Should Your Company Pay the Ransom? What 2026 Law Actually Says

Key Takeaway

• 📉 The payment era is ending by itself: only 28% of ransomware victims paid in 2025, a record low, and trackers put the rate near 21% to 23% by mid-2026, the sixth straight year of decline from 85% in 2019.
• ⚖️ The legal map is patchwork, not prohibition: no US federal ban on ransomware payments for private firms exists, several states ban public agencies from paying, the UK ban is still a proposal awaiting legislation, and sanctions law can make a specific payment illegal anywhere.
• 🚫 The sanctions trap is the real prohibition: paying a group on the Treasury’s sanctions list can trigger civil penalties even in a state that permits ransomware payments.
• 💸 Paying buys less than it promises: 84% of payers did not fully recover their data, and 80% of payers were re-attacked within 12 months, per Halcyon and Fortinet reports.
• 🛡️ The endorsed path: regulators push tested backups, law-enforcement decryption keys and an OFAC-screened, board-approved payments policy written before the incident.

Fewer than a quarter of ransomware victims now pay their attackers, Ransomware payments are becoming a governed decision rather than a reflex, and the law is moving in the same direction as the practice. Chainalysis recorded roughly $820 million flowing to ransomware groups in 2025, down 8% from 2024 and 35% below the 2023 peak, with the paid rate at a record-low 28%, or 23% by Check Point’s second-quarter 2026 reading. Governments are converting that shift into rules: three US states already prohibit public agencies from paying, the UK has proposed a ban plus a tell-us-before-you-pay regime, and sanctions law lurks over every payment. Should your company pay if hit? The factual answer starts with a checklist: the federal advisory on this year’s most active group, your state’s statute, your contracts, and a policy your board signs today.

What 2026 Law Actually Says: the United States

Start with what is actually illegal. No federal statute bans a private US company from paying a ransom demand, and no state bans private businesses outright. What exists is a tiered patchwork. North Carolina became the first state to prohibit paying, and its law also bars communicating with the attackers; Florida’s cybersecurity act forbids counties and municipalities from paying or complying with a demand; Tennessee restricts public-sector payments. These bans apply to government entities, not to the private firm down the road.

Private-sector prohibitions are proposed, not enacted, but they tell you where the map is heading: a New York bill would extend a ban to private businesses and healthcare entities with civil penalties up to $10,000 per violation, and similar measures have been introduced in Pennsylvania and Texas. Meanwhile the reporting side is expanding, and several ransomware advisories now require agencies to report incidents to state authorities, which is one reason the victims list keeps setting records.

The one legal exposure every payer carries regardless of state law: sanctions. If the group you pay sits on the Treasury’s sanctions list, the payment itself can violate federal sanctions law even where state law permits paying. There is no state-law safe harbor against that.

The United Kingdom: a Ban on Paper Is Coming

The UK government announced its proposed framework in January 2025 with a public consultation that drew broad support. The plan has three parts: a ban on ransom payments by public bodies and regulated critical national infrastructure operators, a notification regime requiring private firms to tell the government before paying, and a mandatory ransomware reporting regime with an initial 72-hour report. Support ran high in the consultation, with roughly 72% backing the ban’s logic of starving the groups of revenue.

The UK position on ransomware payments deserves a precise read, because vendor summaries routinely overstate it: as of early November 2026 the ban is still not law. Paying is not generally illegal in the UK, though it already becomes illegal when the recipient is a sanctioned person, and government guidance discourages payment. For a UK-linked company the practical meaning is unchanged from the US: prepare as if the notification duty arrives, because the draft regime requires a 72-hour initial report and a fuller account within 28 days.

The Sanctions Trap That Beats Every State Law

This is the section most ransomware guides skip, and it is the one your counsel cares about. Sanctions law does not care whether your state allows ransomware payments. If the wallet address or the group behind your incident belongs to a sanctioned entity, the payment is a violation with civil penalties attached, and regulators have been explicit that victims carry the screening duty. The duty is not theoretical: the advisories name the groups, and several of this year’s most active crews sit on sanctions lists, which converts a routine recovery decision into a potential enforcement matter for any company that pays without the screen. Insurers add their own layer: many cyber policies require legal-compliance checks before indemnifying a payment, and paying without the policy’s consent steps can forfeit the claim.

The screening sequence is the step every legal guide to ransomware payments opens with, and it costs an hour: identify the group and its attribution from the federal advisory or the advisory your forensics firm issues, run the wallet addresses and aliases against sanctions lists through counsel, notify law enforcement through the required channel, and document every step before any money moves. Skipping the screen to save six hours is the single most expensive shortcut in ransomware payments.

Why Paying Buys Less Than It Used To

The negotiation itself is a deteriorating product, and the numbers explain why 2026 law treats ransomware payments with suspicion. Halcyon’s research found 84% of victims who paid did not fully recover their data, and Fortinet’s numbers show 80% of payers were hit again within twelve months, often by the same crew that kept the access it sold you the key to. The median payment among those who do pay still lands near $1 million, down half from the prior year, which means the buyers at the bottom of the market are paying seven figures for probabilistic recovery. The asymmetry gets worse in the details: decryptors shipped by criminals are single-use code, written under deadline, with no QA process and no support desk, and the same crew that sells you the key knows exactly which backups you lacked so it can price the re-attack accordingly.

The extortion economics explain why paying stopped working. Double extortion means the data is gone regardless of decryption quality, and operators have responded to the shrinking payment pool by raising demands and leaning harder on leak threats. Verizon’s 2025 analysis put ransomware in 44% of all breaches it analyzed, and 88% of small-business breaches, which tells you the attack volume never dropped while the payment rate collapsed. The market is separating: fewer payers, bigger demands, worse recovery odds.

The Regulator-Endorsed Alternative: Rebuild

Every government that drafts a ransomware payments rule pairs it with the same message: the recover-without-paying path is the intended one. The path runs on boring infrastructure, and it gets better every year. Law-enforcement disruptions hand victims free decryption keys at scale, including more than 7,000 keys released in the LockBit takedown that the FBI estimated prevented over $800 million in demanded payments. Tested, offline backups are the difference between a long weekend and a quarter-long negotiation. The 21% to 28% who still pay are, on the evidence, the organizations without either.

The industry telemetry on the decline attributes the shift to exactly those controls, plus the regulatory pressure that makes payment documentation mandatory. A company that can rebuild inside a tested recovery time has converted the decision from a ransom negotiation into a routine failover, which is why the preparation steps in the first-72-hours incident plan carry over directly into ransomware response.

Insurance changes the arithmetic for firms with coverage, in both directions. Cyber policies commonly respond to extortion costs, which is what brings the counsel, the forensics team and the negotiator the morning after, and the same policies impose the compliance gates described above, so the coverage conversation and the sanctions screen travel together. The premium side has moved too: underwriters price the recovery capability, and firms holding tested offline backups now meet lower expectations than firms that need a negotiated recovery to survive.

Write the Policy Before the Incident

The decision your board delegates during a crisis will be the worst version of the decision. Write your ransomware payments policy now, as a one-page document with named roles, and the incident becomes execution instead of improvisation. Five components cover the 2026 legal map:

1. The default: no payment without full legal review, as the regulator-endorsed baseline; the policy states that ransom payments are a last resort, not a tool.
2. The sanctions screen: attribution, wallet screening through counsel, and documentation before any transfer, recorded in the incident register.
3. The notification ladder: law enforcement first, then the state and federal reporting duties, then insurers, then the contractual notices owed to customers and partners.
4. The technical gate: a tested recovery within the target window is verified before any payment conversation starts, because recovery data changes the negotiation.
5. The review trigger: the policy names its own re-open date, because the US state map and the UK bill are both moving and a 2026 policy is a 2027 liability if nobody updates it.

One paragraph belongs in writing precisely because it is uncomfortable: paying is not illegal for most private firms, and a board that decides in extremis to pay can do so lawfully in most US states, provided sanctions screening and reporting duties are met at a minimum. The policy’s job is not to pretend the option does not exist. It is to make sure that if the option is ever exercised, it is exercised inside the law, on the record, and only after the recovery path genuinely failed.

What the EU Requires: Reporting Without a Ban

Across the Union the legal structure is different but the direction matches. There is no EU-wide prohibition on ransomware payments, yet no company escapes the incident layer: in-scope entities report significant incidents under the EU’s critical-services regime with early-warning and notification deadlines inside the first days, and the analysis in the NIS2 practical guide maps those clocks in detail. The software-product layer adds more, because the Cyber Resilience Act now compels manufacturers to report actively exploited vulnerabilities on short deadlines, and a shipped product whose flaw enabled an incident is exactly the case those rules imagine.

The reading for a firm with European exposure: the payment decision is still yours in most cases, but the incident itself is not private. Between the supervisory notification, the product-security report that may apply to your vendors, and the contractual notices your customers hold, a ransomware event in 2026 travels through more reporting channels than any other security incident you will ever handle.

Frequently Asked Questions

Is it illegal to pay a ransomware demand in the United States?

For private companies, generally no federal or state statute bans the payment itself. The exceptions are real: public agencies in several states are barred from paying, and a payment to a sanctioned group can violate federal sanctions law anywhere in the country.

Which states ban ransom payments?

North Carolina, Florida and Tennessee restrict public-sector ransom payments, with North Carolina also banning communication with the attackers. Bills that would extend bans to private businesses have been introduced in New York, Pennsylvania and Texas but were not law as of late 2026.

Is it illegal to pay a ransomware demand in the UK?

Not generally, not yet. The UK has proposed banning payments by public bodies and critical infrastructure operators and requiring private firms to notify before paying, but the rules had not passed into law as of early November 2026. Sanctions law already makes some payments illegal.

What does sanctions law have to do with ransomware payments?

Paying a group or wallet on the sanctions list can carry civil penalties even in a state that allows ransom payments. The screening duty sits with the victim, so attribution and wallet checks through counsel come before money moves.

Does paying the ransom get your data back?

Reliably, no. Reports found 84% of payers did not fully recover their data, and 80% of payers were re-attacked within a year, while median payments run near $1 million. The recovery path with better odds is tested offline backups plus law-enforcement decryption keys.

Should my company pay a ransomware demand?

The regulator-endorsed order of operations is: contain, invoke the incident plan, verify your recovery capability, notify law enforcement, and let the board decide with the sanctions screen complete. Most firms that prepared properly never reach the payment conversation.

If this intelligence helps you, you can add WorldNgayon as a preferred source on Google — free, one click, and it helps other Filipinos find the answers faster.

Financial Disclaimer

This article is published for general informational and educational purposes and does not constitute legal, financial or professional advice. Sanctions laws, state statutes and proposed legislation change frequently; the legal position described here reflects reporting current at publication. Verify every requirement with qualified counsel and check sanctions lists before acting on any payment decision. WorldNgayon and its author accept no liability for losses arising from the use or misuse of this information. No compensation was received for this article unless explicitly disclosed.

@online{agron2026ransomwarepayments,
  author       = {Agron, Edmon},
  title        = {{Should Your Company Pay the Ransom? What 2026 Law Actually Says}},
  year         = {2026},
  date         = {2026-11-11},
  organization = {WorldNgayon},
  url          = {https://worldngayon.com/ransomware-payments-law/},
  urldate      = {}
}

TY  - ELEC
AU  - Agron, Edmon
TI  - Should Your Company Pay the Ransom? What 2026 Law Actually Says
T2  - WorldNgayon
PY  - 2026
DA  - 2026/11/11/
UR  - https://worldngayon.com/ransomware-payments-law/
Y2  - 
ER  -