Where the prohibition comes from
A ransom is a transfer of value. If the recipient is on a sanctions list, or owned by someone who is, the transfer falls under the general prohibition on making funds available to them. This is sanctions law, and therefore foreign policy, applied at the centre of a cyber claim.
The US Treasury said so on 1 October 2020 and restated it in an updated advisory on 21 September 2021: facilitating a payment to a sanctioned person can give rise to civil liability on a strict liability basis, that is, even without knowledge that the person was sanctioned; OFAC treats prompt reporting to law enforcement and cooperation as mitigating factors (OFAC advisory, Sullivan & Cromwell). The advisory expressly covers those who facilitate payment: insurers, negotiators, incident response firms.
The groups have names
On 5 December 2019 OFAC designated Evil Corp, the group behind the Dridex malware, and its alleged leader Maksim Yakubets (Treasury release, State Department). On 7 May 2024 the United States, the United Kingdom and Australia jointly sanctioned Dmitry Khoroshev, named as the administrator of the LockBit ransomware (Australian Defence Minister, Chainalysis).
The practical effect is immediate. LockBit was for a long time one of the most active groups: since May 2024, a victim of that strain cannot pay without asking whether the money reaches a designated person, and a group can rebrand without changing hands.
The UK and France go further, each in its own way
On 22 July 2025, responding to its January consultation, the UK government announced a targeted ban on ransom payments by the public sector and regulated critical national infrastructure, and a regime requiring other organisations to notify an intention to pay, so that the state can block a payment that would breach sanctions (Government response, gov.uk, The Register).
In France, the law of 24 January 2023 (LOPMI) created article L. 12-10-1 of the Insurance Code: any indemnity for an attack on an information system is conditional on a criminal complaint filed within 72 hours of the victim becoming aware of it, and the rule is mandatory (Lexology, Professions financières). It conditions reimbursement; it lifts no sanction.
What this does to a cyber policy
The extortion insuring clause is still in the wording, but it now depends on a condition neither insured nor insurer controls: the list. Payment goes through screening of the recipient, often run by a negotiator, and through the US 50 percent rule, which extends the prohibition to entities owned by a sanctioned person. The decision to pay stops being a crisis management call and becomes a compliance question, settled in hours.
This is the junction AlgoPolis follows: a state decision, taken far from the loss, sets what the cover is worth on the day it is used. This page describes the law; it does not say whether to pay or which cover to buy.
Where we covered it
None of our published underwriting notes decides this case yet. The article "Ransomware as a financial asset" sets out the basis: the OFAC advisory of September 21, 2021 and the strict liability of whoever pays a sanctioned actor.