CM December 2023

INFORMATION SECURITY
AUTHOR – Andrew Northage
Financial sanctions prohibit making
funds or economic resources available to
an individual or entity subject to an asset
freeze; that includes making a ransomware
payment. Breaching financial sanctions is
a serious criminal offence. It can carry
a custodial sentence and the imposition
of a monetary penalty of up to £1m or
50 percent of the value of the breach.
Other enforcement options open to HM
Treasury’s Office of Financial Sanctions
Implementation (OFSI) include issuing a
warning, referring regulated entities to
their professional body or regulator and
publishing information pertaining to the
breach.
Earlier this year (2023), OFSI published
Ransomware and Sanctions: Guidance on
Ransomwre and Financial Sanctions. The
guidance applies not only to victims and
potential victims of ransomware attacks.
It also applies to those who engage with
victims to facilitate or process ransomware
payments, for example financial
institutions or cryptoasset businesses.
OFSI and the National Crime Agency
(NCA) say that, if the mitigating steps
outlined in the guidance are followed,
they will be more likely to resolve a breach
case involving a ransomware payment
through means other than a monetary
penalty or criminal investigation.
Advice and consequences
Commercial, operational, financial and
reputational consequences of responding
inadequately to a ransomware attack, or
of breaching the regulations or another
sanctions regime, can be devastating. So,
what should organisations do? There are a
number of steps.
Become cyber resilient
Taking proactive cyber resilience measures
is key. This means adopting and fostering
a security culture which includes cyber
security governance; the identification
and protection of key assets; putting in
place fit-for-purpose IT capabilities and
business continuity plans; and having a
comprehensive understanding of data
storage and security.
The NCSC’s CEO said in NCSC Annual
Review 2022 that ransomware remains
the most acute threat that businesses
and organisations in the UK face.
Implementing the NCSC’s advice and
guidance drastically reduces the risk of
a successful ransomware attack. OFSI
guidance lists links to various tools and
resources available, including the recently
updated Cyber Security Toolkit for Boards.
OFSI guidance sets out some basic
practical steps for organisations to follow
if they do fall victim to a ransomware
attack. This includes disconnecting
Organisations need
to implement clear
cyber security and
internal sanctions
policies with
supporting guidance
and compliance
manuals tailored to
the business and the
level of risk it faces.
any infected device from all network
connections and attempting to restore
from back-ups, which may result in there
being no need to consider a payment.
Run sanctions due diligence
Organisations should routinely consider
whether sanctions might affect their
transactions, contracts, products or
policies. They should also put in place
appropriate due diligence measures to
manage any identified or anticipated risks
of breaching financial sanctions.
The probability and potential impact of
sanctions risk will be specific to individual
businesses, even within the financial
services sector. But as an initial step,
organisations should think about how the
business is organised, where it is located,
where it trades and the nationality of
employees, shareholders and directors.
Obvious questions to consider are: Where
are goods or services coming from or going
to, who are they from or who is receiving
them? Who is transporting them, how and
via what routes? Where have products
Brave | Curious | Resilient / www.cicm.com / December 2023 / PAGE 22