OFAC's updated advisory says that making or facilitating a ransomware payment may violate US sanctions rules if the recipient is a sanctioned person or in an embargoed jurisdiction, and that liability can be strict. Good cybersecurity practice and prompt reporting to law enforcement count as mitigating factors. This is not legal advice.
The basic rule
US persons are generally prohibited from transactions, directly or indirectly, with people on OFAC's Specially Designated Nationals and Blocked Persons List, other blocked persons, and those covered by comprehensive embargoes. The advisory gives examples of designated actors tied to past ransomware including Cryptolocker's developer and the Evil Corp group.
Strict liability
The advisory says OFAC may impose civil penalties on the basis of strict liability. That means a person subject to US jurisdiction can be held liable even if they did not know or have reason to know the transaction was prohibited. The practical point: you often cannot tell who is behind a ransomware brand.
Who is affected
Not only the victim. The advisory names companies that facilitate payments for victims, including financial institutions, cyber insurance firms, and digital forensics and incident response firms. It states that their sanctions compliance programs should account for the risk that a payment involves a blocked person.
Mitigating factors
OFAC lists steps it will weigh in an enforcement response:
- Security practice before the attack. Meaningful steps to reduce extortion risk, such as those in CISA's ransomware guide, are considered a significant mitigating factor. Examples include offline backups, incident response plans, training, updated anti-malware and authentication protocols.
- Reporting. A self-initiated, complete report of the attack to law enforcement or agencies such as CISA or Treasury's Office of Cybersecurity and Critical Infrastructure Protection, made as soon as possible after discovery, is treated as a significant mitigating factor.
- Cooperation. Full and ongoing cooperation with law enforcement during and after the attack is also considered.
Limits of this post
The advisory is dated 21 September 2021 and states it is explanatory only, with no force of law. Sanctions lists and rules change. Before any payment decision, ask counsel to check current requirements. Outside the US, different rules apply.
What to do now, before an incident
- Put law enforcement reporting contacts in your response plan.
- Ask your insurer and incident response retainer how they screen payments for sanctions exposure.
- Keep records of the security controls you had in place, since those count in your favour.
Quick check
Can we be penalised if we did not know the attacker was sanctioned?
According to the advisory, OFAC civil penalties can rest on strict liability, so lack of knowledge does not by itself remove exposure.
Does reporting the attack help?
Yes. The advisory treats a prompt, complete, self-initiated report as a significant mitigating factor, along with full cooperation.
Sources
Last reviewed: 19 October 2026.
