Are Ransomware Payments Illegal? Usually Not, but Three States Ban Public Bodies and OFAC Can Fine Twice the Payment

Are ransomware payments illegal? As of 2 November 2026, usually not: no US federal, UK or Australian law we read bans private victims from paying outright. Two things change that. Paying a sanctioned party exposes US persons to strict-liability OFAC penalties up to the greater of $377,700 or twice the payment, and North Carolina, Florida and Tennessee bar public bodies from paying.

The legal status matrix: who may pay, by jurisdiction

Allowed or in force Barred Proposed, policy or not yet in force Outside this law

We did not run a 50-state statute search or cover the EU, France or other national regimes, so treat this as the jurisdictions we read, not every law in force.

What changed most recently

OFAC sanctions risk, stated exactly

The advisory says it is “explanatory only and does not have the force of law”, and that the binding text is the statutes and regulations it cites. Sanction targets it lists include Evil Corp (December 2019), the Lazarus Group (September 2019) and exchange SUEX (September 2021). The list moves: the Home Office notes LockBit leader Dmitry Khoroshev was sanctioned by the UK, US and Australia in May 2024, and LockBit is the second-largest variant by value in FinCEN’s 2022 to 2024 data, at about $252.4 million. A group’s brand name is not a sanctions check.

What a sanctions-nexus payment could cost

We applied OFAC’s Enforcement Guidelines base-penalty matrix to payment sizes from this page. Non-egregious cases are capped at $377,700; egregious cases scale with the ransom. A voluntary self-disclosure lowers the base in both categories, and OFAC says a prompt, complete report of the attack to law enforcement or CISA counts as one.

Our calculation of starting points, assuming a sanctions nexus, which none of these named victims is alleged to have had. These are base amounts before OFAC’s adjustments. OFAC says it is more likely to close ransomware cases with a non-public No Action or Cautionary Letter when the victim reported early and cooperated.

Ransomware payment ban: who has actually banned paying

A 2026 guide in this month’s search results still lists only North Carolina and Florida as enacted bans. Tennessee makes it at least three: Public Chapter 534 passed the House 92 to 0 on 22 February 2024 and the Senate 32 to 0 on 26 February, and Governor Bill Lee approved it on 7 March 2024. It copies North Carolina’s wording on payment, drops the ban on communicating, and sends the entity to the Tennessee Bureau of Investigation’s technology and innovation division. North Carolina remains the only one of the three that bars contact with the attacker, which rules out a proof-of-life exchange as well as a wire.

The UK is the closest national ban. The Home Office’s response to 273 consultation responses found 72% agreeing with a targeted ban for the public sector and CNI, 23% disagreeing, and 47% net agreement for a notify-before-paying regime for everyone else. That response left scope, penalties, exceptions and supply-chain treatment open, and the consultation page was last updated on 2 September 2025 when we fetched it. The vehicle often assumed, the Cyber Security and Resilience Bill, does not carry it: HL Bill 62 as amended on Report contains the word “ransom” 0 times. We saw no bill carrying the ban in what we read, though we could not run a full parliamentary search.

The US federal position is a discouragement, not a ban, and the 2023 Counter Ransomware Initiative statement binds only national government institutions, politically. Its 2024 statement mentions “policies to reduce ransom payments”, and its 2025 statement does not use the word “payment” at all.

Mandatory ransomware payment reporting: the clocks

Australia is the only national regime here that produces a count, and we found no official published series. iTnews reported on 26 February 2026 at least 75 payment reports from businesses over A$3 million (via a freedom of information request by security firm Secolve) plus 19 from critical infrastructure (via a Home Affairs spokesperson), or 94 in about eight months. That is press reporting of official figures, and amounts are not public.

The third-party rule matters more to service providers than the clock. Under 681b(d) a covered entity may have a service provider file its report but keeps the duty, and any third party that “knowingly makes a ransom payment” on its behalf “shall advise” it of its reporting duties. Australia’s Home Affairs factsheet takes the same line: the reporting entity “remains responsible” when someone else paid. CISA’s April 2024 proposal would cover entities in critical infrastructure sectors above the small-business size standard or meeting sector criteria, but the text at OIRA is not public, so scope may change.

Confirmed ransom payments: the ledger from primary documents

Only five payments with a stated amount made this list, totalling $39,540,000. Each comes from the victim or its officers on the record. We left out figures that come only from press reports, blockchain tracing or vendors.

Set against FinCEN’s 4,194 incidents for 2022 to 2024, 2 named payments fall in that window, about 1 in 2,097. By that count, almost every ransom is paid in private. SEC filings point the same way: we downloaded 1,353 filings returned by nine EDGAR full-text queries and pulled every sentence near “ransom” or “extortion”. We found no registrant stating the amount of its own ransom payment in the sentences we kept. At least 6 registrants said outright that they did not pay (SmileDirectClub, Ultralife, Allied Motion, Smith Midland, Supernus, Quantum-Si). Quantum-Si is the most specific: a note seeking 50 bitcoin, “approximately $500,000”, in August 2020, unpaid because the files were backed up. The largest figure in the set, a $75 million payment in a Zscaler 8-K exhibit, is a vendor research claim about an unnamed victim, so it is not in the ledger.

How much victims pay, per FinCEN

FinCEN’s December 2025 analysis of Bank Secrecy Act reports is the closest thing to an official number: 7,395 reports on 4,194 incidents from 2022 to 2024. The median single transaction was $155,257 in 2024, down 11% from $175,000 in 2023.

Dark bars are stated by FinCEN (2023, 2024). 2022 is derived from FinCEN’s “77 percent” rise to $1.1 billion. Pale bars are our pixel measurements of FinCEN’s unlabeled Figure 1, so treat them as approximate. Incident-date basis.

Most payments are small; a few set the totals

Payments up to $250,000 were 63% of the 2024 count and 68% in 2022, while roughly 85 of about 4,169 payments in the three years exceeded $5 million. FinCEN publishes this chart without labels, so we measured the bars. They sum to within 0.7% of FinCEN’s stated incident count in each year, which is our check on the method.

FinCEN’s totals do not reconcile, and it does not say why

FinCEN’s yearly figures add to about $2.46 billion ($621 million derived, $1.1 billion, $734 million), but its headline says “more than $2.1 billion”. Its quarterly Figure 2, by our measurement, sums to about $2.03 billion, and its currency table shows about $2.0 billion in Bitcoin plus $25.8 million in Monero. For 2013 to 2021 the same document gives both “approximately $2.4 billion” on 3,075 reports and “approximately $1.56 billion” on 3,038 reports; Figure 1’s earlier years sum to about $2.3 billion by our measurement. FinCEN notes that its older analyses counted by filing date and this one by incident date, but it does not reconcile the figures. Cite the year and the basis together.

Late filings also move old years, which matters for the 2024 drop. FinCEN’s November 2022 analysis put 2021 at 1,251 incidents and about $886 million; the new report says 1,403 incidents and Figure 1 reads about $950 million. This data set closed to filings on 1 February 2025, so the 2024 total of $734 million could rise too. FinCEN credits the disruption of ALPHV/BlackCat and LockBit for the decline; we cannot test that from its published tables.

Two caveats apply to every FinCEN number. Its footnote says “both actual and attempted transactions” are included, and 176 reports involve incidents where no payment was made. And the reports show what financial institutions flagged, so payments that never crossed a reporting institution are missing. The FBI complaint data in our IC3 report analysis and the leak-site posts in our ransomware statistics measure other things and cannot fill that gap.

What the evidence says about paying

FinCEN reports that “some threat actors demanded further negotiation even after initial payments were made, often escalating payment demands”. The 47 parties listed in the 2023 joint statement say paying “does not guarantee you will get your data back”. Coveware’s Q3 report, on its data-exfiltration cases, says “nearly 80% of incidents are resolved without a ransom payment”. Change Healthcare’s CEO called his $22 million decision “one of the hardest decisions I have ever had to make”. OFAC’s own word is “strongly discourages”, which is not a ban.

Does cyber insurance cover ransomware payments?

It can, and we have two on-the-record cases. The American Radio Relay League says its $1 million payment and restoration costs were “largely covered by our insurance policy”, and its carrier was on the crisis team within three hours. Colonial’s Joseph Blount told Congress “We have submitted a claim for that ransom payment” and that he suspected it would be covered, adding that he thought talks on cover ran through his CFO. Neither document gives the policy wording, and none of the statutes on this page bans that cover.

Cover does not remove sanctions risk. OFAC names cyber insurance firms among facilitators who “may risk violating” its regulations and expects their compliance programs to account for that. FinCEN adds that insurers and incident response firms facilitating payments could be money transmitters. The Counter Ransomware Initiative’s 2024 statement records insurance bodies endorsing guidance for organizations under attack. Market size is in our cyber insurance statistics, but NAIC’s data there is not a measure of ransom claims paid. SEC filings mention recoveries on incident costs rather than ransoms: Hanesbrands reports about $15 million in 2022 costs from its ransomware attack, “net of expected insurance recoveries”, and does not say a ransom was paid.

Are ransomware payments tax deductible?

We found no primary source that answers this by name: no IRS ruling, regulation or court decision naming ransomware payments in the documents we read, and no registrant saying so in the EDGAR sentences above. This was not an exhaustive search of Tax Court records. What exists is general:

• 26 U.S.C. 165(a) allows a deduction for a loss “not compensated for by insurance or otherwise”, so an insured ransom is a different question from an uninsured one. Section 165(c)(1) covers an individual’s trade or business losses.
• IRS Publication 547 lists extortion among the means of theft, and it covers casualties and thefts generally rather than ransomware.
• Chief Counsel memo 202511015 (released 14 March 2025) uses “ransom” once, for a fake kidnapping scam against an individual, and denies that deduction as a personal casualty loss in 2024. It is not about a business paying ransomware.
• 26 U.S.C. 162(f) bars deducting amounts paid to a government in relation to a violation of law, which reads onto a sanctions penalty rather than the ransom.

Take the yes-or-no to a tax adviser with the facts of the payment.

What this means for MSPs

• Write the decision into the playbook. Name who may contact an attacker and who may authorize payment. Witty (“the decision to pay a ransom was mine”) and Blount both made it at CEO level. For North Carolina public clients the contact itself is barred, so your runbook must stop before any negotiation chat and go to NCDIT.
• Run the OFAC check before any payment, and keep the record. Screen names, wallets and variant attribution against the SDN List, and contact OFAC if there is any reason to suspect a nexus. Report the attack to CISA, the FBI or Treasury first, since OFAC treats that as a voluntary self-disclosure. Do not wire or buy crypto yourself without counsel: FinCEN’s money-transmitter warning and OFAC’s facilitator language both point at you.
• Tag clients with their clock. Keep it in the PSA record: Florida local government 12 hours, Tennessee state entity immediately, Australian entity over A$3 million 72 hours after payment, CIRCIA 24 hours once the rule takes effect. If you knowingly make a payment for a covered client, you must tell them their duty under 681b(d)(4).
• Read the insurance wording before the incident. Ask three things in writing: does cover require insurer consent before paying, does a sanctions clause void it, and whose panel firm negotiates. ARRL had its carrier on the crisis team within 3 hours, and OFAC names insurers as facilitators, so settle this before a demand arrives. Then check your own contract for who is liable if you carried out the payment.

Frequently asked questions

Is it illegal to pay ransomware?

Usually not for a private company. We found no US federal statute that bans payment outright, but OFAC generally prohibits US persons from dealing with sanctioned parties, on a strict-liability civil basis, with a maximum of the greater of $377,700 or twice the transaction. North Carolina, Florida and Tennessee ban named public bodies from paying.

Which states ban ransomware payments?

Three, in the statutes we read: North Carolina (G.S. 143-800, state agencies and local governments, and contact with the attacker), Florida (s. 282.3186, state agencies, counties, municipalities) and Tennessee (Public Chapter 534 of 2024, state entities including public higher education). None of the three texts names private businesses.

Has the UK banned ransomware payments?

Not as of 2 November 2026. The Home Office proposed a ban for the public sector and critical national infrastructure in January 2025, and 72% of those answering agreed. Its July 2025 response says the government will keep developing it. The word ransom appears 0 times in HL Bill 62, the current Cyber Security and Resilience Bill.

Do you have to report a ransomware payment?

In Australia, yes: within 72 hours if turnover exceeds A$3 million or you run a critical infrastructure asset. In the US, CIRCIA sets a 24-hour rule for covered entities, but CISA says reporting is not required until the final rule takes effect, and that rule has been at OIRA since 24 September 2026.

Does cyber insurance cover ransomware payments?

It can, depending on the policy. The American Radio Relay League says its $1 million payment was largely covered by insurance, and Colonial Pipeline’s CEO told Congress it had filed a claim for its payment. OFAC warns that cyber insurers that facilitate payments may also risk violating its regulations.

Are ransomware payments tax deductible?

We found no IRS ruling, regulation or court decision that names ransomware payments, so we cannot give a primary-source yes or no. The general rules are 26 U.S.C. 162 and 165, and IRS Publication 547 lists extortion as a form of theft. Section 165(a) excludes losses compensated by insurance. Ask a tax adviser.

Methodology

References

1. FinCEN, Ransomware Trends in Bank Secrecy Act Data Between 2022 and 2024, Dec 2025. Accessed November 2026.
2. FinCEN, Ransomware Trends in Bank Secrecy Act Data, July to December 2021, Nov 2022. Accessed November 2026.
3. FinCEN, Advisory FIN-2021-A004, 8 Nov 2021. Accessed November 2026.
4. OFAC, Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments, 21 Sep 2021. Accessed November 2026.
5. 31 CFR Part 505, Sanctions Penalties Regulations. Accessed November 2026.
6. 31 CFR Part 501, Appendix A, Enforcement Guidelines. Accessed November 2026.
7. 50 U.S.C. 1705. Accessed November 2026.
8. 6 U.S.C. 681b, CIRCIA. Accessed November 2026.
9. CISA, CIRCIA page. Accessed November 2026.
10. OIRA, regulatory review list, RIN 1670-AA04. Accessed November 2026.
11. Federal Register, CIRCIA proposed rule, 4 Apr 2024. Accessed November 2026.
12. Decryption Digest, Ransomware Payment Ban State Legislation 2026 (the guide discussed, not a source for the law). Accessed November 2026.
13. Fla. Stat. 282.3186. Accessed November 2026.
14. Fla. Stat. 282.3185. Accessed November 2026.
15. Tennessee Public Chapter 534 (2024). Accessed November 2026.
16. Legal analysis quoting N.C.G.S. 143-800, National Law Review. Accessed November 2026.
17. Nelson Mullins analysis of S.L. 2021-180 and G.S. 143-800, National Law Review. Accessed November 2026.
18. Home Office, Ransomware legislative proposals, Jan 2025. Accessed November 2026.
19. Home Office, Government response, Jul 2025. Accessed November 2026.
20. GOV.UK consultation page. Accessed November 2026.
21. UK Parliament, Cyber Security and Resilience Bill. Accessed November 2026.
22. UK Parliament, bill stages. Accessed November 2026.
23. HL Bill 62, as amended on Report. Accessed November 2026.
24. Australia, Cyber Security Act 2024. Accessed November 2026.
25. Australia, Cyber Security (Ransomware Payment Reporting) Rules 2025. Accessed November 2026.
26. Home Affairs, ransomware payment reporting factsheet. Accessed November 2026.
27. iTnews, 26 Feb 2026 (press report of FOI and Home Affairs figures). Accessed November 2026.
28. Counter Ransomware Initiative, Joint Statement on Ransomware Payments, 2023 (CSA Singapore). Accessed November 2026.
29. CRI 2024 Joint Statement (Public Safety Canada). Accessed November 2026.
30. CRI 2025 statement (Public Safety Canada). Accessed November 2026.
31. S. Hrg. 118-785, Senate Finance Committee, 1 May 2024. Accessed November 2026.
32. House Homeland Security Committee, Serial 117-15, 9 Jun 2021. Accessed November 2026.
33. JBS USA media statement, 9 Jun 2021. Accessed November 2026.
34. UCSF update, 26 Jun 2020. Accessed November 2026.
35. ARRL report to members, 22 Aug 2024. Accessed November 2026.
36. Zscaler 8-K exhibit 99.1, 3 Sep 2024. Accessed November 2026.
37. Quantum-Si 10-Q, 16 Aug 2021. Accessed November 2026.
38. Hanesbrands 10-K, 14 Feb 2025. Accessed November 2026.
39. Tennessee General Assembly, HB 1733 bill history (archived copy). Accessed November 2026.
40. Coveware, Q3 2026 report (third-party). Accessed November 2026.
41. Coveware, Q2 2026 report (third-party). Accessed November 2026.
42. Chainalysis, 26 Feb 2026 (third-party). Accessed November 2026.
43. 26 U.S.C. 162. Accessed November 2026.
44. 26 U.S.C. 165. Accessed November 2026.
45. IRS Chief Counsel memo 202511015. Accessed November 2026.
46. IRS Publication 547. Accessed November 2026.