Whether a company may pay a ransom following a cyberattack is, in the first instance, a question of law. In Puerto Rico, Ley Núm. 40-2024 (the "Cybersecurity Act") prohibits the government entities it covers, and their agents, insurers, and guarantors, from paying a ransom, subject to narrow exceptions. Under federal law, no statute prohibits a private company from paying. However, a payment to a sanctioned person or jurisdiction violates the regulations administered by the Office of Foreign Assets Control ("OFAC") on a strict-liability basis, and several regulatory regimes require that a payment be reported within hours. In this Legal Update, we summarize the Puerto Rico prohibition, the federal sanctions and reporting framework, and the governance process through which a payment decision should be made.
Two developments give the question current importance. CISA transmitted the final rule under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 ("CIRCIA") to the Office of Management and Budget on October 1, 2026; once the rule takes effect, covered entities will report ransom payments to CISA within 24 hours. And the presidential memorandum of August 12, 2026 created a program for vetted private companies to act against transnational cyber-enabled crime without altering the Computer Fraud and Abuse Act for companies outside it.
The Puerto Rico Prohibition
The Cybersecurity Act, the Ley de Ciberseguridad del Gobierno de Puerto Rico (Government of Puerto Rico Cybersecurity Act), as amended by Ley Núm. 140-2026, prohibits the government entities it covers, and their agents, insurers, or guarantors, from paying a ransom in connection with a cyber incident.[1] The statute permits exceptions on a case-by-case basis for critical infrastructure or where there is an imminent risk to life, in consultation with the Puerto Rico Innovation and Technology Service ("PRITS"). The Cybersecurity Act's definitions provide that a ransom payment includes payment in virtual currency.[2]
Two features of the prohibition extend its reach beyond the public sector. First, because it applies to the agents of covered entities, a private vendor that operates or manages systems on an agency's behalf may be bound by the prohibition when those systems are attacked. Second, because it applies to insurers and guarantors, a cyber insurer may not fund a payment on a covered entity's behalf. In our view, a private company whose contract with a covered entity places it in an agency role should treat the prohibition as applicable unless and until counsel concludes otherwise.
The Federal Framework: Sanctions
No federal statute prohibits a private company from paying a ransom. The principal federal constraint is the sanctions regime administered by OFAC. Under the International Emergency Economic Powers Act and the regulations issued under it, a US person may not engage in transactions with persons on OFAC's Specially Designated Nationals and Blocked Persons List or with persons in comprehensively sanctioned jurisdictions.[3] Civil liability for a prohibited payment is strict: the payor's knowledge of the recipient's identity is not an element of the violation.
OFAC's advisories on ransomware payments, first issued in October 2020 and updated in September 2021, state that OFAC will consider a company's timely report to law enforcement, its cooperation with the investigation, and its voluntary self-disclosure as significant mitigating factors in any enforcement determination.[4] The Financial Crimes Enforcement Network ("FinCEN") has separately advised that intermediaries facilitating ransom payments may be money transmitters subject to Bank Secrecy Act obligations.[5] Sanctions screening of the threat actor, its known affiliations, and the destination wallet should therefore precede any payment, and the screening should be documented. OFAC's emphasis on law-enforcement reporting also gives a company weighing payment a concrete legal reason to engage the FBI early, a step discussed in our Legal Update of October 17, 2026.
Reporting Obligations Triggered by a Payment
NYDFS. A company licensed by the New York State Department of Financial Services ("NYDFS") must notify the Department within 24 hours of an extortion payment. Within 30 days, it must provide a written explanation of why payment was necessary, the alternatives considered, the diligence performed, and the sanctions compliance undertaken.[6]
CIRCIA. CIRCIA requires covered entities to report a ransom payment to CISA within 24 hours of making it.[7] The requirement becomes binding when CISA's final rule takes effect. The rule has been under review at the Office of Management and Budget since October 1, 2026, and the effective date and covered-entity criteria will be set by the rule itself.
Insurance. Cyber insurance policies generally condition coverage of an extortion payment on the insurer's prior consent, and many require the use of a panel negotiator. A payment made without consent may fall outside coverage.
Active Defense Remains Unlawful
Companies under attack occasionally consider measures against the attacker's infrastructure. Such measures remain subject to the Computer Fraud and Abuse Act.[8] The presidential memorandum of August 12, 2026, "Expanding Capabilities to Combat Transnational Cyber-Enabled Crime," directed the Departments of Justice and Homeland Security to establish a program through which vetted, contracted private companies may undertake operations against transnational cyber-enabled crime; the program's procedures were due in October 2026. The memorandum did not amend the CFAA, and companies outside the program remain fully subject to it.
Practical Implications for Companies
A payment decision made correctly is the product of a process established before the incident. Companies should consider the following:
We will continue to monitor developments and will provide further updates as warranted. If you have questions about the matters discussed in this Legal Update, please contact the MZLS lawyers with whom you regularly work.
Endnotes
This publication provides general information on legal developments of interest to clients and friends of Maceira Zayas (MZLS). It is not a comprehensive treatment of the subject matter and does not constitute legal advice. Readers should consult counsel before acting on any matter discussed here. Developments after the date of this Legal Update are not reflected..
