UK Sanctions Implementation and Strategy Taskforce: Ransomware Sanctions

The ransomware sanctions regime has expanded in recent years and has become a core component of the UK’s counter-ransomware strategy. The government aims to use sanctions to expose ransomware criminals’ identities, undermine their ability to monetise ransomware, and degrade other criminals’ trust in key ransomware services.

In February 2025, as part of ongoing work through its UK Sanctions Implementation and Strategy Taskforce, RUSI convened an online workshop to discuss the UK’s experience with ransomware sanctions to date. The workshop was jointly organised by the Centre for Finance and Security and the Cyber and Tech research group at RUSI. A select group of 35 expert stakeholders from the UK, US and Canada attended the workshop. Participants represented a diverse range of professional backgrounds. These included incident responders, ransomware payment brokers, cryptocurrency tracers, lawyers, academics, law enforcement officers and UK government officials.

The first section of this report provides an overview of the discussion relating to the implementation of UK cyber sanctions. The second section focuses on the discussion pertaining to the sanction regime’s ‘theory of change’. The third section describes the impact of sanctions on ransomware threat actors. The fourth section articulates participants’ perspectives on the state of play with respect to compliance and enforcement. Finally, the report outlines policy implications for the UK’s role as a cyber sanctions proponent in a dynamic international context. None of the discussions at the event are attributable.