From crisis call to compliance record: OFAC’s ransomware advisory

The week

On October 1, 2020, the Treasury Department’s Office of Foreign Assets Control issued an advisory on the potential sanctions risks of facilitating ransomware payments. It reminded organizations that paying a ransom to a sanctioned person or jurisdiction could violate U.S. sanctions, that liability is strict, and that this applied not only to victims but to companies that facilitate payments, such as financial institutions, cyber insurers and digital forensics and incident response firms. OFAC said it would consider self-reporting and cooperation with law enforcement as mitigating factors.

The same day, the Financial Crimes Enforcement Network issued an advisory to financial institutions describing ransomware trends, red flags and expectations for reporting suspicious activity related to ransom payments.

Before October 2020, a ransom decision was usually treated as a continuity call made under pressure by executives, outside counsel and an incident response firm. The OFAC advisory did not make payment generally unlawful. It made clear that payment carries a distinct legal risk, assessed under strict liability, that has to be judged and documented, and that is best prepared for in advance. For banks, health systems and public agencies alike, the implications fall into three parts: who carries the exposure, what must be known before any payment, and how the decision is governed.

Who carries the exposure

The advisory reached well beyond the victim. It named the intermediaries that commonly handle ransom payments: financial institutions and money services businesses that move funds, insurers that reimburse them, and forensic and incident response firms that negotiate and transact. Because sanctions liability is strict, a party can face penalties even if it did not know the recipient was sanctioned.

For financial institutions, the FinCEN advisory issued the same day added a second layer. Banks, credit unions and money services businesses were reminded that ransomware payments, and the patterns around them, can trigger suspicious activity reporting. A bank processing a customer’s ransom payment can face a sanctions screening question and a reporting question on the same transaction, handled by different teams.

Hospitals, public agencies and other victims face exposure as decision-makers. They usually pay through intermediaries and often have no in-house sanctions expertise. A county or a community hospital may never have run a sanctions check before the night it needs one.

Response firms and insurers carry their own exposure under the advisory, so the diligence they perform is designed to protect them first. A victim that relies entirely on a vendor’s sanctions conclusion should ask what that conclusion covers, what it excludes and whether the vendor will put it in writing.

What must be known before any payment

A sanctions assessment depends on attribution, and attribution in a ransomware event is hard. Groups rename themselves, share tooling and run affiliate programs. Payment addresses change. In practice, victims rely on response firms and threat intelligence to judge whether a group or wallet is linked to a sanctioned party.

The quality of that judgment depends on preparation done before the incident.

• Which response firm and counsel will be engaged, and what sanctions due diligence each performs and documents.
• How the insurer’s requirements interact with the decision, including consent rights and the insurer’s own sanctions checks.
• When and how law enforcement is contacted. OFAC said it would treat prompt, complete reporting and cooperation as significant mitigating factors.
• What evidence is preserved, so the organization can later show what it knew and when.

These arrangements take weeks to set up and minutes to use. Retainers with response firms and counsel, signed before an incident, can specify the sanctions work in scope. Insurance renewals are the moment to clarify consent and reimbursement conditions. Neither conversation goes well at 2 a.m. with systems encrypted.

How the decision is governed

A ransom decision touches legal, compliance, finance and operations. In health care and government it also touches patient or public safety. It tends to arrive at night or on a weekend, under severe time pressure. That is when an unprepared decision is most likely to be poorly documented.

A defensible approach has four elements. A pre-agreed decision group, with named deputies, that includes the general counsel or chief compliance officer. Written criteria covering safety impact, recovery options, sanctions risk and law enforcement engagement. A rule that no payment proceeds without a documented sanctions assessment. And a decision record, with rationale, written on the assumption that regulators will read it.

Sector context changes the criteria. A health system weighing payment has to consider patient safety and the length of any diversion. A public agency may face statutory limits on spending, procurement rules that never anticipated an extortion payment, and certainty that the decision will become public. A bank or broker-dealer will be asked by its own supervisors how the decision fits its sanctions and anti-money laundering program. Each of these belongs in the criteria in advance.

Tabletop exercises test the process cheaply. A realistic scenario run with the actual decision group quickly exposes gaps. Typical ones are an unreachable deputy, an unclear insurer requirement, a missing sanctions step, or a board chair who expects a call and is not on the list.

The governance has a cost. A slower, documented decision can lengthen downtime by hours or days, which is a real harm in a hospital. That trade-off is why the decision group should agree in advance on what evidence is sufficient, so diligence is proportionate and does not stall indefinitely.

The strongest protection is still the ability to recover without paying. Tested, isolated backups and rehearsed restoration reduce the pressure that makes payment look necessary. Organizations should check with counsel on how sanctions and reporting rules apply to their circumstances. After October 2020, a ransom payment had to be treated as a regulated transaction with a paper trail.

With hindsight

OFAC updated its advisory in September 2021, putting more weight on prevention and on reporting to law enforcement. The same month it sanctioned a cryptocurrency exchange for its role in laundering ransomware proceeds, the first action of its kind. Further designations of exchanges, mixers and individual ransomware actors followed, which made screening of ransom payments more consequential.

In 2022 Congress passed the Cyber Incident Reporting for Critical Infrastructure Act. It will require covered entities to report ransom payments to CISA within 24 hours once implementing rules take effect. CISA proposed those rules in 2024. Finalization slipped past the October 2025 statutory deadline, and as of this writing the final rule had not been published. North Carolina and Florida barred state and local public entities from paying ransoms in 2022. The advisory’s core message has held. Payment is not banned across the board, but it is a compliance decision that needs process, evidence and counsel.