Tracker record · Federal · Agency guidance
OFAC ransomware-payment sanctions risk
On September 21, 2021, OFAC issued an 'Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments,' superseding its October 1, 2020 advisory. The advisory is guidance, not itself a sanction: it warns that companies facilitating ransomware payments to sanctioned cyber actors, including financial institutions, cyber insurers, and incident-response firms, may violate OFAC-administered sanctions, and describes mitigating factors such as reporting to law enforcement, cooperating with investigations, and maintaining cybersecurity practices. The binding obligations come from the underlying sanctions programs and designations themselves, such as the same-day designation of SUEX OTC, S.R.O. as a malicious cyber actor, not from the advisory.
Status
- Legal status
- Issued: advisory guidance only (September 21, 2021); not itself a sanction (Updated advisory issued September 21, 2021 (supersedes October 1, 2020 advisory); guidance only)
- Allegation or finding
- Guidance (not law)
- Applicability
- Persons considering ransomware payments
- Enforceability
- Non-binding (advisory); underlying sanctions designations binding
- Law checked through
- October 12, 2026
- Citation
- OFAC, Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments
- Source
- OFAC, Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (September 21, 2021)