# Should you pay a ransomware demand? What UK and US agencies say Paying can look like the fastest way back, so it helps to know what the agencies and the law say first. The Assurance Desk. Published 22 October 2026. Last checked 22 October 2026. Part of the guide [Incident response plan: what to write down](https://theassurancedesk.com/guides/incident-response-plan-what-to-write-down.md). **The short answer.** UK and US agencies do not encourage paying a ransomware demand, because payment does not guarantee you get your data back. In the UK, paying a sanctioned person also risks civil or criminal penalties ([cisa.gov, #StopRansomware: SafePay Ransomware, CISA](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a), [nationalcrimeagency.gov.uk, Cybercrime, National Crime Agency](https://www.nationalcrimeagency.gov.uk/what-we-do/crime-threats/cyber-crime) and [GOV.UK, Financial sanctions guidance for ransomware](https://www.gov.uk/government/publications/financial-sanctions-guidance-for-ransomware/financial-sanctions-guidance-for-ransomware), checked 22 October 2026). ## Should you pay a ransomware demand? Paying a ransomware demand is not encouraged by law enforcement in the UK. The National Crime Agency and the NCSC both say law enforcement does not encourage, endorse or condone paying ([nationalcrimeagency.gov.uk, Cybercrime, National Crime Agency](https://www.nationalcrimeagency.gov.uk/what-we-do/crime-threats/cyber-crime) and [NCSC, Mitigating malware and ransomware attacks](https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks), checked 22 October 2026). UK sanctions guidance says the UK government does not condone ransomware payments. Guidance from Counter Ransomware Initiative members and insurance bodies strongly discourages paying ([GOV.UK, Financial sanctions guidance for ransomware](https://www.gov.uk/government/publications/financial-sanctions-guidance-for-ransomware/financial-sanctions-guidance-for-ransomware) and [GOV.UK, CRI guidance for organisations during ransomware incidents](https://www.gov.uk/government/publications/cri-guidance-for-organisations-during-ransomware-incidents/cri-guidance-for-organisations-during-ransomware-incidents), checked 22 October 2026). The same guidance accepts that a victim may, in some cases and within local laws, still consider paying. So the decision stays with the organisation. It should rest on the incident's impact and whether paying would change the outcome ([GOV.UK, CRI guidance for organisations during ransomware incidents](https://www.gov.uk/government/publications/cri-guidance-for-organisations-during-ransomware-incidents/cri-guidance-for-organisations-during-ransomware-incidents), checked 22 October 2026). ## Does paying a ransom get your data back? Paying a ransom does not guarantee you get your data back. The ICO says there is no guarantee attackers will provide the decryption key. UK sanctions guidance gives examples of decryptors that were not provided or were faulty ([ICO, Ransomware and data protection compliance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/ransomware-and-data-protection-compliance/) and [GOV.UK, Financial sanctions guidance for ransomware](https://www.gov.uk/government/publications/financial-sanctions-guidance-for-ransomware/financial-sanctions-guidance-for-ransomware), checked 22 October 2026). The NCSC says malware is sometimes presented as ransomware, and the files stay locked after payment ([NCSC, Mitigating malware and ransomware attacks](https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks), checked 22 October 2026). Paying once may not end it. The ICO says double extortion is common, where attackers ask for more money to stop publishing the data. Groups may also return if you have shown willingness to pay ([ICO, Ransomware and data protection compliance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/ransomware-and-data-protection-compliance/), checked 22 October 2026). > "there is no guarantee that you will get access to your data or computer; your computer will still be infected; you will be paying criminal groups; you are more likely to be targeted in future." > nationalcrimeagency.gov.uk, Cybercrime, National Crime Agency, https://www.nationalcrimeagency.gov.uk/what-we-do/crime-threats/cyber-crime (checked 22 October 2026) ## Is it illegal to pay a ransom in the UK? Paying a ransom in the UK may not be lawful in some circumstances, for example a payment to a sanctioned entity. UK financial sanctions prohibit making funds available to anyone under an asset freeze, including through a ransomware payment ([GOV.UK, CRI guidance for organisations during ransomware incidents](https://www.gov.uk/government/publications/cri-guidance-for-organisations-during-ransomware-incidents/cri-guidance-for-organisations-during-ransomware-incidents) and [GOV.UK, Financial sanctions guidance for ransomware](https://www.gov.uk/government/publications/financial-sanctions-guidance-for-ransomware/financial-sanctions-guidance-for-ransomware), checked 22 October 2026). Paying, or helping someone pay, a ransom to a sanctioned person risks civil or criminal penalties. The guidance calls these people designated persons ([GOV.UK, Financial sanctions guidance for ransomware](https://www.gov.uk/government/publications/financial-sanctions-guidance-for-ransomware/financial-sanctions-guidance-for-ransomware), checked 22 October 2026). Reporting matters here. UK sanctions guidance says victims should use the where to report a cyber incident portal as soon as possible. If a payment may have gone to a designated person, report it to OFSI, the UK sanctions office, as soon as practicable ([GOV.UK, Financial sanctions guidance for ransomware](https://www.gov.uk/government/publications/financial-sanctions-guidance-for-ransomware/financial-sanctions-guidance-for-ransomware), checked 22 October 2026). OFSI generally treats reporting through the portal, and prompt and complete voluntary disclosure, as mitigating factors. With those steps, OFSI and the NCA would be more likely to resolve a case without a monetary penalty or criminal investigation ([GOV.UK, Financial sanctions guidance for ransomware](https://www.gov.uk/government/publications/financial-sanctions-guidance-for-ransomware/financial-sanctions-guidance-for-ransomware), checked 22 October 2026). ## Is the UK banning ransomware payments? The UK has proposed banning some ransomware payments, but these are proposals. The government says that, if progressed, they would be the first specific measures in UK law to counter ransomware ([GOV.UK, Government response to ransomware legislative proposals: reducing payments to cyber criminals and increasing incident reporting (accessible)](https://www.gov.uk/government/consultations/ransomware-proposals-to-increase-incident-reporting-and-reduce-payments-to-criminals/outcome/government-response-to-ransomware-legislative-proposals-reducing-payments-to-cyber-criminals-and-increasing-incident-reporting-accessible), checked 22 October 2026). One limit already exists as policy, not law. The Home Office consultation describes a current principle that central government departments cannot make ransomware payments. The proposed ban would go beyond it ([GOV.UK, Ransomware legislative proposals: reducing payments to cyber criminals and increasing incident reporting (accessible)](https://www.gov.uk/government/consultations/ransomware-proposals-to-increase-incident-reporting-and-reduce-payments-to-criminals/ransomware-legislative-proposals-reducing-payments-to-cyber-criminals-and-increasing-incident-reporting-accessible), checked 22 October 2026). The first proposal is a targeted ban on payments for the public sector and regulated critical national infrastructure. The other two are a payment prevention regime and mandatory incident reporting ([GOV.UK, Government response to ransomware legislative proposals: reducing payments to cyber criminals and increasing incident reporting (accessible)](https://www.gov.uk/government/consultations/ransomware-proposals-to-increase-incident-reporting-and-reduce-payments-to-criminals/outcome/government-response-to-ransomware-legislative-proposals-reducing-payments-to-cyber-criminals-and-increasing-incident-reporting-accessible), checked 22 October 2026). Under the prevention proposal, victims would tell the government they intend to pay. A payment could be blocked if it could reach sanctioned criminals or break terrorism finance law. If not blocked, it would be the victim's choice, and it would not be approved ([GOV.UK, Government response to ransomware legislative proposals: reducing payments to cyber criminals and increasing incident reporting (accessible)](https://www.gov.uk/government/consultations/ransomware-proposals-to-increase-incident-reporting-and-reduce-payments-to-criminals/outcome/government-response-to-ransomware-legislative-proposals-reducing-payments-to-cyber-criminals-and-increasing-incident-reporting-accessible), checked 22 October 2026). The reporting proposal would mean an initial report within 72 hours and a fuller one within 28 days. The Home Office published the government's response in 2025. It said it will keep developing the ban with industry ([GOV.UK, Government response to ransomware legislative proposals: reducing payments to cyber criminals and increasing incident reporting (accessible)](https://www.gov.uk/government/consultations/ransomware-proposals-to-increase-incident-reporting-and-reduce-payments-to-criminals/outcome/government-response-to-ransomware-legislative-proposals-reducing-payments-to-cyber-criminals-and-increasing-incident-reporting-accessible), checked 22 October 2026). ## What do US agencies say about paying a ransom? US agencies also do not encourage paying a ransom. On 20 October 2026, CISA released advisory AA26-293A on SafePay ransomware with partners, including the UK's National Crime Agency ([cisa.gov, #StopRansomware: SafePay Ransomware, CISA](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a), checked 22 October 2026). The authoring agencies say payment does not guarantee files will be recovered. They add that payment may embolden attackers, encourage other criminals and fund illicit activities ([cisa.gov, #StopRansomware: SafePay Ransomware, CISA](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a), checked 22 October 2026). The FBI and CISA urge organisations to report ransomware incidents promptly, whether or not they have decided to pay. This is US government guidance, not UK law ([cisa.gov, #StopRansomware: SafePay Ransomware, CISA](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a), checked 22 October 2026). The advisory says SafePay actors have affected at least 600 victims. When a victim does not pay, SafePay posts the stolen data on its leak website ([cisa.gov, #StopRansomware: SafePay Ransomware, CISA](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a), checked 22 October 2026). **What UK and US agencies say about paying a ransom** | Question | UK | US | | --- | --- | --- | | Do the agencies encourage paying? | No. Law enforcement does not encourage, endorse or condone payment. | No. The SafePay advisory's authoring agencies do not encourage paying. | | Does paying guarantee recovery? | No. There is no guarantee of getting the decryption key. | No. Payment does not guarantee files will be recovered. | | Should you report it? | Yes. Use the where to report a cyber incident portal as soon as possible. | Yes. The FBI and CISA urge prompt reporting, whether or not you pay. | Source: nationalcrimeagency.gov.uk, Cybercrime, National Crime Agency, https://www.nationalcrimeagency.gov.uk/what-we-do/crime-threats/cyber-crime (checked 22 October 2026); NCSC, Mitigating malware and ransomware attacks, https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks (checked 22 October 2026); cisa.gov, #StopRansomware: SafePay Ransomware, CISA, https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a (checked 22 October 2026); ICO, Ransomware and data protection compliance, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/ransomware-and-data-protection-compliance/ (checked 22 October 2026); GOV.UK, Financial sanctions guidance for ransomware, https://www.gov.uk/government/publications/financial-sanctions-guidance-for-ransomware/financial-sanctions-guidance-for-ransomware (checked 22 October 2026) ## What should you check before deciding whether to pay? Before deciding whether to pay, check the legal position, the technical options and your reporting duties. The Counter Ransomware Initiative guidance says experts can give access to legal and regulatory advice ([GOV.UK, CRI guidance for organisations during ransomware incidents](https://www.gov.uk/government/publications/cri-guidance-for-organisations-during-ransomware-incidents/cri-guidance-for-organisations-during-ransomware-incidents), checked 22 October 2026). Look at the technical options. The guidance says to consider backups, other sources of decryption keys and how long restoring would take. It warns that criminals will try to convince you that paying is the only way back ([GOV.UK, CRI guidance for organisations during ransomware incidents](https://www.gov.uk/government/publications/cri-guidance-for-organisations-during-ransomware-incidents/cri-guidance-for-organisations-during-ransomware-incidents), checked 22 October 2026). If you have cyber insurance, follow the policy's reporting provisions. Reporting to the authorities early can support you ([GOV.UK, CRI guidance for organisations during ransomware incidents](https://www.gov.uk/government/publications/cri-guidance-for-organisations-during-ransomware-incidents/cri-guidance-for-organisations-during-ransomware-incidents), checked 22 October 2026). Personal data needs its own thought. The ICO does not consider paying a ransom an appropriate measure to restore personal data, or an effective mitigation. If you pay to stop publication, the ICO says to still presume the data is compromised ([ICO, Ransomware and data protection compliance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/ransomware-and-data-protection-compliance/), checked 22 October 2026). Paying does not end your data protection duties. The ICO says to report a personal data breach to it within 72 hours of becoming aware of it. That applies unless the breach is unlikely to result in a risk to people. You still need to reduce the risks to people after paying ([ICO, Ransomware and data protection compliance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/ransomware-and-data-protection-compliance/), checked 22 October 2026). **Before any decision about paying** - Take legal and regulatory advice, including on sanctions. - Check your backups and other sources of decryption keys. - Estimate how long restoring would take. - Report the incident to the authorities. - Follow your cyber insurance policy's reporting provisions. Drawn from the Counter Ransomware Initiative guidance. It is a list of checks, not a recommendation to pay. Source: GOV.UK, CRI guidance for organisations during ransomware incidents, https://www.gov.uk/government/publications/cri-guidance-for-organisations-during-ransomware-incidents/cri-guidance-for-organisations-during-ransomware-incidents (checked 22 October 2026) ## What to do 1. Report the incident through the where to report a cyber incident portal as soon as possible ([GOV.UK, Financial sanctions guidance for ransomware](https://www.gov.uk/government/publications/financial-sanctions-guidance-for-ransomware/financial-sanctions-guidance-for-ransomware), checked 22 October 2026). 2. Check your backups. Ransomware targets backups, so keep offline copies apart from your network ([NCSC, Mitigating malware and ransomware attacks](https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks), checked 22 October 2026). 3. Take legal advice on sanctions before any payment is considered ([GOV.UK, CRI guidance for organisations during ransomware incidents](https://www.gov.uk/government/publications/cri-guidance-for-organisations-during-ransomware-incidents/cri-guidance-for-organisations-during-ransomware-incidents), checked 22 October 2026). 4. Follow your cyber insurance policy's reporting provisions ([GOV.UK, CRI guidance for organisations during ransomware incidents](https://www.gov.uk/government/publications/cri-guidance-for-organisations-during-ransomware-incidents/cri-guidance-for-organisations-during-ransomware-incidents), checked 22 October 2026). 5. If a payment may have reached a designated person, report it to OFSI as soon as practicable ([GOV.UK, Financial sanctions guidance for ransomware](https://www.gov.uk/government/publications/financial-sanctions-guidance-for-ransomware/financial-sanctions-guidance-for-ransomware), checked 22 October 2026). ## Common questions ### Has anyone gone through the process of paying a ransomware company? Some victims do consider paying, and the decision is theirs within the law. The National Crime Agency says paying brings no guarantee of getting your data back, and your computer will still be infected ([GOV.UK, CRI guidance for organisations during ransomware incidents](https://www.gov.uk/government/publications/cri-guidance-for-organisations-during-ransomware-incidents/cri-guidance-for-organisations-during-ransomware-incidents) and [nationalcrimeagency.gov.uk, Cybercrime, National Crime Agency](https://www.nationalcrimeagency.gov.uk/what-we-do/crime-threats/cyber-crime), checked 22 October 2026). ### What happens after you pay a ransomware gang? There may be no decryption key, and attackers may ask again to stop publishing the data. The ICO says groups may also target you again ([ICO, Ransomware and data protection compliance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/ransomware-and-data-protection-compliance/), checked 22 October 2026). ### Does the government play any role when a company needs help with ransomware? Yes. In the UK, sanctions guidance says to use the where to report a cyber incident portal as soon as possible. In the US, the FBI and CISA urge prompt reporting ([GOV.UK, Financial sanctions guidance for ransomware](https://www.gov.uk/government/publications/financial-sanctions-guidance-for-ransomware/financial-sanctions-guidance-for-ransomware) and [cisa.gov, #StopRansomware: SafePay Ransomware, CISA](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a), checked 22 October 2026). ### Does paying a ransom change your duty to report to the ICO? No. The ICO does not view paying the ransom as an effective mitigation measure. It says you still need to consider how to reduce the risks to people after paying ([ICO, Ransomware and data protection compliance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/ransomware-and-data-protection-compliance/), checked 22 October 2026). ## Where next - [After a ransomware or security incident](https://theassurancedesk.com/best/security-incident.md) - [After a breach or ICO contact](https://theassurancedesk.com/best/post-breach.md) - [Ransomware: what to do in the first hour](https://theassurancedesk.com/guides/ransomware-what-to-do-in-the-first-hour.md) - [A data breach has happened: who do you call?](https://theassurancedesk.com/guides/data-breach-who-to-call.md) - [When must you report a personal data breach?](https://theassurancedesk.com/guides/personal-data-breach-when-to-report.md) - [Incident response plan: what to write down](https://theassurancedesk.com/guides/incident-response-plan-what-to-write-down.md) ## Sources - cisa.gov, #StopRansomware: SafePay Ransomware, CISA: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-293a (checked 22 October 2026) - nationalcrimeagency.gov.uk, Cybercrime, National Crime Agency: https://www.nationalcrimeagency.gov.uk/what-we-do/crime-threats/cyber-crime (checked 22 October 2026) - GOV.UK, Financial sanctions guidance for ransomware: https://www.gov.uk/government/publications/financial-sanctions-guidance-for-ransomware/financial-sanctions-guidance-for-ransomware (checked 22 October 2026) - NCSC, Mitigating malware and ransomware attacks: https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks (checked 22 October 2026) - GOV.UK, CRI guidance for organisations during ransomware incidents: https://www.gov.uk/government/publications/cri-guidance-for-organisations-during-ransomware-incidents/cri-guidance-for-organisations-during-ransomware-incidents (checked 22 October 2026) - ICO, Ransomware and data protection compliance: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/a-guide-to-data-security/ransomware-and-data-protection-compliance/ (checked 22 October 2026) - GOV.UK, Government response to ransomware legislative proposals: reducing payments to cyber criminals and increasing incident reporting (accessible): https://www.gov.uk/government/consultations/ransomware-proposals-to-increase-incident-reporting-and-reduce-payments-to-criminals/outcome/government-response-to-ransomware-legislative-proposals-reducing-payments-to-cyber-criminals-and-increasing-incident-reporting-accessible (checked 22 October 2026) - GOV.UK, Ransomware legislative proposals: reducing payments to cyber criminals and increasing incident reporting (accessible): https://www.gov.uk/government/consultations/ransomware-proposals-to-increase-incident-reporting-and-reduce-payments-to-criminals/ransomware-legislative-proposals-reducing-payments-to-cyber-criminals-and-increasing-incident-reporting-accessible (checked 22 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.