Paying Ransomware in Crypto: The OFAC Sanctions Risk

Paying a ransomware demand in crypto can break US sanctions law if the attacker, or the exchange that cashes out the ransom, is sanctioned. OFAC can penalise that payment even if the payer did not know, and the US government strongly discourages paying at all. For everyone else, coins that trace back to ransomware are a high-risk label in an AML report, because exchanges and banks are told to watch for exactly that link.

What the OFAC advisory says

On 21 September 2021 OFAC, part of the US Treasury, issued its "Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments". It replaced an earlier advisory of 1 October 2020.^[1]

The key points:

• The US government strongly discourages paying. The advisory says this applies to all private companies and citizens. It recommends investing in defence and resilience instead.^[1]
• Facilitators are in scope. OFAC names financial institutions, cyber insurance firms and digital forensics and incident response companies. It says firms that pay on a victim's behalf may also risk violating OFAC rules.^[1]
• Liability is strict. OFAC may impose civil penalties even if the person did not know or have reason to know the deal was prohibited.^[1]
• Licences are unlikely. Applications to make ransomware payments are reviewed case by case "with a presumption of denial".^[1]
• Paying guarantees nothing. OFAC notes there is no guarantee a company will get its data back or avoid further attacks.^[1]

The advisory is explanatory only. It says it does not have the force of law and does not change the underlying regulations.^[1] This post is not legal advice either.

What counts in your favour

OFAC lists mitigating factors it will weigh in any enforcement case:^[1]

• meaningful steps to improve cybersecurity, such as offline backups, incident response plans, staff training and authentication protocols;
• a self-initiated and complete report of the attack to law enforcement or other agencies, such as CISA, made as soon as possible after discovery. OFAC treats this as a voluntary self-disclosure;
• full and ongoing cooperation, including sharing technical details, the ransom demand and the payment instructions.

When these steps are taken, OFAC says it is more likely to close a case with a non-public response, such as a No Action Letter or a Cautionary Letter.^[1]

Who OFAC has designated

The advisory recalls earlier designations of ransomware actors. They include the developer of Cryptolocker in 2016, two Iranians linked to SamSam ransomware in 2018, and Lazarus Group, which the advisory links to WannaCry 2.0, in 2019. It also mentions Evil Corp and its leader in December 2019, for the Dridex malware.^[1]

On the same day as the advisory, OFAC designated SUEX OTC, S.R.O., a virtual currency exchange. Treasury said SUEX handled proceeds from at least eight ransomware variants. Over 40% of its known transactions were linked to illicit actors. Treasury called it the first sanctions designation of a virtual currency exchange.^[2]

On 8 November 2021 OFAC added Chatex, another virtual currency exchange. Treasury said over half of Chatex's known transactions were tied to illicit or high-risk activity, including darknet markets, high-risk exchanges and ransomware. Chatex used SUEX as an intermediary exchange. Three companies that built Chatex's infrastructure were designated too: IZIBITS OU, Chatextech SIA and Hightrade Finance Ltd. The same action designated two people tied to the Sodinokibi/REvil ransomware, Yaroslav Vasinskyi and Yevgeniy Polyanin.^[3]

This shows the pattern. Sanctions do not stop at the hackers. They reach the exchanges that turn ransom into cash. Our post on OFAC sanctioned crypto addresses explains how such listings work.

What CISA and the FBI advise

The FBI's ransomware page on IC3 is direct: "The FBI does not support paying a ransom." It gives three reasons. Paying does not guarantee you get your data back. It encourages attackers to target more victims. And it gives others an incentive to join in.^[4]

The FBI asks victims to file a complaint at ic3.gov. It suggests including the ransomware variant, the cryptocurrency type and address, the ransom demanded and whether anything was paid.^[4]

CISA's #StopRansomware Guide was written by CISA, the FBI, the NSA and MS-ISAC. It lists where to report: CISA, a local FBI field office, IC3 or a local US Secret Service office.^[5] OFAC's advisory names the same agencies and also asks victims to report to Treasury's cyber office (OCCIP).^[1]

Why ransomware exposure is a red flag in AML reports

In November 2021 FinCEN updated its own ransomware advisory for financial institutions. One of its red flags is a customer address, or a counterparty address, "connected to ransomware variants, payments, or related activity". FinCEN says such links may show up in open sources or in commercial or government analyses.^[6]

Commercial analyses are what AML checkers provide. When a report shows a "ransomware" share, it means some of the funds trace back to addresses tied to ransom collection or laundering. FinCEN lists other red flags that often sit next to it: mixing services, rapid swaps into anonymity-enhanced coins, and exchangers in high-risk jurisdictions with weak AML rules.^[6]

FinCEN also says no single red flag proves illicit activity on its own. Institutions should weigh all the facts.^[6] So a small, distant share may not lead to a freeze. A direct link, or a link to a designated exchange like SUEX or Chatex, adds sanctions risk on top. See our ransomware risk category and sanctions risk page for how checkers label each.

What to do

1. If you are a victim, report first. Contact the FBI through ic3.gov or a field office, and CISA. OFAC treats a prompt, complete report as a significant mitigating factor.^[1]
2. Do not assume a payment is legal. If the attacker or the cash-out exchange may be sanctioned, paying can be a violation. Talk to a sanctions lawyer and contact OFAC if there is any sign of a sanctions nexus.^[1]
3. Keep the ransom note and addresses. The FBI asks for the variant, address and amounts.^[4]
4. Check incoming coins. Before a P2P or OTC deal, run the sending address through an AML checker. A ransomware label is a reason to stop.
5. Read the category and the share. Ransomware plus sanctions is far more serious than a small indirect ransomware share.
6. If an exchange holds your deposit, follow our guide on what to do when an exchange freezes funds.

To compare checkers that label ransomware and sanctions exposure, see the service comparison.