iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
It is not currently established as a law. The UK Government proposed a targeted ransomware-payment ban in a Home Office consultation launched in January 2025. The proposal would cover UK public-sector bodies, including local authorities, and specified regulated owners and operators of Critical National Infrastructure (CNI). The Home Office published its consultation response on 22 July 2025, and a parliamentary answer on 17 December 2025 said policy was still being developed with industry and government departments.
What the UK proposal would ban
The consultation’s Proposal 1 was headed: “Targeted ban on ransomware payments for all public sector bodies, including local government, and for owners and operators of Critical National Infrastructure, that are regulated, or that have competent authorities.” That wording describes a proposed statutory restriction, not an operative rule.
The policy objective is to stop public money and essential-service operators’ funds from reaching ransomware groups. The Government’s stated rationale is that removing payment revenue could reduce the financial incentive to attack public services and infrastructure.
Public-sector coverage
The contemplated scope included central and local government, schools and the wider public sector, including health organisations. It was intended to extend the existing central-government position against using taxpayer money to pay ransomware demands.
#1 Best Overall
CNI coverage
The CNI element focused on owners and operators in sectors identified by the National Protective Security Authority where they are regulated or have a competent authority. The consultation did not establish that every company supplying a critical service would automatically be covered. Whether essential suppliers and other supply-chain organisations should also be included remained an open question.
Is the ban law yet?
The official material identified for this article does not establish enactment of this specific ban by 30 September 2026. The Home Office published a consultation response on 22 July 2025. In a written answer published by the UK Parliament on 17 December 2025, the Government said it was considering a proportionate approach and continuing policy development with industry and relevant departments.
Organisations should therefore distinguish a consultation proposal from a legal prohibition. The final scope, commencement date, enforcement arrangements and any statutory exceptions would need to be set out in legislation or binding rules before the ban could operate as law.
Free tools Windows power users keep installed
One-click scans. No signup required.
What consultation respondents said
The Home Office reported the following views from consultation respondents:
| Question | Reported response | What it means |
|---|---|---|
| Should Government implement the targeted ban? | 72% agreed; 23% disagreed | These are respondent opinions, not evidence from an implemented ban. |
| Would the ban reduce money flowing to ransomware criminals? | 68% thought it would | This records expectations rather than a measured reduction in criminal revenue. |
| Would it deter criminals from attacking organisations in scope? | 60% thought it would | This is a predicted deterrent effect, not an observed change in attack rates. |
| Should there be an exceptions process? | 43% agreed; 40% disagreed; 17% did not know | Views were closely divided, so the design of exemptions was unsettled. |
The consultation also recorded mixed views about extending the policy to CNI and public-sector supply chains. None of these percentages proves that a ban would reduce attacks, payments or criminal income in practice.
How the ban relates to the other proposals
The consultation package considered three distinct policy mechanisms. They should not be treated as interchangeable or as measures that have all been enacted.
| Measure | What it would regulate | When the obligation would arise | Potential coverage |
|---|---|---|---|
| Targeted payment ban | Making a ransomware payment | Before or when an organisation proposes to pay | Public-sector bodies and specified regulated CNI owners and operators |
| Payment-prevention regime | Steps intended to prevent or control ransom payments | Before a payment decision | Coverage and final design were still being developed |
| Mandatory incident reporting | Reporting a ransomware incident to authorities | After, or upon discovering, an incident | Coverage, thresholds and deadlines were subject to policy development |
The Government response said the payment-prevention and reporting measures would continue to be developed with industry, with guidance and supporting material made available.
What remains undecided
Exact CNI boundaries
The proposal referred to regulated CNI owners and operators and organisations with competent authorities. It did not settle whether particular suppliers, contractors or wider supply-chain entities would fall within the ban.
Exceptions
Respondents were almost evenly split on an exceptions process. The sources reviewed do not establish which circumstances, if any, would qualify for an exception, who would approve it or how quickly a decision would be made during an active attack.
Enforcement and commencement
The reviewed official material does not establish the final offences, penalties, regulator powers, commencement date or transition arrangements. Those details matter because a prohibition can affect an organisation’s incident-response decisions, insurance arrangements and negotiations with criminals.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What organisations should do while policy develops
The proposal does not remove the need for immediate ransomware preparation. Public bodies and critical-service operators should follow current official cyber guidance and their regulator’s requirements rather than assume the proposed ban is already in force.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Maintain tested, offline-capable backups and restoration procedures.
- Define who can declare an incident and who can make urgent legal, operational and financial decisions.
- Record contacts for law enforcement, regulators, insurers, incident responders and key suppliers.
- Review contracts and supply-chain dependencies so responsibilities are clear if a supplier is attacked.
- Prepare an incident-reporting workflow that can be updated if new mandatory requirements take effect.
- Obtain legal advice before making any payment decision; this article is not legal advice.
Why the distinction between proposal and law matters
A consultation can show the Government’s direction of travel and the concerns it is testing, but it does not create a criminal offence or immediately prohibit a payment. Until legislation or binding rules are published and commenced, an organisation cannot infer the final legal position from the consultation percentages or proposal heading alone.
The clearest current description is therefore: the UK has considered a targeted ban on ransomware payments by public-sector bodies and specified regulated CNI owners and operators, while continuing to develop the policy. The scope, exemptions and implementation details were not settled in the official material reviewed through 30 September 2026.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
