UK Government Looks Set To Introduce Ransomware Payment Ban And Mandatory Reporting

Ransomware remains one the UK's most serious and disruptive cyber risks in the UK, with high-profile attacks on retailers, hospitals and government services underscoring the significance of the risk it poses. Over the past year, the UK government has signalled its intent to adopt a more interventionist approach to tackling ransomware. We've been tracking this closely. First, when the government signalled its intent to consult (link here). Then, it launched the consultation itself, floating concrete proposals to restrict ransom payments and compel greater transparency (link here).

The government has now published its report on the consultation response (link here) based on the 223 submissions received. While it does not confirm which measures will be adopted, it offers important insight into the direction of travel for UK ransomware policy. Overall, the proposed measures, aimed at "smash[ing] the cyber criminal business model"¹ were broadly supported in the