# Should you pay a ransomware demand? The UK position

> Paying a ransom is not banned for most UK businesses, but paying a sanctioned group is a criminal offence, public bodies face a proposed ban, and the NCSC and OFSI warn that paying does not guarantee recovery.

- Published: 2026-10-25
- Topic: [Security](https://futuretechnologyhq.com/topic/security/)
- URL: https://futuretechnologyhq.com/article/should-you-pay-ransomware-uk/
- Publisher: [Future Technology](https://futuretechnologyhq.com/), free to read. Quote as "Future Technology" with a link to the article.

## Key points

- Paying a ransom is not generally illegal for UK businesses, but paying a sanctioned person or group is a serious criminal offence
- The government has proposed banning public sector bodies and critical national infrastructure, including the NHS, councils and schools, from paying, and making other businesses notify it before paying
- The NCSC and UK law enforcement do not encourage, endorse or condone paying ransoms
- The ICO does not treat a payment as risk mitigation and says it would not reduce any penalty
- Paying does not guarantee your data back, does not remove the attackers' access, and stolen data may still be sold

## Article

Most UK businesses are not banned from paying a ransomware demand. But paying a group under UK sanctions is a serious criminal offence, the government has proposed banning public bodies and critical services from paying at all, the NCSC and law enforcement do not condone it, and the ICO says paying would not reduce a penalty. This guide sets out what the law and the official guidance say, and what to check before anyone in your organisation agrees to pay.

## Is paying a ransomware demand illegal in the UK?

Not in general, for a private business. The main legal line is sanctions, though the NCSC also points to wider legal and regulatory considerations.

The Office of Financial Sanctions Implementation (OFSI) says financial sanctions prohibit making funds or economic resources available to an individual or entity subject to an asset freeze, including through a ransomware payment, and the government's guidance on how the Regulations work says this includes cryptoassets. Breaches of financial sanctions are a serious criminal offence and can carry a custodial sentence and/or a monetary penalty. OFSI also has the power to impose civil monetary penalties under the Policing and Crime Act 2017.

That risk extends beyond the victim. OFSI says paying a ransom to a designated person might expose both victims and the organisations facilitating payments on their behalf to civil and criminal penalties. The NCSC's guidance, written with the insurance industry bodies ABI, BIBA and IUA, makes the same point: payments may not be lawful if they go to an entity or area sanctioned by the UK.

OFSI says that if the mitigating steps in its guidance are taken, OFSI and the National Crime Agency would be more likely to resolve a breach case involving a ransomware payment through means other than a monetary penalty or a criminal investigation.

## What the government has proposed

After its consultation, the government said it will take measures to tackle ransomware forward with industry, and set out these proposals:

- **A payment ban for the public sector and critical national infrastructure.** Public sector bodies and operators of critical national infrastructure, including the NHS, local councils and schools, would be banned from paying ransom demands. Nearly three quarters of consultation respondents supported this.
- **Notice before paying for everyone else.** Businesses not covered by the ban would be required to notify the government of any intent to pay. The government could then give advice and support, including telling them if a payment would risk breaking the law by sending money to sanctioned cyber criminal groups.
- **Mandatory reporting.** A mandatory reporting regime is being developed, which the government says would give law enforcement intelligence to hunt down perpetrators and disrupt their activities.

These are proposals. Check the current position before relying on them, especially if you run public services or critical infrastructure.

## What the NCSC and law enforcement say

The NCSC and UK law enforcement do not encourage, endorse nor condone the payment of ransom demands. The NCSC's guidance for organisations considering payment is clear that the final decision rests with the victim. The NCSC and OFSI, in separate guidance, point to these risks of paying:

- **Stolen data is not safely deleted.** Attackers increasingly threaten to publish or sell stolen data. The NCSC warns that after payment a victim may find the attacker lied about deleting the data, sells it to other criminals, or repeats the threat months or even years later.
- **Decryption is slow.** Even with a decryption key, the NCSC says a return to business as usual is unlikely to be immediate, especially for large organisations, and if you have both backups and a decryptor, restoring from backups may be quicker.
- **The way in stays open.** Paying without finding and fixing how you were compromised leaves you open to further incidents. OFSI adds that payment does not remove criminal actors' access to networks.
- **It funds the next attack.** OFSI says ransomware payments perpetuate the threat and sustain the criminal marketplace.

## Does paying reduce an ICO fine?

No. The NCSC guidance records that the ICO does not consider a payment to criminals who have attacked a system as a risk mitigation, and that it would not reduce the amount of any penalty.

## What to do before anyone decides to pay

The NCSC's advice is to slow down. Ransomware groups use pressure tactics to force quick decisions, and checking your options takes time. Its guidance suggests:

1. **Check what you can recover without paying.** You may have viable backups, or other ways to recover systems and data partially or fully. Decryption keys are sometimes made freely available by third parties such as law enforcement.
2. **Understand the impact first.** Base any decision on as full a picture as possible of what the incident has actually affected.
3. **Keep a record.** Note the decisions made, actions taken and data captured or missing. Record this offline or on systems the incident has not touched, for post-incident reviews and any regulator.
4. **Bring in objective experts.** Insurers, the NCSC, law enforcement and cyber incident response companies can improve decisions. If you have cyber insurance, report the attack to your insurer or broker. If your IT is outsourced, involve your provider.
5. **Find out how they got in.** Do not take an attacker's account of the compromise at face value. Validate it independently and fix it.
6. **Check the law.** Consider sanctions and the laws of every country you operate in, for example if subsidiaries abroad are also affected.
7. **Report it.** Reporting to UK authorities helps support victims, and the government's incident signposting service shows which organisations to notify.

## The real answer is preparation

The government urges organisations to be able to keep running through a successful attack: offline backups, tested plans to operate without IT for an extended period, and a well-rehearsed strategy for restoring systems from backups. The NCSC says it is important to always have a recent offline backup of your most important files and data.

NCSC Director of National Resilience Jonathon Ellison said all businesses should strengthen their defences using frameworks such as Cyber Essentials and the NCSC's free Early Warning service, and be prepared to respond, recover quickly and keep running if the worst happens.

Our [3-2-1 backup rule guide](/article/3-2-1-backup-rule-how-to/) covers how to keep a copy that ransomware cannot reach, and [MDR vs EDR vs XDR](/article/mdr-vs-edr-vs-xdr-what-is-the-difference/) explains the detection options if nobody on your team watches alerts overnight.

## Frequently asked questions

### Is paying a ransomware demand illegal in the UK?

Not in general for private businesses. It is a serious criminal offence to make funds, including cryptoassets, available to a person or group under UK financial sanctions, and OFSI can also impose civil penalties.

### Are UK public bodies banned from paying ransoms?

Under measures the government has proposed after consultation, public sector bodies and operators of critical national infrastructure, including the NHS, local councils and schools, would be banned from paying.

### Does paying a ransom work?

Not reliably. The NCSC warns that attackers may lie about deleting stolen data and sell it or repeat the threat later, and that running a decryption key across a complex network takes time. OFSI says paying does not remove criminals' access to networks.

### Will paying a ransom reduce an ICO fine?

No. The ICO does not consider a payment to criminals as risk mitigation, and says it would not reduce the amount of any penalty.

### Do I have to tell the government before paying?

Under the government's proposals, businesses not covered by the ban would have to notify the government of any intent to pay, so it can warn them if a payment would break sanctions law.

## Sources

- [UK to lead crackdown on cyber criminals with ransomware measures](https://www.gov.uk/government/news/uk-to-lead-crackdown-on-cyber-criminals-with-ransomware-measures)
- [Financial sanctions guidance for ransomware](https://www.gov.uk/government/publications/financial-sanctions-guidance-for-ransomware/financial-sanctions-guidance-for-ransomware)
- [Guidance for organisations considering payment in ransomware incidents](https://www.ncsc.gov.uk/guidance/organisations-considering-payment-in-ransomware-incidents)
- [What you need to know about ransomware](https://www.ncsc.gov.uk/ransomware/home)