OFAC Releases Updated Ransomware Advisory And Announces First Designation Of Cryptocurrency Exchange

On 21 September 2021, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) issued an updated advisory¹  that highlights the sanctions risks associated with making ransomware payments. OFAC reiterated that it strongly discourages companies from making or facilitating ransomware payments, which it believes encourages future attacks and may also violate U.S. sanctions. The updated guidance instead seeks to incentivize companies to adopt or improve preventive measures such as cybersecurity controls and to cooperate closely with the U.S. government in case of an attack.

On the same day, OFAC also announced its first designation of a cryptocurrency exchange that facilitated ransomware payments and other illicit transactions.² The exchange, SUEX OTC, S.R.O. (SUEX), is incorporated in Czechia, but based in Russia, and is a "nested" exchange that uses the payment systems of larger cryptocurrency exchanges to facilitate illicit payments. OFAC