UK Ransomware Payments Ban for Public Sector

The UK Home Office has unveiled a Ransomware Payments Ban for public sector bodies and key infrastructure operators, including NHS trusts, energy firms and local councils. Under the Ransomware Payments Ban, any victim planning to pay a ransom must notify authorities in advance. A mandatory incident reporting regime requires a preliminary notice within 72 hours and a full analysis within 28 days. A public consultation held from January 14 to April 8 drew 273 responses (57% organisations, 39% individuals, 4% other). Around 75% supported the ban for public bodies; nearly half backed extending the ban to all sectors. Sixty-three percent favoured the new reporting rules over the voluntary framework. Respondents agreed on penalties for non-compliance but flagged concerns over victim liability and civil versus criminal sanctions. Security Minister Dan Jarvis said the measures aim to break the ransomware business model and protect essential services. Chainalysis data show a 35% year-on-year decline in ransomware attacks. The new rules align the UK with Australia’s mandatory reporting and reflect ongoing US debates. Crypto traders should expect heightened scrutiny of crypto flows linked to illicit activity, though immediate market impact is likely limited.