UK ransomware payment rules and the Bill
The UK plans to ban ransomware payments by the public sector and regulated critical national infrastructure, but this is not yet law. It sits alongside, not within, the current text of the Cyber Security and Resilience Bill (CSRB), so plan to recover without paying.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
Where this stands
The UK plans new rules on ransomware payments, but they are not law. The Home Office confirmed in July 2025 that it would pursue a ban for the public sector and critical national infrastructure, a notice regime for other payments, and mandatory reporting. These are separate from what is currently written in the Cyber Security and Resilience Bill (CSRB).
We did not find a Bill containing these measures, and reports we saw as late as October 2026 said none had been introduced. Check the latest position before you rely on this.
The three proposals
| Proposal | Who it would affect | What it would do |
|---|---|---|
| Targeted payment ban | All public sector bodies, including local government, plus owners and operators of regulated critical national infrastructure | Stop them paying ransoms |
| Payment prevention regime | Victims outside the ban | Require notice to the authorities before paying, so they can discuss the proposed payment and alternatives |
| Mandatory incident reporting | Organisations and individuals, subject to thresholds still to be decided | Require reporting of ransomware incidents whether or not payment is considered. A 72-hour initial window is under consideration |
Scope, thresholds and penalties are still being developed. A commentator on the Government's response notes that open issues include whether the ban should have extraterritorial effect, how to treat supply chains, and how to avoid punishing victims twice.
How this fits with the Bill
Different question, same incident. The Bill asks whether an incident must be reported. The ransomware proposals also ask whether a payment can be made. A ransomware attack on a regulated organisation could eventually engage both.
Clocks may differ. Under the Bill, the first report is due within 24 hours of awareness. A ransomware rule may use another window and go to a different recipient. The Government's response suggested alignment with the Bill is being considered, but nothing is final.
Scope may differ. "Regulated critical national infrastructure" may or may not match the categories in the Bill. A managed service provider, for example, is a regulated category under the Bill, but it isn't yet clear whether the ban would cover it.
What you can and cannot do today
There's no general UK ban on paying a ransom yet. But paying is not free of legal risk today. Sanctions law can apply if the recipient is a sanctioned person, and government guidance discourages payment. Take legal advice during an incident, and don't assume your insurance position solves this.
What to do while the rules are unsettled
- Assume you might not be able to pay. Test whether you could recover without paying. This is the most useful step whatever the final rules say.
- Protect backups. Keep at least one copy that attackers can't reach, and test restoration for your most important systems.
- Set a decision process. Name who would decide, who advises them, and what evidence they'd need.
- Add the reporting routes. Include law enforcement, the NCSC, your regulator and the ICO in your plan, as relevant.
- Talk to your insurer. Check what they require, and how a future ban could affect the cover.
- Check your supply chain. A supplier's attack could affect you, and your critical suppliers may not be covered by a ban that applies to you.
- Exercise the difficult scenario. Run a tabletop where paying isn't allowed and restoration will take weeks.
- Keep a record. Note why decisions were made and who approved them.
Who should pay closest attention
- Public bodies, including councils, because the proposed ban reaches beyond the Bill's main categories. See local councils.
- Operators of essential services, because they could face both duties.
- Managed service providers, where scope remains open and one attack can affect many customers.
- Suppliers to the public sector, who could be affected if the supply chain is brought in.
Questions still open
- Which law will carry these rules, and when.
- The precise definition of regulated critical national infrastructure.
- What penalties would apply, and to whom.
- Whether the new notice would be separate from a notification under the Bill.
- Whether there will be exemptions, such as for national security.
Sources
Frequently asked questions
There is no general ban yet, but paying can create legal risk, including under sanctions law. Take legal advice during an incident.
All public sector bodies, including local government, and owners and operators of regulated critical national infrastructure, under the Government’s proposals. The final scope is not settled.
We did not find it in the Bill’s text as brought from the Commons, and some commentary conflicts on the vehicle. Check the final Act and Home Office publications.
No proposal we have seen says so. Plan for separate duties until the Government confirms any alignment.