Deciding Before the Deadline: A Board Framework for Ransomware Payment Choices

The gap between policy and a live crisis

Most boards have a cyber incident response plan. Fewer have a pre-agreed position on ransomware payments that can survive contact with a real demand. The distinction matters. An incident response plan tells people how to mobilise; a payment decision framework tells them what the board will and will not tolerate when the clock is running, the backups are uncertain and the criminals are making threats.

In 2026, ransomware remains a board-level risk because it is not only a technical event. It is a legal, regulatory, insurance and reputational event that may arrive with a deadline. The board does not need to negotiate with attackers. It does need to ensure that any decision to pay, or to refuse, is taken within parameters it has already thought through.

Start with prohibited outcomes, not preferred ones

A useful framework begins with boundaries rather than tactics. The board should identify outcomes that are unacceptable in any circumstances: a payment that would breach UK sanctions, a payment to a person or entity subject to financial restrictions, a payment made without appropriate legal and insurer involvement, or a transfer of funds through uncontrolled channels. These are not matters for crisis-time creativity.

From there, the board can set conditions that must be satisfied before any payment is considered. These might include confirmation of the payer and recipient, sanctions screening, insurer notification, law-enforcement engagement and a documented assessment of recovery alternatives. The point is to move the organisation from an unstructured debate about whether payment is distasteful to a structured test of whether it is lawful, insurable and defensible.

Sanctions and regulatory triage

UK sanctions obligations do not pause during an incident. A ransomware payment may engage sanctions regimes administered by the Office of Financial Sanctions Implementation, as well as money-laundering, terrorist-financing and proceeds-of-crime considerations. The board should not assume that a demand is payable simply because the attacker provides a wallet address or a broker.

A pre-agreed triage process should require specialist legal advice before any transfer. It should also identify who is authorised to make the final call and on what evidence. Regulators and law enforcement will not expect the board to have perfect information, but they will expect the organisation to show that it did not ignore obvious red flags.

Sector regulation adds another layer. FCA-regulated firms, insurers and other supervised entities may have notification obligations and operational resilience expectations that affect timing and communication. The board framework should map those obligations in advance so that the crisis team is not discovering them under pressure.

Engaging insurers and law enforcement without outsourcing judgement

Cyber insurers are important partners, not decision-makers. A policy may cover incident response costs, negotiation support or, where lawful, reimbursement of a payment. But the board remains responsible for the organisation. Early notification to the insurer is usually sensible, and the insurer may have approved vendors and preferred response routes. The board should nevertheless understand the limits of cover and the consequences of acting outside them.

Law-enforcement engagement is similarly practical. The National Crime Agency, Action Fraud, the National Cyber Security Centre and, where relevant, specialist police units can provide guidance and intelligence. Early contact may also create a record of cooperation that supports later regulatory explanations. The framework should name the route for contact and the person responsible for maintaining it, rather than leaving it to improvisation.

Reputation, ethics and stakeholder trust

Payment decisions carry reputational risk in both directions. Paying may fund criminal activity and encourage further attacks; refusing may prolong disruption and harm customers, employees or patients. The board should not pretend there is a clean ethical answer in every case. It should instead document how it weighed the harm of payment against the harm of non-payment.

Stakeholder communication should be part of the framework. Customers, employees, regulators and investors may ask not only what happened but how the board decided. A prepared statement of principles, even if not published, helps ensure consistency between the boardroom, the communications team and the incident responders.

The evidence trail a board should be able to produce

The test after an incident is rarely whether the board made a popular decision. It is whether the board exercised reasonable judgement on the information available. That requires evidence: minutes showing the framework was set in advance, records of legal and sanctions advice, insurer notifications, law-enforcement contact, recovery assessments and the rationale for the final decision.

The board should also record what it did not know and why. Uncertainty is not a failure of governance if it is identified and managed. A decision log that shows options considered, advice taken and conflicts disclosed is more persuasive than a retrospective narrative written after the event.

Rehearse the decision, then review it

A framework that has never been tested is a document, not a control. Boards should run a tabletop exercise that reaches the payment decision, not merely the technical containment phase. The exercise should include legal counsel, the insurer, communications and, where appropriate, law enforcement. It should test whether the people expected to make decisions can actually reach each other and whether the evidence trail works in practice.

Afterwards, the board should review the framework annually and after any near miss. Ransomware tactics change, sanctions designations change and insurance terms change. The board's position should not be static. The objective is not to make payment easy or impossible. It is to ensure that if the question arrives at an unsociable hour, the organisation already knows how to answer it lawfully, consistently and with evidence that stands up to scrutiny.