Key Takeaways From OFAC's Updated Ransomware Advisory

On September 21, 2021, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) issued an "Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments." While this advisory explicitly supersedes OFAC's previous ransomware advisory from October 2020, it does not fundamentally alter OFAC's approach towards ransom payments. Like the prior guidance, OFAC's recent advisory reiterates the U.S. policy of "strongly discouraging" ransom payments, warns that such payments carry sanctions risk, and lists a number of "significant mitigating factors" that OFAC will consider when deciding whether to bring an enforcement response. Still, there are several significant takeaways from the updated guidance: