The payee was listed

Completed on 7 October 2026, decision unchanged, one threshold added. Note No. 15 ("The ransom was agreed"), which will not be published on its own, is folded in: the time of the transfer, which decides what the sanctions clause suspends; the three laws that do not punish the same ignorance; the designation of the groups' suppliers (hosting providers, private networks, crypters), common since 2025; and the costed portfolio scenario that section 3 lacked. Option A remains a decline as presented; section 6 now carries five thresholds instead of four (the fifth: a court decision applying a sanctions clause to a ransom).

This note became a decision on 3 October 2026. It builds the file, sets out what a grid would have returned, and writes three complete decisions. Option A, recommended by the writing underwriter, was chosen under the delegation rule of 29 September 2026: it appears in section 6, with its reason, and the other two remain written.

This is the first decline in the schedule. The notes published before it all concluded "yes, subject to conditions". This one does not force the yes: the analysis leads to a decline as presented, and section 6 says what would reverse it.

Every fact was checked on 1 and 2 October 2026, then on 7, 16 and 19 October, or withdrawn. The list in section 9 gives, for each fact, its source and what became of it. Web access was partial: a search engine answered, but the official pages (US Treasury, EUR-Lex, the Council of the EU, Légifrance, gov.uk) were blocked from the drafting machine. "Checked" therefore means: found by exact-phrase search, the title and excerpt of the primary source read, and confirmed by a second source, a law firm, an agency or a specialist publication. No text was read in full, and the note says so wherever it matters.

Proposed review date: 2 November 2027. On that date the note will be read again against what actually happened, and the review will be published at the top, whether it proves the chosen decision right or wrong.

The sanctions are public, the insured is fabricated. The designations, advisories, regulations and dates cited here are real. The company seeking cover does not exist: it combines situations common in the trade. The note says what an underwriter would decide; it tells no one what to buy or where, and carries no recommendation on cover, limit, deductible or premium.

0. Why this case

The site's guiding line holds that political risk already sits inside the cyber contract: the war exclusion, attribution to a State, and the sanction that makes a ransom unlawful. Notes No. 2 and 4 dealt with the first two. This one deals with the third, the most concrete of the three: it is decided within hours, while the insured's servers are encrypted, long before any court hears it.

Ransomware is a private crime. The day a State puts the group behind it on a sanctions list, the same claim changes nature: paying becomes an offense, so does facilitating the payment, and the exit the insured had planned closes. The note asks what a cyber policy is worth when the insured's recovery depends on a payment that an act of State can prohibit overnight.

1. The risk

The public facts

On 5 December 2019, the US Treasury (OFAC) designated Evil Corp and its leader, Maksim Yakubets, for the Dridex malware, and noted that Yakubets provided direct assistance to the Russian government's cyber operations.

On 1 October 2020, OFAC published a first advisory on the sanctions risks of ransom payments. Besides the victim, it names cyber insurers, financial institutions and incident response firms that facilitate payment. It recalls that civil liability is strict: a person subject to US jurisdiction may be held liable "even if it did not know or have reason to know" that the transaction was prohibited. On 21 September 2021, an updated advisory replaced it: it discourages any payment and treats prompt reporting and cooperation with the authorities as mitigating factors. A license to pay remains possible, reviewed case by case, with a presumption of denial.

On 7 May 2024, the United States, the United Kingdom and Australia designated on the same day Dmitry Khoroshev, the leader of LockBit. On 1 October 2024, a trilateral action against Evil Corp designated, among others, Aleksandr Ryzhenkov, a LockBit affiliate. That is where the two names meet: a payment to an affiliate of one brand can reach a person designated under another.

Since 2025, governments also designate the groups' suppliers. On 11 February 2025, the United States, the United Kingdom and Australia designated Zservers, a Russian hosting provider that rented its servers to LockBit affiliates; on 19 November 2025, the same three countries designated the hosting provider Media Land, used by LockBit, BlackSuit and Play; on 13 July 2026, OFAC designated a virtual private network sold to ransomware groups (First VPN Service) and a vendor of "crypters", the tools that disguise malware. One supplier serves several groups: its designation makes ransoms to every one of them unpayable on the same day.

And designated groups rebrand. In June 2022, Mandiant assessed "with high confidence" that a group overlapping with Evil Corp had dropped its own ransomware for LockBit's, to hamper attribution and evade sanctions.

In Europe, Regulation (EU) 2019/796 of 17 May 2019 sets up the sanctions regime against cyberattacks. Its Article 3(2) prohibits making funds available, "directly or indirectly", to a listed person. The first ransomware actors were listed on 24 June 2024 (Conti, Trickbot); on 13 July 2026, the Council listed, among others, Vitaly Kovalev, known as "Stern", an administrator of Trickbot credited with more than USD 300 million in ransoms, in action coordinated with the United States and the United Kingdom. The same day, the EU listed under this regulation a hosting provider, Media Land, and its sister company ML.Cloud, for enabling large-scale ransomware campaigns: the EU too now designates suppliers.

EU law does not punish the same ignorance as US law. Article 2a of the same regulation excludes any liability for a person who "did not know, and had no reasonable cause to suspect" that their action would infringe the measures. OFAC strikes even those who did not know.

In the United Kingdom, OFSI published its guidance on 15 February 2024: paying a person whose assets are frozen is an offense, and voluntary disclosure mitigates. On 22 July 2025, the government announced a ban on ransom payments for the public sector and operators of critical national infrastructure. As of 19 October 2026, the ban is announced, not in force: no text carrying it has been adopted, its threshold and penalties are left to implementing legislation, and the Cyber Security and Resilience Bill, a separate text, is still before Parliament.

In France, Article L. 12-10-1 of the Insurance Code, in force since 24 April 2023, makes indemnity for losses from a cyberattack, ransom included, conditional on a criminal complaint filed within seventy-two hours. Payment is not prohibited: it is regulated, and EU law applies on top.

The insured, fabricated

A French temperature-controlled logistics group, EUR 640 million in revenue, seventeen warehouses. Fourteen are in France; three in the United Kingdom, run by an English subsidiary, including a port warehouse storing medical products on behalf of public hospitals. A US subsidiary, in Newark, handles the flows of a transatlantic customer and holds a dollar account.

All operations run on a single warehouse management system, hosted in two of the group's server rooms, and on one corporate directory shared by the three countries. Backups are daily, on storage joined to the same directory. The last full restoration test dates from March 2024: it took nineteen days.

The proposal form, asked "what do you do in case of widespread encryption", answers: "call on a specialist negotiation and recovery provider within forty-eight hours". Nothing in it describes a recovery without payment.

The request is a cyber policy in the London market: incident response costs, business interruption, extortion, liability.

The exposure, bounded

The figures below are assumptions of the fabricated file (section 9, fact 16). One day of full shutdown costs the group EUR 1.2 million in lost margin and extra costs (perishable goods destroyed, substitute transport, customer penalties). The ransom demand assumed is EUR 4 million.

1. If the ransom can be paid and the key works, recovery takes six days: 7.2 million of business interruption, 4 million of ransom, 1.5 million of costs. About EUR 12.7 million.
2. If the ransom cannot be paid because the payee is listed, or becomes listed during the negotiation, recovery runs from backups part of which will have been encrypted with the rest: twenty-four days at best, on the strength of the 2024 test. 28.8 million of business interruption and 2.5 million of costs: about EUR 31 million, two and a half times the first case.
3. If the backups are lost, which is the first aim of a group that encrypts a directory, rebuilding takes six weeks or more: over EUR 50 million, before counting lost customers.

The sanction does not remove the loss, it moves it: from the extortion line, which it makes unpayable, to business interruption, which it multiplies. Excluding extortion or suspending it by a clause does not reduce the exposure of this file; it removes the 4 million that shorten it.

2. What is missing

A recovery without payment, demonstrated. How many days to bring the warehouse management system back to the fourteen French sites, from backups the attacker could not have reached? The 2024 test says nineteen days with intact backups; it says nothing of their isolation. It is the only figure that bounds the loss when the ransom is prohibited, and the file does not have it.

Who would pay, and with what money. Is the negotiation provider a company subject to US or UK jurisdiction? Would the payment leave from the Newark subsidiary's dollar account? A transaction that involves a US person, the subsidiary included, falls under the OFAC rule, and liability is strict. I do not know how the group would pay, and the proposal form does not say.

What would become of the English port warehouse. If it is classed as critical infrastructure on the day the UK ban comes into force, the English subsidiary will no longer be able to pay at all, whoever the payee. Could the group pay from France for a system shared by the three countries? I do not know, and no adopted text says yet.

The payee screening procedure. Before any payment, who screens, against which lists (OFAC, EU, UK), and how long does it take? A group changes its name, an affiliate works for several brands: screening is not about a name, it is about attribution, and it takes time that business interruption does not allow. It also covers the group's suppliers: the hosting provider the group rents from can be designated without the group being designated.

3. The signals

Retained

The risk lies in the identity of the payee, which is almost never known at the time of payment. On 1 October 2024, a LockBit affiliate was designated as part of Evil Corp: whoever pays one brand may be paying another person. And US liability is strict: not knowing that the payee is designated is no defense.

The time of the transfer decides, not the date of the loss. A ransom paid the day before a designation was lawful when it left: reimbursing it to the insured makes no funds available to the group, and the sanctions clause has nothing to suspend. The same ransom, agreed the day before but paid an hour after the designation, is not reimbursed, and the recovery it was meant to buy does not happen. Between those two moments, the loss in this file moves from about EUR 12.7 million to 31 million (section 1).

Three laws, one purse. The parent company is French: EU law punishes it only if it knew or had reasonable cause to suspect (Article 2a). Its Newark subsidiary and its dollar account fall under OFAC's strict liability. Its English subsidiary and the London insurer fall under the UK regime. The strictest of the regimes that reach the payment sets what the group can pay; as long as the file does not say who would pay and from which account (section 2), that is the strictest of the three.

The law is tightening, always in the same direction. A US advisory in 2020, replaced and hardened in 2021; first EU listings in 2024, more in 2026; UK guidance in 2024; a UK ban announced in 2025. A policy incepting on 1 January 2027 runs under the lists of 2027, and each new listing applies to claims in progress.

This file is the one the sanction changes most. An insured that recovers in six days without paying loses little if the ransom is prohibited. This one wrote, in its proposal form, that its recovery goes through negotiation. Its severity depends on a list it does not control.

Business interruption is perishable. In temperature-controlled logistics, a day of shutdown destroys goods: the pressure to pay fast is the highest in the market, and payee screening happens under that pressure.

Victims pay less and less. Chainalysis counts USD 820 million in ransoms in 2025, 8% less than in 2024, and a payment rate down to 28%, the lowest it has measured; it attributes the decline in part to better incident response, regulatory pressure and law enforcement action. That holds for the market, not for this file: an insured that can only recover by paying is the one this decline leaves most exposed.

Set aside

The second door: attribution to a State. The 2019 designation notes that Yakubets assists the Russian government's cyber operations. An insurer might be tempted to infer that an Evil Corp attack is a state cyber operation within the meaning of clauses LMA 5564 to 5567 (notes No. 2 and 4). I set it aside: a designation says who is punished, not who carried out a given attack, and those clauses read attribution first in the word of the State where the affected systems are located, here France. The file turns on the sanction, not on war.

The lack of precedent. No penalty imposed on an insurer for reimbursing a ransom was found (section 9, set aside 4). That does not make the risk nil: liability is strict, and a first case needs no precedent.

The sector. Logistics is no more targeted than any other sector. What counts is the dependence on a single system and recovery by payment, which one would find in a clinic or a factory.

The wording that matters: the sanctions clause

The most widely used market wording, LMA 3100 of 15 September 2010, reads: "No (re)insurer shall be deemed to provide cover and no (re)insurer shall be liable to pay any claim or provide any benefit hereunder to the extent that the provision of such cover, payment of such claim or provision of such benefit would expose that (re)insurer to any sanction, prohibition or restriction under United Nations resolutions or the trade or economic sanctions, laws or regulations of the European Union, United Kingdom or United States of America."

What it does to this file, read word by word:

1. "to the extent that": the clause suspends, it does not extinguish. The English High Court so held on 12 October 2018 (Mamancochet Mining v Aegis), on a clause of the same make. While the payee is listed, the insurer does not reimburse the ransom; it will reimburse it only when the listing is lifted, if it ever is, long after recovery. The same judgment bounds the clause the other way: it applies only if, and for as long as, payment would actually be prohibited, and the mere risk of being sanctioned is not enough. Before the designation, the insurer cannot rely on it, however much it fears one. The Swiss Federal Supreme Court applied this to an Evil Corp ransom on 17 August 2023 (4A_206/2023, WastedLocker): the insurer relying on the clause must prove that the payee is in fact the listed person, and the malware's brand is not proof. The UK Supreme Court said the same of the statute itself on 25 March 2026 (UniCredit v Constitution Aircraft Leasing, [2026] UKSC 10, letters of credit under the Russia regime): the duty to pay waits for a license, which must be sought. For a ransom, OFAC presumes denial (fact 22): the suspension lasts.
2. "payment of such claim": the clause protects the insurer against the payment that would expose it. It does not protect it against the business interruption that non-payment causes, which exposes no one to any sanction and which the policy still owes. That is the heart of the file: the clause removes 4 million and leaves 31.
3. French law: the Paris Court of Appeal, on 21 June 2022, characterized a sanctions clause in a D&O policy as an exclusion and set it aside for lack of precision. The market answered on 5 October 2023 with LMA 3100A and LMA 3200. Under French law, the clause itself may fall; Regulation 2019/796, for its part, prohibits making funds available whatever becomes of the clause.

Is an insurer's reimbursement of a ransom already paid to a listed person an "indirect" making available within the meaning of Article 3? No text or decision read settles it. The note treats it as a risk, not a certainty. Article 2a changes nothing for an insurer that reimburses after the listing is published: it can no longer argue that it had no reasonable cause to suspect.

The accumulation, and the scenario that would hurt

The accumulation in this risk is legal. A common vulnerability hits insureds running the same software; a listing hits all insureds negotiating with the same group, on the same day, whatever their software. An active group has dozens of open victims at a time. And since 2025, the key has moved one step up: when a government designates the hosting provider or private network that several groups rent (section 1), the listing hits on the same day every insured negotiating with any of those groups.

The scenario that would hurt: a very active group is listed by the EU or by OFAC on a Tuesday. That day, every claim in progress against that group switches from "ransom paid, recovery in six days" to "ransom impossible, recovery in four weeks". Settled files do not move; open files are multiplied by two or three, all together, on a single decision of State. The portfolio's severity no longer depends on its insureds but on a sanctions calendar none of them knows.

Costed on a fabricated portfolio (section 9, fact 27): two hundred and fifty European insureds in manufacturing and logistics. One afternoon, a hosting provider is designated, and four of them are negotiating with groups that rent from it. For an insured of the portfolio's average size (EUR 350,000 per day of shutdown, a ransom of 2 million), recovery goes from six to twenty-four days and the claim from about 4.7 to 9.6 million: 4.9 million more per insured, about EUR 20 million for the four, triggered by a single act of State. If one of the four is the insured in this file, its gap alone is 18.6 million, and the total exceeds 33 million. The loss experience of a ransomware wave is priced on the frequency of attacks; this one arises on a date no one chooses, and hits files already open: it is an event, not a frequency.

What the insurer does with this accumulation is not for this note, which sets no limit: it says only that the accumulation key for extortion is the criminal group and its suppliers, and the severity key is their place on a list.

4. What an engine would have decided

The grid

An ordinary cyber appetite grid would have read this:

sector               logistics                            compliant
revenue              EUR 640 m                            compliant
backups              daily                                favorable
recovery test        performed (March 2024)               favorable
response plan        provider within 48 h                 favorable
authentication       MFA on remote access                 favorable
claims               none reported                        favorable
sanctions            LMA 3100 in the contract             compliant
countries            France, United Kingdom, US           compliant
accumulation         ransomware wave                      per rate table
------------------------------------------------------------
result               acceptance

sector

logistics

compliant

revenue

EUR 640 m

compliant

backups

daily

favorable

recovery test

performed (March 2024)

favorable

response plan

provider within 48 h

favorable

authentication

MFA on remote access

favorable

claims

none reported

favorable

sanctions

LMA 3100 in the contract

compliant

countries

France, United Kingdom, US

compliant

accumulation

ransomware wave

per rate table

result

acceptance

The engine accepts, and on what it reads it is right. The backups exist, recovery has been tested, a provider is retained, the sanctions clause is in the contract.

Where judgment departs from it, and why

At three lines that read together: "backups: favorable", "response plan: favorable" and "sanctions: compliant". The engine reads them as three protections. I read them as a single assumption: that the ransom can be paid.

1. The backups are joined to the directory that ransomware encrypts first. The engine ticks their existence; it does not ask whether the attacker can reach them.
2. The response plan is a payment plan. "Negotiation provider within 48 hours" is a favorable line for the grid; it is an admission that recovery goes through the ransom.
3. The sanctions clause is ticked as a protection for the insurer. It is one for reimbursing the ransom; it is not one for the business interruption that follows the refusal to pay, and that loss is what makes the severity.

A fourth line, "accumulation: per rate table", counts independent attacks, at their frequency. A designation hits files already open in an instant (section 3): the engine does not see it, because it is not an attack.

What the review will settle. On 2 November 2027, we will know whether a new listing targeted an active group, and whether victims had to recover without paying. If no listing touched an active group, the grid was right over the period, and judgment will have to say whether its decline was worth what it cost.

5. The three possible decisions

Each is complete and defensible. None recommends a cover, limit, deductible or premium to the insured: they say whether this risk is written, and on what information.

Option ANo, as presented

The file is declined as presented, with the reason given: its recovery rests only on a payment that an act of State can prohibit at any time, and the sanctions clause does not protect against the loss that follows. The decline is not final. The file is reconsidered on three facts:

1. a full restoration test from backups isolated from the production directory, performed and dated, showing in how many days the warehouse management system returns without payment;
2. the written payee screening procedure, documented and time-stamped, before any payment, against the US, EU and UK lists, the group's known hosting provider and suppliers included, with the entity that would pay and the account the funds would leave from;
3. the position of the English subsidiary under the announced ban: is its port warehouse, or will it be, critical infrastructure within the meaning of the implementing legislation.

These are not recommendations made to the insured: they are the facts without which no one knows whether its most likely loss lasts six days or six weeks.

Option BYes, without extortion

The file is written, but not the extortion section: the policy covers incident response, business interruption and liability, and reimburses no ransom. The lawfulness question leaves the contract. It is the easiest decision to defend before a regulator. It has a flaw that section 1 puts a number on: it keeps business interruption, which is the exposure, and removes the ransom, which shortened it. It does not decline the risk; it declines its cheapest part.

Option CYes, on the engine's terms

Accept, as the grid did. The backups exist, recovery has been tested, a provider is retained, the sanctions clause is in the contract; no penalty has ever been imposed on an insurer for a reimbursed ransom. Declining because the payee of a future ransom might be listed one day is pricing a list that does not yet exist.

6. What would prove each option wrong

A would be wrong if, by 2 November 2027, no new listing had targeted an active group, and ransomware victims had kept paying and recovering fast: the decline would have cost an insured for a risk that did not occur. It would also be wrong if the insured readily produced a recovery test without payment in under ten days: the file was good, and only the proposal form hid it.

B would be wrong if a claim occurred at a similar insured whose ransom was lawful and whose key worked: the policy would have paid four weeks of business interruption that six days and a ransom would have avoided. It would be wrong again if the four-week business interruption happened anyway: B would have accepted the exposure it claimed to reduce.

C would be wrong if a new listing occurred during an open negotiation, or if a first penalty hit an insurer or a negotiator for a ransom paid. In each case, the policy accepted on the strength of "backups: favorable" would have paid the long loss, the one the grid did not see.

What would change my mind before inception

The policy would incept on 1 January 2027 (date of the fabricated file). Here, dated, are the facts that would move option A before that date.

1. By 1 December 2026, the insured provides a restoration test from isolated backups, in ten days or less: the file moves to acceptance subject to information conditions, like notes No. 2 to 4. The sanction no longer transforms the loss, it only removes the shortcut.
2. By 1 December 2026, the insured provides the test, but over twenty days: option B at best, and only if the long business interruption is treated as the exposure it is.
3. Before inception, the UK ban is adopted and the port warehouse falls within it: the decline holds for any file whose system is shared with the English subsidiary, whatever the answer to the first two points, until the text says whether a foreign parent may pay for a shared system.
4. Before inception, OFAC, OFSI or a European authority penalizes an insurer or a negotiator for a ransom paid: the file is reconsidered, and the risk of indirect making available that section 3 leaves open becomes a fact.
5. Before inception, a court decision applies a sanctions clause to a ransom and says whether it reaches business interruption: if it does, the long loss leaves the policy, the central reason for option A falls, and the file is reconsidered on thresholds 1 and 2 alone. Added on 7 October 2026.

These thresholds will be reread on 2 November 2027 with the facts of section 7.

The writing underwriter's recommendation

Option A. Reason: the loss in this file depends less on the insured than on a sanctions list, and the sanctions clause protects only against the smaller of the two losses a listing causes. B removes the ransom and keeps the loss it avoided; C reads three favorable lines where there is only one assumption, that payment will stay lawful. A does not decline the insured, it declines its recovery plan, and says what would reverse it.

The decision below adopts this recommendation. Had a contrary decision chosen B or C, it would have prevailed, and the note would have carried both, disagreement included.

Decision: Option A, no as presented, adopted on the writing underwriter's recommendation under the delegation rule of 29 September 2026: the file as presented is declined, and the five thresholds in section 6 say which dated facts would reopen it, starting with a test showing systems restored without payment within ten days.

Reason in one sentence: The loss in this file depends less on the insured than on a sanctions list, and the sanctions clause protects only against the smaller of the two losses a listing causes; A does not decline the insured, it declines its recovery plan.

Date of decision: 3 October 2026

Review date: 2 November 2027 (proposed, and open to change)

7. The review

On 2 November 2027, or on the date set. The insured being fabricated, the review bears only on public facts. We will look, in this order, for seven verifiable facts:

1. A new listing of an active ransomware group by the EU (Official Journal), OFAC or the United Kingdom, between 2 November 2026 and the review date, with the group and the date.
2. A public victim that had to recover without paying because the payee was listed, and how long its recovery took, against the six and twenty-four days of section 1.
3. The actual adoption of the UK ban, its date of entry into force, and what it says about a system shared with a foreign parent.
4. A penalty imposed on an insurer, a negotiator or an institution for a ransom payment, in the United States, the EU or the United Kingdom.
5. A first published decision applying Article L. 12-10-1 of the French Insurance Code, on the seventy-two-hour deadline.
6. The year's designations: how many target an active group or supplier (hosting provider, private network, crypter), and how many a person from a dismantled group.
7. The annual total of ransoms paid and the payment rate: if they fall further, the extortion component fades, and recovery without payment becomes the ordinary loss, designation or not.

The review will say which occurred, what it does to the retained option, and who was right, the grid or judgment. If none of the first five occurred, it will say so too, and option C will be credited with its win.

8. Objections

Adversarial review, played by a political risk reviewer in the role of a senior London market underwriter who has spent fifteen years reading sanctions clauses on credit and expropriation policies. The three hardest objections, and the answers.

Objection 1 · "No one has ever been penalized for a reimbursed ransom."

"You are declining a risk over a penalty that has never been imposed. OFAC publishes advisories, not fines against insurers. Your decline prices a fear."

Answer. The objection is right on the fact, and the note itself sets it aside as a signal (section 3). But the decline does not rest on a penalty against the insurer: it rests on what the listing does to the insured. The day the payee is listed, no serious professional pays, penalty or not, and business interruption lengthens. What costs is the long recovery, far more than the fine, and that needs no precedent. Nor is listing rare anymore: in eighteen months, Zservers, Media Land, a private network and a crypter vendor (section 1). Governments are moving up the chain, and every link they designate serves several groups.

Objection 2 · "You are declining a backup flaw. That is engineering."

"Backups joined to the directory are an auditor's recommendation, not an underwriting reason. Ask for a fix, do not decline."

Answer. That is exactly what option A does: it declines the file as presented and names the fact that reopens it. But the backup flaw is not an engineering matter in this file, because it changes the nature of the loss under sanction. The same flaw at an insured whose ransom stays lawful costs six days; here it costs the difference between twelve and thirty-one million, on a decision of State that neither insured nor insurer controls. That is where political risk and cyber meet, and it is why this note is about cyber and not about engineering.

Objection 3 · "LMA 3100 is enough."

"Your insurer is protected: if it cannot pay the ransom, the clause suspends. Why decline a risk whose unlawful part is already neutralized?"

Answer. Because the clause neutralizes the cheapest part. It suspends reimbursement of 4 million; it leaves business interruption owed, which goes from 7 to 29 million because of the suspension. The clause does not remove the risk from the contract, it moves it from one line to another and multiplies it on the way. And under French law, since the ruling of 21 June 2022, it is not even settled that it holds.

9. The facts checked

Fact file of 1 October 2026, rechecked on 2 October 2026, completed and rechecked on 7 October 2026 with note No. 15, folded in (facts 17 to 27). Twenty-five public facts and two file facts; five set aside. Partial web access, stated at the top of the note; the links are in the instruction of note No. 6. Presented as a list, as the note pages do not render tables. No text was read in full.

1. 5 December 2019: OFAC designates Evil Corp and Maksim Yakubets, for Dridex, and notes his assistance to the Russian government's cyber operations. Treasury press release (reproduced by GlobalSecurity); Willkie Farr & Gallagher, 9 December 2019. Checked, kept.
2. 1 October 2020: first OFAC advisory on ransoms, naming cyber insurers. CISA, 2 October 2020; Morrison Foerster, 7 October 2020. Checked, kept.
3. Strict liability, "even if it did not know or have reason to know". OFAC advisory (title and excerpt read, page blocked); Jones Day, October 2020. Checked, kept; wording corrected on 2 November 2026, "it", not "such person" (Mayer Brown, Mondaq).
4. 21 September 2021: updated advisory, replacing the 2020 one. Hunton Andrews Kurth; Covington. Checked, kept. The text was not read in one piece.
5. 7 May 2024: Dmitry Khoroshev, leader of LockBit, designated the same day by the United States, the United Kingdom and Australia. Treasury (GlobalSecurity); Mayer Brown, week of 6 May 2024. Checked, kept.
6. 1 October 2024: trilateral action against Evil Corp, including Aleksandr Ryzhenkov, a LockBit affiliate. UPI, 1 October 2024; TRM Labs. Checked, kept.
7. Regulation (EU) 2019/796, Article 3(2): "directly or indirectly". EUR-Lex (excerpt); text preserved by legislation.gov.uk. Checked, kept. The article was not read in full.
8. 24 June 2024: first listings of ransomware actors (Conti, Trickbot). Council of the EU, press release of 24 June 2024; Bitdefender. Checked, kept.
9. 13 July 2026: Vitaly Kovalev, known as "Stern", listed; more than USD 300 million in ransoms attributed; coordinated action. EUR-Lex (Implementing Regulation 2026/1714); Chainalysis; rechecked on 2 October: Council press release and Crowdfund Insider. Checked, kept. Reservation maintained: the Council press release announces "nine individuals and four entities" for Russian cyberattacks and destabilizing activities, a summary of the regulation says eight persons; the note gives no number.
10. 15 February 2024: OFSI guidance on ransomware and sanctions. Regulation Tomorrow (Norton Rose Fulbright); WorldECR. Checked, kept.
11. 22 July 2025: ban announced for the public sector and critical infrastructure. Pinsent Masons; Burges Salmon. Checked, kept. Reservation lifted on 2 October 2026: as of 2 October, the ban is not in force and requires implementing legislation (Computer Weekly; CyberGen Security, "before it becomes law"). The note says "announced, not in force". Rechecked on 7 October: still no text adopted (fact 26).
12. Article L. 12-10-1 of the French Insurance Code, complaint within seventy-two hours, ransom included, in force on 24 April 2023. Les Surligneurs; INCYBER. Checked, kept. Légifrance blocked.
13. Text of LMA 3100 of 15 September 2010. Note No. 3, fact 37. Reused.
14. Mamancochet Mining v Aegis, [2018] EWHC 2643 (Comm), 12 October 2018: the clause suspends. Note No. 3, fact 38. Reused.
15. Paris Court of Appeal, 21 June 2022, RG 20/10832; LMA 3100A and 3200 of 5 October 2023. Note No. 3, facts 40 and 41. Reused.
16. Figures in section 1: EUR 1.2 million per day of shutdown, ransom of 4 million, recoveries of six, twenty-four and over forty days, a nineteen-day test in March 2024. Assumptions of the fabricated file, not public facts. Arithmetic: 6 × 1.2 = 7.2; + 4 + 1.5 = 12.7; 24 × 1.2 = 28.8; + 2.5 = 31.3. Added, open to discussion.
17. 11 February 2025: Zservers designated by the United States, the United Kingdom and Australia; 127 servers seized the next day. Baker McKenzie, Sanctions News; OCCRP; Treasury press release sb0018 (title and excerpt). Taken from note No. 15, checked, kept.
18. 19 November 2025: Media Land designated by the same three countries, host to LockBit, BlackSuit and Play. Treasury press release (reproduced by GlobalSecurity); OCCRP; BleepingComputer. Added on 7 October, checked, kept.
19. 13 July 2026: First VPN Service, its administrator and a crypter vendor designated by OFAC. Treasury press release sb0559 (reproduced by GlobalSecurity); Herbert Smith Freehills Kramer; TRM Labs. Taken from note No. 15, checked, kept.
20. 13 July 2026: the EU lists Media Land and ML.Cloud under Regulation 2019/796. Council press release of 13 July 2026 (title and excerpt); Industrial Cyber; summary of the implementing regulation by Lovguiden. Added on 7 October, checked, kept.
21. June 2022: a group overlapping with Evil Corp moved to LockBit to evade sanctions (Mandiant). Google Cloud (Mandiant); The Register, 3 June 2022. Taken from note No. 15, checked, kept.
22. OFAC's presumption of denial for licenses since 21 September 2021. Honigman; Mondaq. Taken from note No. 15, checked, kept.
23. Article 2a of Regulation 2019/796: no liability for a person who did not know and had no reasonable cause to suspect. Consolidated text reproduced by Better Regulation; legislation.gov.uk. Taken from note No. 15, checked, kept.
24. **Mamancochet: the clause applies only if payment is actually prohibited; the mere risk is not enough.** Official summary (judiciary.uk); HFW. Taken from note No. 15, checked, kept.
25. Chainalysis, 2025: USD 820 million, down 8%, payment rate of 28%. BleepingComputer; Infosecurity Magazine; Computing. Added on 7 October, checked, kept. Chainalysis itself says the 2025 total may approach 900 million as more payments are attributed.
26. As of 19 October 2026, the UK ban is carried by no adopted text; threshold and penalties left to implementing legislation. Goodwin, February 2026; Taylor Wessing, 2026; CyberGen Security. Checked, kept; rechecked on 16 and 19 October 2026, no bill found since.
27. Portfolio figures (section 3): two hundred and fifty insureds, four in negotiation, EUR 350,000 per day of shutdown, a ransom of 2 million, recoveries of six and twenty-four days, incident response of 0.6 and 1.2 million. Assumptions of the fabricated portfolio, taken from note No. 15. Arithmetic: 6 × 0.35 + 2 + 0.6 = 4.7; 24 × 0.35 + 1.2 = 9.6; gap 4.9; 4 × 4.9 = 19.6; 3 × 4.9 + 18.6 = 33.3. Added, open to discussion.
28. Swiss Federal Supreme Court, 17 August 2023, 4A_206/2023: an insurer relying on a sanctions clause against reimbursement of a ransom paid after WastedLocker must prove that the attack came from Evil Corp and that Evil Corp benefited; the malware's brand is not enough. cdbf.ch (Célian Hirsch, 23 October 2023) and summaries; the judgment itself was not read from the drafting machine. Added on 28 October 2026 (review of the 25th). It concerns reimbursement, not business interruption: threshold 5 is not met.
29. *UK Supreme Court, 25 March 2026, UniCredit Bank GmbH v Constitution Aircraft Leasing (Ireland) 3 Ltd, [2026] UKSC 10: the duty to pay under standby letters of credit is suspended by the sanctions regime until a license is obtained, and reasonable efforts must be made to obtain one.* TLT; HFW; CMS; Linklaters. Added on 28 October 2026. Letters of credit under the Russia regime, not a ransom: the note takes only the suspension rule from it.

Set aside, with the reason:

1. "On 6 December 2019, seventeen individuals and seven entities": a single source, which contradicts the date of the 5th. The number is not cited.
2. The number of persons listed on 13 July 2026: two conflicting sources, see fact 9.
3. The date the UK ban enters into force: no source gives it, see fact 11.
4. A penalty imposed on an insurer for a reimbursed ransom: none found; the note does not assert that one exists. Searched again on 7 October: none.
5. The amount paid by Garmin in 2020 (note No. 15): press only, conflicting figures; the case is not used.

What the check changes to the decision. Nothing. The pivot of the note is not a penalty that fell, it is the combination of three established facts (strict liability, the listing of active groups, the structure of the market clause) and one file fact, recovery by payment. What folding in note No. 15 on 7 October changes. The decline comes out stronger: the designation of suppliers, by the EU too since July 2026, widens the accumulation key, and the costed portfolio shows what section 3 only stated. One threshold is added (section 6, threshold 5).

What has still not been read in full. Paragraph 2 of Article 3 of Regulation 2019/796 was found word for word at two sources on 7 October ("No funds or economic resources shall be made available, directly or indirectly, to or for the benefit of" a listed person); the whole article and the OFAC advisory of 21 September 2021 are still read by passages, the official pages being blocked from the drafting machine. The note relies on them only for the passages it quotes.

Public sources cited. US Treasury (OFAC), designation of Evil Corp of 5 December 2019, advisories of 1 October 2020 and 21 September 2021, designations of 7 May and 1 October 2024. Regulation (EU) 2019/796 of 17 May 2019; Implementing Regulation (EU) 2024/1778; Implementing Regulation (EU) 2026/1714; Council press releases of 24 June 2024 and 13 July 2026. OFSI, guidance of 15 February 2024. UK government, consultation response, 22 July 2025. French Insurance Code, Article L. 12-10-1. Designations of Zservers (11 February 2025, sb0018), Media Land (19 November 2025) and First VPN Service (13 July 2026, sb0559); Council press release of 13 July 2026 (Media Land, ML.Cloud). Regulation (EU) 2019/796, Articles 2a and 3. Mandiant (Google Cloud), June 2022. Chainalysis, 2026 report on 2025. LMA 3100, 3100A and 3200. Mamancochet Mining Ltd v Aegis Managing Agency Ltd, [2018] EWHC 2643 (Comm). Paris Court of Appeal, 21 June 2022, RG 20/10832. Swiss Federal Supreme Court, 17 August 2023, 4A_206/2023. UK Supreme Court, UniCredit Bank GmbH v Constitution Aircraft Leasing (Ireland) 3 Ltd, [2026] UKSC 10, 25 March 2026.