Legislation to be introduced to tackle payments to cyber criminals and increase incident reporting

The UK government has announced plans to introduce new legislation which will counter ransomware payments and increase visibility and intelligence for the fight against cyber criminals.

The announcement comes after a consultation earlier in 2025 which we broadly supported the proposals being made. 

What is being proposed

The government response to the consultation sets out an overview of the responses, key 
findings and sets out the next steps for policy development. Overall, the feedback to the consultation proposals was positive and constructive. 

Under the proposals to be taken forward, public sector bodies and operators of critical national infrastructure, including the NHS, local councils and schools, would be banned from paying ransom demands to criminals under the measure, with nearly three quarters of consultation respondents showing support for the proposal.

Businesses not covered by the ban would be required to notify of any intent to pay a ransom. Those businesses could then be offered advice and support, including notifying them if any such payment would risk breaking the law by sending money to sanctioned cyber-criminal groups.

In addition, mandatory reporting of ransomware attacks would be required, which would equip law enforcement with intelligence to fight against cyber criminals aimed at disrupting their activities and allowing for better support for victims. 
 
The government now intends to develop the detail of the proposed measures in collaboration with industry, and guidance and other supporting and clarifying documents will be made available in due course.

Don’t wait

In the meantime, businesses should continue to be aware of the threat of a cyber-attack on their business and ensure that they have robust cyber security measures in place to deter against an attack together with appropriate plans to deal with a cyber incident.

As a first step, why not use the National Cyber Security Centre’s new free service for UK organisations which performs a range of simple online checks to identify common vulnerabilities in your public-facing IT. All checks are remote, without the need to install software and uses the same kind of publicly available information as cyber criminals use to find easy targets.

Access our cyber security resources