On 11 June 2019, the Cyber-Attacks (Asset-Freezing) Regulations
2019 (SI 2019/956) (the “U.K. Regulations”) come into
force in the United Kingdom. The U.K. Regulations implement the
domestic requirements of EU Regulation (2019/796), which sets out
restrictive measures against cyber-attacks (i.e., malicious cyber
activities) threatening the European Union or its Member
States.
The U.K. Regulations apply to U.K. nationals or any body
incorporated in the United Kingdom but also have extra-territorial
effect for conduct (which includes acts and omissions) committed
wholly or partly outside the U.K. by a U.K. national or body
incorporated in the United Kingdom.
Interactions with funds or resources belonging to a
“designated person” can trigger liability under the
U.K. Regulations. The definition of a “designated
person” is taken from EU Regulation (2019/796) and includes
those who:
