Australia Was First to Require Ransomware Payment Reports: How the 72-Hour Rule Works

Key Takeaway

• 🇦🇺 The world first: Australia became the first jurisdiction anywhere to require ransomware payment reporting, with the duty live since May 30, 2025 under Part 3 of the Cyber Security Act 2024.
• ⏱️ The clock: covered entities complete their ransomware payment report to the Australian Signals Directorate within 72 hours of making a ransomware payment, or of becoming aware that one was made on their behalf.
• 📏 Who is covered: businesses operating in Australia with more than A$3 million in annual turnover, plus critical-infrastructure responsible entities at any size, with no minimum payment threshold.
• 💰 The penalty: missing the deadline carries a civil penalty of up to 60 penalty units, currently A$19,800, per unreported payment.
• 📝 The prep for ransomware payment reporting: log every demand, negotiation message and payment detail from the first minute, because the report itself must describe the incident, the demand, the payment and your communications with the attacker.

Australia now holds a cybersecurity first that no other country has matched: the only law in the world that obliges businesses to report a ransomware payment to a government agency, in force since May 30, 2025. Part 3 of the Cyber Security Act 2024 gives covered entities the ransomware payment reporting window: exactly 72 hours to file with the Australian Signals Directorate, whether the company paid directly or merely learned that someone paid for it. The report is not a press release; it is a structured disclosure expected to carry the incident details, the demand, the payment and the communications record. If your organization touches Australian operations, this guide covers who must report, what the report needs, where the fine sits, and the exact checklist for the first three days.

What the Ransomware Payment Reporting Rule Requires

Part 3 of the act creates one duty with four moving parts. The trigger: a ransomware payment or a cyber extortion payment has been made. The subjects: reporting business entities, defined by turnover and role rather than industry. The window: 72 hours from the payment, or from the moment you become aware a payment was made on your behalf, with the government’s own guidance confirming the regime has been active since May 30, 2025. The destination: a report to the Australian Signals Directorate through the Australian Cyber Security Centre’s online portal.

Two boundaries matter as much as the ransomware payment reporting duty itself. A demand alone is not reportable, because the duty attaches to payments; an unaccepted demand can still be reported voluntarily, and many incident-response teams do exactly that for the intelligence value. And the rule captures every payment, with no minimum threshold: auditors wrote the law to catch the A$500 transfer as deliberately as the seven-figure settlement, and a payment need not be money at all. Benefits under the act include non-monetary compensation, so a free restore of data or a service provided in exchange for withdrawing an extortion demand counts.

Who Counts as a Reporting Business

The turnover test is the front door. A reporting business entity, for ransomware payment reporting purposes, carries on business in Australia with annual turnover for the previous financial year above A$3 million, and is not a Commonwealth or state body, which run their own security regimes. The second door bypasses size entirely: a responsible entity for a critical infrastructure asset under the critical-infrastructure act must report whatever its turnover, because the government treats payments connected to essential services as intelligence in their own right.

Foreign-linked organisations should read the jurisdiction carefully. Carrying on business in Australia is the operative phrase, not Australian incorporation, so a subsidiary that operates locally, a branch that serves Australian customers and a partner that settles extortion demands on Australian-held data can all fall inside the definition. The practitioner guidance issued when the regime commenced stresses that there are no grace periods: the duty applied in full from day one, to entities that had never heard of the portal.

Why Australia Built the Rule: the Intelligence Logic

To read the law correctly, read what it is for. A ransomware payment is the moment money reaches a criminal group, and before this act no government could see that moment at scale. The reporting regime turns every covered payment into a data point for the national picture: which groups are active, which sectors are paying, what sums flow, and where supply chains leak. That is why the rule reaches payments made on a company’s behalf and payments settled in services rather than cash, a design aimed at the whole market rather than the headline seven-figure case.

The government’s stance on the payment itself is deliberately separate from the reporting duty. Authorities discourage paying, pointing to the poor recovery odds and the repeat-targeting problem, but they did not legislate a ban for private firms, which keeps Australia’s model distinct from the proposed British framework and the American state bans mapped in our ransomware payments guide. The record-setting attack volume behind the policy is visible in the victim counts tracked through the October ransomware record, where thousands of named victims a month give the payment statistics their context.

The turnover test also settles a question smaller firms ask first: passive presence does not count, but an online store serving Australian customers with settlement data generally does. Companies at the boundary should scope the question in writing with counsel, because the penalty regime has no amnesty for misreading it.

The Penalty and What Missing the Reporting Deadline Actually Costs

The civil penalty for failing to lodge a required report within 72 hours runs to 60 penalty units, which the current penalty-unit value puts at up to A$19,800 per unreported payment. That figure is deliberately modest next to the extortion itself, and practitioners read it as an intelligence-gathering incentive rather than a punisher: the government priced compliance low so that reporting is the path of least resistance. Enforcement scrutiny, however, compounds with everything else in an incident, because an entity that missed the statutory clock looks differently in every later review, from insurer conferences to regulator meetings.

Ransomware payment reporting also touches one worry most boards raise first: legal privilege, and the act was drafted around it. The design includes limited-use protections for information in a payment report, restricting its use in subsequent proceedings, so the disclosure is built to feed national intelligence without becoming the plaintiff’s exhibit. Treat the boundary as a reason to report accurately, not a reason to report vaguely; the report should carry facts, not legal theories.

How the Rule Fits the Global Map

Australia’s law is the world’s first of its kind, and every major jurisdiction is now converging on the same problem from a different angle. The United States has no federal payment ban for private firms but carries a sanctions trap on any payment to listed groups, and several states bar public agencies from paying; the full map is in our ransomware payments guide. The United Kingdom has proposed both a public-sector ban and a tell-us-before-you-pay notification regime. Across the EU, in-scope entities report significant incidents on short statutory clocks, with reporting duties that a ransomware event triggers in parallel. Australia’s model is the boldest of the set: not a ban, not merely a notification, but a mandatory government report on the payment itself.

For a company with operations in several of these jurisdictions, one incident can produce several filings with different clocks. The sequence in our first-72-hours incident plan handles the containment and classification half; the Australian payment report is the piece only your payments register can write, which is why the register discipline below matters before anything goes wrong.

The Payments Register: the Artifact That Writes the Report

The statutory report requires specifics that nobody reconstructs well on memory: details of the incident, the demand received, the payment made, and communications with the attacker. The organizations that meet the 72-hour clock are the ones that captured those facts as they formed. A payments register for extortion incidents needs five fields per event, each timestamped as it happens:

1. The demand: who sent it, through what channel, with copies of the message and any samples of encrypted data attached.
2. The decision trail: who authorized discussion, who authorized payment, and the advice received before either step.
3. The payment: amount, currency and wallet or account, or the non-monetary benefit if the settlement was in services or data restores. The act’s drafters expected that mix: the compliance design treats a services-for-data settlement and a bitcoin transfer as the same reportable event, which is why the register records benefits as well as currency.
4. The communications record: every negotiation message, because the report must describe your communications with the attacker and the negotiation history is also your sanctions-screening evidence.

In practice the portal expects the story of the incident in structured fields rather than a legal essay: when the intrusion was detected and how, what the demand demanded and by when, what was paid and to which wallet or account, and the sequence of communications between the parties. The last field is the one responders most often leave thin, and it is the one the act names explicitly. Write the communications summary from the register while the messages are fresh, attach the evidence files, and keep the portal submission ID in the incident record for every later review.

1. The awareness timestamp: the moment the organization knew the payment occurred, from which the 72 hours run, including the awkward case of an insurer or consultant who paid on the company’s behalf.

That last field is the one that catches boards out. The statutory period starts on awareness, not on authorization, so an intermediary settling on your behalf starts your deadline without your signature. Make the register the shared record across legal, treasury and incident response, and the report becomes a form rather than an investigation.

The Checklist for the First 72 Hours After a Payment

1. Confirm the payment classification. Was it a ransomware or cyber extortion payment under the act, including non-monetary benefits? If the answer is arguable, report; voluntary reports carry no penalty and the classification question disappears.
2. Start the window documentation. Record the payment date-time and the awareness date-time as two separate facts, because the 72-hour window opens on awareness for payments made on the company’s behalf.
3. File through the portal. The report goes to the Australian Signals Directorate via the Australian Cyber Security Centre portal, with the incident, demand, payment and communications details attached.
4. Screen for sanctions exposure. Before and after any payment, screen the group and wallet through counsel, because sanctions law applies to Australian entities as it does elsewhere, and the payment report is not a sanctions clearance.
5. Update the incident record. Feed the register entry into your broader incident plan, the customer and partner notices, and any regulator filings owed in other jurisdictions where the same event touched data or operations. For a group with European exposure, remember that the attack itself already triggers continental incident duties, so the Australian filing is one lane in a multi-track response, and the clocks differ enough that sequencing matters. The Australian report is the only one of the set keyed to the payment rather than the incident, which is why it can be completed even while containment is still moving.

Frequently Asked Questions About Ransomware Payment Reporting

Who must report a ransomware payment in Australia?

Ransomware payment reporting covers reporting business entities: businesses operating in Australia with more than A$3 million in turnover for the previous financial year, and responsible entities for critical infrastructure assets at any turnover. Commonwealth and state bodies sit outside this regime.

How fast must I report a ransomware payment?

Within 72 hours of making the payment, or of becoming aware that a ransomware payment was made on the organization’s behalf. Ransomware payment reporting was written so the awareness test, not the paperwork, defines the deadline. The deadline runs on awareness, not authorization, which matters when an insurer or intermediary settles on your behalf.

Where do I file the ransomware payment report?

With the Australian Signals Directorate through the Australian Cyber Security Centre’s online portal. The portal is the single home of ransomware payment reporting in Australia, and the submission ID it returns belongs in your incident record. The report covers the incident, the demand, the payment and the communications with the attacker.

What is the fine for not reporting a ransomware payment?

A civil penalty of up to 60 penalty units, currently A$19,800, per required report not lodged in time. The design aim of ransomware payment reporting is intelligence, not punishment, which is why the fine sits below the cost of a single forensics day. The regime is built to encourage reporting rather than to punish it severely, but missed deadlines compound scrutiny in every later review.

Do I have to report a ransom demand I did not pay?

No: the duty attaches to payments, not demands. An unaccepted demand can be reported voluntarily through the same portal, and voluntary reporting is a common choice for the intelligence value and the clean conscience it creates in later reviews.

Does reporting a ransomware payment waive legal privilege?

The act includes limited-use protections that restrict how information in a payment report is used in later proceedings. The report is designed as an intelligence submission, not a waiver, but its contents should still be factual and reviewed through counsel before filing.

If this intelligence helps you, you can add WorldNgayon as a preferred source on Google — free, one click, and it helps other Filipinos find the answers faster.

Financial Disclaimer

This article is published for general informational and educational purposes and does not constitute legal, financial or professional advice. Penalty values, thresholds and administrative details current at publication may change; verify every obligation against the act, the government’s guidance and qualified counsel before acting. WorldNgayon and its author accept no liability for losses arising from the use or misuse of this information. No compensation was received for this article unless explicitly disclosed.

@online{agron2026ransomwarepayment,
  author       = {Agron, Edmon},
  title        = {{Australia Was First to Require Ransomware Payment Reports: How the 72-Hour Rule Works}},
  year         = {2026},
  date         = {2026-11-11},
  organization = {WorldNgayon},
  url          = {https://worldngayon.com/ransomware-payment-reporting-australia/},
  urldate      = {}
}

TY  - ELEC
AU  - Agron, Edmon
TI  - Australia Was First to Require Ransomware Payment Reports: How the 72-Hour Rule Works
T2  - WorldNgayon
PY  - 2026
DA  - 2026/11/11/
UR  - https://worldngayon.com/ransomware-payment-reporting-australia/
Y2  - 
ER  -