Countering Ransomware Financing

The Financial Action Task Force (FATF) has published a new Countering Ransomware Financing report, highlighting the dramatic increase in financial flows related to ransomware attacks in recent years.
The increase in such attacks is due to new techniques, such as targeting large, high-value entities and ransomware as a service. The report emphasizes the dire consequences of ransomware attacks, including damage and disruption to critical infrastructure and services. The FATF aims to improve understanding of financial flows linked to ransomware and provide good practices to address this threat.
The report finds that payments and laundering of ransomware proceeds are almost exclusively conducted through virtual assets. Criminals exploit the international nature of virtual assets to facilitate large-scale, nearly instantaneous cross-border transactions, sometimes without the involvement of traditional financial institutions. The report emphasizes the importance of accelerating the implementation of measures to mitigate risks linked to virtual assets and regulate the virtual asset service provider sector. Ransomware attacks are generally underreported, and a multi-disciplinary approach is required to effectively tackle ransomware-related laundering. Building and leveraging existing international cooperation mechanisms is imperative to successfully tackle ransomware-related laundering.
This report also provides suggestions for how countries can improve their ability to combat illicit financial flows related to ransomware. Some of the suggested actions include implementing relevant FATF Standards, enhancing detection of ransomware, promoting financial investigations and asset recovery efforts, adopting a multi-disciplinary approach to tackle ransomware, supporting partnerships with the private sector, and improving international cooperation. By implementing these practices, jurisdictions can better disrupt ransomware-related money laundering and dismantle transnational networks engaging in ransomware and associated money laundering.
Finally, as an addendum to the above report, the FATF also issued Potential Risk Indicators, including a list of examples of potential risk indicators for detecting suspicious transactions related to ransomware, which have been compiled from the experience and data received from jurisdictions across the Global Network. The list includes various perspectives across the process of making a ransomware payment, such as outgoing wire transfers to cybersecurity consulting or incident response firms, unusual incoming wire transfers from insurance companies that specialize in ransomware remediation, and high volume of transactions from the same bank account to multiple accounts at a VASP. The existence of a single indicator in relation to a customer or transaction may not alone warrant suspicion of a ransomware offence, but it could prompt further monitoring and examination. The indicators are relevant to both the public and private sectors, including VASPs, banks, and other financial and payment institutions.