons are generally prohibited from dealing, directly or indirectly, with persons on the SDN List, other blocked persons, and comprehensively embargoed jurisdictions. A ransom payment could land in one of those categories without the victim realising.
It also says companies that facilitate payments for victims, naming financial institutions, cyber insurance firms and incident response firms, may risk violating OFAC regulations. The advisory is explanatory and says it does not have the force of law, so read it as a statement of how OFAC thinks about enforcement, then talk to counsel about the underlying rules.
Strict liability, in plain words
The advisory says OFAC may impose civil penalties on a strict liability basis. A person subject to U.S. jurisdiction can be held civilly liable even if they did not know and had no reason to know the transaction was prohibited.
That is why "we did not know who the attackers were" is not a safe position by itself. It does not mean every payment leads to a penalty. The advisory says enforcement responses range from non public ones, such as a no action letter or cautionary letter, up to civil monetary penalties.
What OFAC says it will weigh
Two clusters of mitigating factors appear in the advisory.
Before the attack: meaningful steps to reduce the risk of extortion by adopting or improving cybersecurity practices are described as a significant mitigating factor. Examples named include offline backups, incident response plans, security training, updated anti malware and authentication protocols.
During and after: a self initiated, complete report of the attack to law enforcement or another relevant agency, made as soon as possible after discovery, is treated as voluntary self disclosure and a significant mitigating factor. So is full and ongoing cooperation, including sharing technical details and payment instructions.
The advisory adds that OFAC would be more likely to resolve violations involving ransomware with a non public response when these steps were taken.
Licensing
License applications for ransomware payments will be reviewed case by case with a presumption of denial, according to the advisory. Do not plan on getting a license in the middle of an incident.
What an engineering leader can do
- Treat backups and recovery tests as legal risk reduction, not only operations. They shape whether paying is ever on the table.
- Write the "who do we call" list in advance: law enforcement contacts, counsel, your insurer.
- Make sure no one inside engineering can arrange a payment without legal and finance involvement.
- Keep an incident timeline from the first hour, since cooperation is judged on speed and completeness.
Quick check
Does the advisory say paying a ransom is illegal?
No. It says payments can create sanctions risk and that the government strongly discourages them. Whether a specific payment is a violation depends on facts and the underlying regulations.
Is reporting the attack optional?
The advisory encourages reporting and says prompt, complete reports are a significant mitigating factor. Other laws may impose their own reporting duties.
Sources
Last reviewed: 19 October 2026.
