OFAC Issues Additional Ransomware Guidance And Designates Virtual Currency Exchange

The U.S. Treasury Department has issued an updated ransomware advisory that highlights sanctions risks associated with ransomware payments and details proactive steps companies can take to mitigate these risks.

On September 21, 2021, the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC") took several actions relating to ransomware, including designating an exchange and issuing guidance. Last October, OFAC issued an Advisory highlighting the sanctions risks faced by parties that make or facilitate ransom payments to malicious cyber actors. OFAC's new Advisory supersedes its earlier guidance and reiterates these risks, emphasizing that facilitating ransomware payments on behalf of a victim may violate OFAC regulations, and provides guidance for ransomware victims.