Ransom-Payment Legality & Coverage Gate
A ransom payment has to clear two independent gates before it is even an option: is it lawful, and will your policy reimburse it? They are different questions. Walk both below. This is educational and lawful-use only — the lawful first moves are to contain, preserve evidence, check No More Ransom, notify your insurer and report to the authorities. Not legal or insurance advice.
Gate 1 · Legality
OFAC sanctions are strict-liability: you can be liable even without knowing. Several ransomware groups and operators are specifically designated.
nomoreransom.org — a genuine, free Europol + Dutch-police initiative. If a free decryptor exists, there is no need to pay.
Before legality can even be assessed: the threat actor / wallet has not been sanctions-screened; No More Ransom has not been checked for a free decryptor; the incident has not been reported to law enforcement (FBI/CISA or local equivalent). Each is a lawful, no-cost first step and the diligence OFAC expects.
Gate 2 · Coverage
Most policies require consent before payment — paying first commonly forfeits reimbursement.
Extortion cover is usually sub-limited well below the overall tower.
Reimbursement is conditional: you do not yet have the insurer’s prior written consent — paying first commonly forfeits reimbursement; the amount may exceed the extortion sub-limit (often far below your overall tower); whether extortion cover exists at all is unconfirmed. And every policy’s sanctions exclusion voids reimbursement of an unlawful payment.
Both gates are necessary and neither is sufficient: a payment can be lawful yet unreimbursed, or reimbursable in principle yet barred because the recipient is sanctioned. The sanctions exclusion sits across both.
- Contain the incident and preserve forensic evidence.
- Check No More Ransom for a free, lawful decryptor.
- Notify your insurer’s breach hotline early — consent and panel counsel flow from there.
- Report to law enforcement (FBI/CISA in the US, or your national CERT / police).
- Let counsel run the sanctions screening and the legal judgement.
What this gate does
- A ransom payment has to clear two gates before it is even an option: is it lawful, and will your policy actually reimburse it? This walks both.
- Legality gate: paying an OFAC-sanctioned actor can be a strict-liability violation — screen the actor, check for a free decryptor on No More Ransom first, and report to law enforcement.
- Coverage gate: even a lawful payment is only reimbursed if you got the insurer’s prior consent, stayed inside the extortion sub-limit, and the payment is not caught by the sanctions exclusion.
- Educational, lawful-use only. Not legal, insurance or incident-response advice — involve counsel, your insurer and law enforcement before any payment decision.
Why this matters
In the heat of a ransomware incident the pressure is to decide fast, and the two questions that actually govern a payment get blurred together. They are separate. The first is legal: paying the wrong recipient — a sanctioned group or individual — can be a strict-liability sanctions violation regardless of intent, which is why screening the actor, checking No More Ransom for a free decryptor, and reporting to OFAC, the FBI and CISA come first. The second is contractual: your policy only reimburses an extortion payment under conditions — prior insurer consent, an extortion sub-limit, and a sanctions exclusion that voids reimbursement of an unlawful payment.
This gate lays both tests out so you understand the terrain before the real decision, which belongs to your counsel, your insurer’s panel and law enforcement. It is educational and lawful-use only — nothing here is legal or insurance advice, and nothing here is encouragement to pay.
Frequently asked questions
Is it illegal to pay a ransomware ransom?
Paying a ransom is not automatically illegal in the United States, but it can become illegal depending on who receives the money. The US Treasury’s Office of Foreign Assets Control (OFAC) has warned that facilitating a payment to a sanctioned person, group or jurisdiction can violate sanctions regulations — and OFAC enforces those on a strict-liability basis, meaning you can be liable even if you did not know the recipient was sanctioned. Several ransomware groups and the individuals behind them have been specifically designated. That is why screening the actor, documenting your diligence, and reporting to OFAC, the FBI and CISA matter before any payment is considered. This tool is educational and not legal advice — involve counsel.
What is No More Ransom and why check it first?
No More Ransom (nomoreransom.org) is a genuine, free initiative run by Europol’s European Cybercrime Centre and the Dutch police together with security-industry partners. It hosts a library of free decryption tools for many ransomware families. Before anyone discusses paying, you check whether a free, lawful decryptor already exists for your variant — if it does, there is no need to pay at all. It is the first stop, costs nothing, and is completely lawful to use.
Will my cyber policy reimburse a ransom payment?
Only under conditions. Most cyber policies that include cyber-extortion cover require the insurer’s prior written consent before you pay — pay first and you may forfeit reimbursement. Payments are usually capped by an extortion sub-limit well below your overall tower, and every policy carries a sanctions exclusion that bars reimbursing a payment that would itself be unlawful. So the coverage question is separate from the legality question: a payment can be lawful yet unreimbursed, or reimbursable in principle yet barred because the recipient is sanctioned. Check your policy wording and call your insurer’s breach hotline early.
Is this tool telling me whether to pay?
No. It is an educational gate that shows the two independent tests a payment has to pass — lawfulness and coverage — so you understand the landscape before the real decision, which belongs to your incident-response counsel, your insurer’s panel and, where relevant, law enforcement. It does not evaluate your specific facts, does not constitute legal or insurance advice, and nothing here should be read as encouragement to pay. The lawful, recommended first moves are to contain the incident, preserve evidence, check No More Ransom, notify your insurer and report to the authorities.
This tool is free and always will be. Would a Pro workspace — saved designs, team sharing and exports — be worth paying for?
Show me Pro →No account needed to use this tool — this just tells us whether Pro is worth building out.