Countering Ransomware Financing

14 March 2023 - Ransomware attacks target individuals, businesses and government agencies, across the world. The impact of these attacks can be devastating for individuals, government agencies and business activity and even disrupt essential infrastructure and services.

This FATF report analyses the methods that criminals use to carry out their ransomware attacks and how payments are made and laundered. Criminals are almost exclusively using crypto, or virtual assets and have easy access to virtual asset service providers around the world. Jurisdictions with weak or non-existent AML/CFT controls are therefore of concern.

The report proposes a number of actions that countries can take to more effectively disrupt ransomware-related money laundering. This includes building on and leveraging existing international cooperation mechanisms, given the transnational nature of ransomware attacks and related laundering. Authorities also need to develop the necessary skills and tools to quickly collect key information, trace the nearly instantaneous financial transactions and recover virtual assets before they dissipate. The multi-disciplinary nature of ransomware also means that authorities must extend their collaboration beyond their traditional counterparts to include cyber-security and data protection agencies.

The FATF also finalized a list of potential risk indicators that can help public and private sector entities identify suspicious activities related to ransomware.