The UK Ransomware Payment Ban Is Coming: What Public Sector and CNI Organisations Must Do Before It Becomes Law

Introduction

Editor's note: this article reflects the confirmed government position and legislative status as of September 2026. The ransomware payment ban and reporting regime are still being finalised through secondary legislation, so specific dates, thresholds, and penalties should be checked against the latest government guidance before this piece is republished or refreshed.

For more than a decade, ransomware negotiators, insurers, and boards have operated under an uncomfortable but practical assumption: if the backups fail and the business is on its knees, paying the criminals is still on the table. In the UK, that assumption is about to be legislated out of existence for a large and growing part of the economy.

Following a Home Office consultation that closed in April 2025 and a government response published that July, the UK is moving ahead with a targeted ban on ransomware payments for public sector bodies and critical national infrastructure (CNI) organisations, backed by a mandatory incident reporting regime. It will sit alongside, but separately from, the Cyber Security and Resilience Bill currently working its way through the House of Lords. Neither piece of legislation has received Royal Assent yet. Both are close enough to reality that "we'll deal with it when it lands" is no longer a defensible strategy for any CISO, IT director, or board member in a covered sector.

This article sets out exactly what has been confirmed, what is still undecided, and, most importantly, the practical steps public sector and CNI organisations should be taking right now, while the detail is still being finalised.

What the Government Has Actually Confirmed

It is worth being precise here, because a lot of commentary on this topic blurs consultation proposals with confirmed policy. Here is where things genuinely stand.

The ban covers public sector bodies and CNI owners and operators in regulated sectors. This includes central government departments, local councils, NHS trusts, schools, and the operators of critical infrastructure such as energy, water, and transport. The government has explicitly ruled out an automatic extension to the wider private sector, charities, or individuals, although it sought views on whether essential suppliers to these sectors should also be brought into scope. If you supply IT services, managed detection, or critical software to a council or an NHS trust, do not assume this ban has nothing to do with you.

Private sector organisations are not banned outright, but they are not being left alone either. The government is introducing a "payment prevention regime" that will require any organisation outside the ban to notify the authorities before paying a ransom. Officials will then have the ability to assess whether the intended payment would breach sanctions law or terrorism financing restrictions, and to block it if so. There is no blanket authorisation process. If a payment does not fall foul of sanctions rules, an organisation can, in principle, still proceed. But the days of quietly wiring cryptocurrency to a threat actor with no one else in government aware it happened are ending for everybody, not just the organisations under the outright ban.

A mandatory reporting regime is coming for ransomware incidents specifically. This is separate from, and in addition to, the reporting obligations already being expanded under the Cyber Security and Resilience Bill. The consultation proposed an initial notification within 72 hours of detecting a ransomware incident, followed by a more detailed report within 28 days covering the ransom demand, the organisation's recovery capability, identifiable threat actor details, the access vector used, and the resilience measures in place. The exact reporting threshold, meaning how serious an incident has to be before reporting becomes mandatory, has not yet been finalised.

Penalties are still undecided. The consultation asked respondents directly whether enforcement should rely on criminal penalties, civil penalties such as fines, or measures like disqualifying board members from holding directorships. The government has not committed to a specific enforcement model. What we do know is that around three-quarters of consultation respondents supported the proposals overall, which gives the policy strong political momentum even without a finalised penalty framework.

There is no firm implementation date. The government has said the outstanding detail will be worked through via further consultation and secondary legislation "in due course." That phrase should not be read as reassuring. Secondary legislation in the UK can move quickly once a government has decided the policy direction and secured consultation support, and this one already has both.

Why This Is Happening Now

Ransomware has become the single most disruptive category of cyber incident affecting UK public services in the last five years, from NHS trusts diverting ambulances after supplier compromises to local authorities losing months of case management data. Two things have pushed the government from guidance to legislation.

First, intelligence gaps. Law enforcement and the NCSC have long argued that under-reporting of ransomware incidents, particularly where a victim pays quietly and moves on, blinds the UK to the true scale of the threat and starves international operations against ransomware gangs of the evidence they need. The mandatory reporting regime exists primarily to close that gap, not to punish victims.

Second, the economics of extortion. Every payment that goes through, whether from a hospital trust or a mid-sized logistics firm, funds the next attack. The government's own messaging around the consultation was blunt about this: hitting ransomware gangs "in their wallets" is now an explicit policy objective, not a side effect of better cyber hygiene advice.

There is a third, quieter driver too: insurer and reinsurer pressure. As ransomware losses have climbed, the cyber insurance market has grown increasingly uneasy with underwriting a risk where the "solution" of last resort is to pay criminals, since that dynamic arguably keeps the attack economy profitable and premiums rising in a loop with no natural ceiling. A legislative floor that removes payment as an option for a large chunk of the economy gives insurers a clearer, more predictable risk to price, which is one reason the consultation response noted broad support from across sectors, not just from law enforcement and government.

It is also worth noting this sits inside a wider pattern of UK regulatory tightening. The Cyber Security and Resilience Bill, separately, is expanding the scope of regulated entities to include managed service providers, data centres, and large-scale critical suppliers, introducing a 24-hour initial notification requirement for significant incidents, and raising maximum fines to between £10 million and £17 million, or 4% of global turnover for the most serious breaches. Boards in regulated sectors are facing a genuinely different compliance landscape from the one that existed even two years ago, and the ransomware payment ban is one part of a coordinated push, not an isolated measure.

What This Means in Practice for Public Sector and CNI Organisations

If your organisation falls inside the ban's scope, the practical implication is stark: ransom payment stops being a viable fallback position, even as a last resort. That single change should reshape how resilience is planned, tested, and funded. A few consequences follow directly from it.

Recovery capability becomes the whole strategy, not a backup to negotiation. Where an organisation could previously treat "we might just pay" as an implicit safety net sitting behind its incident response plan, that net is being removed by law. Backup and recovery arrangements that were adequate when payment was an option may not be adequate once it is not.

Board-level risk appetite conversations need to happen before an incident, not during one. A board that has never explicitly discussed "what happens if we are hit and cannot pay" is going to have that conversation for the first time in the middle of a live crisis, which is the worst possible moment to discover gaps in recovery capability or authority to act.

Supplier and contract exposure needs re-examining now. Given the government's openness to extending the ban to essential suppliers, any organisation that provides services into the public sector or CNI, including MSPs, cloud providers, and specialist software vendors, should assume it may eventually be pulled into scope, directly or via contractual flow-down clauses from its customers.

Practical Steps to Take Before the Legislation Lands

None of the following depends on waiting for the final statutory instrument. These are the actions that put an organisation in a defensible position regardless of exactly where the penalty threshold or reporting trigger ends up.

Pressure-test your backups as if payment were already illegal. Run a genuine recovery exercise, not a tabletop discussion, that assumes ransom payment is not an option under any circumstances. Time how long it actually takes to restore critical services from offline, immutable backups. If that number is measured in weeks rather than days, that is the gap the legislation is about to expose.

Map your incident response plan against the proposed reporting timelines. A 72-hour initial notification window sounds generous until you have lived through the first three days of an active ransomware incident, when systems are down, evidence is being gathered, and legal and communications teams are already stretched. Walk through who would actually compile that initial report, what information they would need, and whether your current logging and monitoring would give them it in time.

Establish clear internal authority for reporting decisions now. Once mandatory reporting exists, ambiguity about who has the authority to make that report, and on what evidence threshold, becomes a genuine operational risk in itself. Decide this in a calm meeting, not in hour four of an incident.

Review supplier contracts and MSP relationships for ransomware clauses. If a critical supplier were compromised and unable to pay a ransom under the ban, what does that do to your own continuity? Conversely, if you are a supplier to public sector or CNI clients, start the conversation with them now about how any future ban or reporting obligation might flow down contractually.

Revisit cyber insurance policies with this specific scenario in mind. Many cyber insurance policies were priced and structured around an assumption that ransom payment, negotiation, and payment facilitation services would be available as a claims option. Ask your broker directly what your policy does in a scenario where payment is legally prohibited and recovery has to be self-funded and self-managed.

Strengthen the controls that reduce the odds of needing this decision at all.

Prevention remains the cheapest form of compliance. Attack surface reduction, timely patching, credential hygiene, and continuous monitoring for the early indicators of a ransomware intrusion, such as unusual lateral movement or mass file access, all reduce the chance that any of the above ever gets tested for real. A 24/7 detection and response capability that can catch and contain an intrusion before encryption begins does more for regulatory compliance than any policy document.

Align existing compliance frameworks to the new reality rather than treating them as separate workstreams.

Organisations already working towards ISO 27001, Cyber Essentials Plus, or NIS-aligned controls have a head start, since the technical and governance measures those frameworks demand, asset inventories, access control, incident response planning, are largely the same measures that will demonstrate readiness under the ransomware reporting regime. Treat the two as one compliance programme rather than duplicating effort across separate audits.

Brief the board in terms of decisions, not just risk. Rather than presenting ransomware risk as an abstract likelihood-and-impact score, give the board three concrete decisions to make in advance: the maximum acceptable downtime for each critical service, who has the legal authority to file the mandatory report, and what the organisation's public communication looks like in the first 24 hours of an incident it cannot pay its way out of.

How the UK Compares Internationally

The UK is not acting in isolation. Australia introduced mandatory ransomware payment reporting for larger businesses in 2025, requiring victims to disclose payments to the Australian Signals Directorate within 72 hours regardless of sector. Several US states have floated or passed narrower restrictions on public sector ransom payments, and the wider international direction of travel, reinforced through forums like the International Counter Ransomware Initiative, is unmistakably towards less tolerance for payment and more mandatory disclosure. UK organisations with international operations should expect this to become the norm across most of their major markets over the next few years, not a uniquely British quirk of regulation. Building a recovery-first posture now avoids having to retrofit compliance separately for every jurisdiction as each one catches up.

The Private Sector Should Not Tune Out

It is tempting for organisations outside the direct ban to treat this as a public sector problem. That would be a mistake for three reasons. The payment prevention notification regime already applies more broadly than the outright ban, meaning private organisations that intend to pay a ransom will soon face a formal government notification step regardless. The scope of the outright ban itself is not fixed, and the consultation explicitly left the door open to extending it to essential suppliers, a category that could eventually capture a meaningful slice of the private sector supply chain. And reputationally, once public sector bodies are legally barred from paying, public and media expectation around private sector payment behaviour is likely to shift hard in the same direction, ban or no ban.

How Cybergen Can Help

Whether your organisation falls directly under the proposed ban, sits in its supply chain, or simply wants to be ahead of where UK ransomware policy is clearly heading, the preparation work is the same: provable recovery capability, tested incident response, and detection that catches an attack before it becomes a ransom demand in the first place. Our team works with public sector bodies, CNI operators, and their suppliers on exactly this combination of penetration testing, managed detection and response, and compliance consultancy, so that when this legislation does land, it confirms what you already know about your resilience rather than exposing what you did not.

Frequently Asked Questions

Is the UK ransomware payment ban law yet?

No. As of the time of writing, the government has confirmed it intends to proceed following a supportive consultation response, but the ban has not yet been enacted through legislation, and no firm implementation date has been set.

Who exactly will be banned from paying ransoms?

Public sector bodies, including central government, local councils, the NHS, and schools, along with owners and operators of critical national infrastructure in regulated sectors. The government has also sought views on extending this to essential suppliers of those organisations.

Do private sector businesses have to report ransomware attacks?

A mandatory reporting regime for ransomware incidents has been proposed, alongside a separate requirement for private sector organisations to notify the government before making a ransom payment, so that authorities can check the payment would not breach sanctions or counter-terrorism financing law.

What happens if a banned organisation is hit by ransomware and cannot recover another way?

This is precisely why recovery capability, not payment, needs to become the primary resilience strategy for in-scope organisations well before the legislation takes effect.

Stay Ahead of the Next Attack

Speak to our specialist team today to discover how we can help protect your organisation from the latest global threat actors.

Ready to strengthen your security posture? Contact us today for more information on protecting your business.