Ransomware payments and OFAC sanctions risk
The sanctions exposure a ransom paid to a sanctioned group creates for the victim, its insurer and its incident responders, under OFAC's 2021 advisory and strict civil liability.
Paying, or helping pay, a ransom to a sanctioned party can breach US sanctions law. The Office of Foreign Assets Control, the Treasury office that runs US sanctions, designated Evil Corp and its alleged leader, Maksim Yakubets, on December 5, 2019. When WastedLocker, attributed to the group, hit in 2020, every US victim had to ask whether paying was still lawful. OFAC's advisory of October 1, 2020, superseded by the updated advisory of September 21, 2021, expressly applies sanctions law to the whole chain that facilitates a ransom payment: financial institutions, cyber insurers, incident response firms. The rule is strict liability. Any US person, or any entity operating from the United States, that makes or facilitates a payment to a party on the Specially Designated Nationals list (SDN list) or tied to an embargoed country faces civil penalties even if it did not know, and had no reason to know, that the payee was designated. Criminal prosecution requires a willful violation. For a cyber insurer the exposure is operational: it may have to stop a payment mid-negotiation if attribution of the threat actor turns up a sanctions nexus. OFAC also lists crypto exchanges that launder ransoms, SUEX OTC on September 21, 2021 among them, which pushes compliance well past the direct payment. For the insured, that sanctions exposure weighs against paying, whatever the business case. Not to be confused with the sanctions exclusion clause: the OFAC advisory says what the law prohibits, the clause says what the insurer will not pay. The term shows up in the policy's sanction limitation and exclusion clause, and in the negotiator's mandate, which requires screening before any payment.
Textbook case: a cyber insurer consents to its insured retaining a negotiator to deal with a ransomware group calling itself DarkSide, the name behind the May 2021 Colonial Pipeline attack. Midway through, open-source intelligence suggests some group members have ties to OFAC-listed entities. The insurer suspends its payment authorization and retains specialist outside counsel to run an OFAC compliance review before talks resume. Dated case: on December 5, 2019, OFAC designated the Evil Corp group and its alleged leader, Maksim Yakubets. When WastedLocker, ransomware later attributed to the group, hit in 2020, every US victim had to ask whether paying was still lawful.
- OFAC, Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments, 21 September 2021
OFAC, ransomware sanctions, OFAC advisory 2021, SDN list, strict liability ransomware
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.