The 24-Hour Ransomware Clock Doesn’t Care If Your Controls Worked

Most boards still hold a comfortable picture of ransomware: a sophisticated attacker gets in, encrypts the systems, and demands money. The security team handles it painfully, but it’s an IT problem. What’s changed is that the regulatory infrastructure built up across UK financial services between 2021 and 2026 has put a price on holding that view any longer.

The Story Boards Tell Themselves

The National Cyber Security Centre (NCSC) logged 204 nationally significant cyber incidents between September 2024 and August 2025, a 130% jump on the previous year and the highest annual count on record^[1], with ransomware at the centre of it^[2]. But the threat itself matters less than the question regulators now ask about it. Whether your controls stopped the attack interests them far less than what your organisation did the moment it started, and whether the governance existed to do it properly. Prevention and governance are different functions with different investment profiles, and the space between them is where most financial services firms are exposed.

Regulators have accepted that breaches will happen. What they’re measuring now is whether your organisation was built to function through one.

Four Clocks, Running Simultaneously

A single ransomware attack on a regulated UK financial institution doesn’t trigger one regulator. It triggers at least four, each with its own timeline, its own evidential expectations, and penalty structure.

• FCA / PRA — Under FCA PS26/2^[3] and PRA PS7/26^[4] (joint policy, March 2026, effective 18 March 2027), firms must report within 24 hours of determining an incident clears the materiality threshold; payment service providers face a 4-hour clock^[5]. Submissions go through one portal: FCA Connect. The FCA has been explicit that 24 hours is a ceiling, not a planning target. They’ll also want evidence that important business services were restored within the firm’s documented impact tolerances, which means those tolerances need to have been tested, not just written down.
• ICO — UK GDPR gives a 72-hour window for personal data breaches^[6]. When the ICO fined Advanced Computer Software £3.07m in March 2025 (a case examined more closely below), the figure carried a lesson in behaviour^[7]. Advanced had cooperated proactively with the NCSC, the National Crime Agency (NCA), and the National Health Service (NHS). The ICO’s original calculation was £6.09m. How an organisation behaves during the incident directly shapes what it pays afterwards.
• Office of Financial Sanctions Implementation (OFSI) — OFSI is the one most firms haven’t mapped into their playbooks. Under the Cyber (Sanctions) (EU Exit) Regulations 2020, making or facilitating a ransomware payment to a designated person is a financial sanctions breach. The liability standard is strict; no knowledge of the designation is required. The civil penalty runs to £1 million or 50% of the transaction value, whichever is larger; at the criminal level, executives face unlimited fines and up to seven years in custody^[8]. And as of early 2026, an FOI disclosed that OFSI is actively pursuing up to five suspected breaches, the first ever since the regime came into force, all involving financial services firms^[9].

Any one of them creates significant liability: concurrent investigations, penalties stacking across separate legal frameworks, and executives named under the Senior Managers and Certification Regime.

More Money, Less Readiness

UK financial services firms are spending more on cybersecurity than ever before. In the UK, 94% of finance leaders expect their cyber budgets to increase over the next twelve months^[10]. And yet Cisco’s Cybersecurity Readiness Index found that while 93% of organisations raised budgets by at least 10%, 70% still sit in the formative or beginner categories of resilience maturity^[11]. The investment is going to the right problem from five years ago. What the FCA’s March 2026 operational resilience self-assessment identified was a gap in board-level oversight and governance accountability, not technical capability^[12]. Firms could articulate their resilience; they couldn’t evidence it, and regulators now treat those as different things. Firms that have spent heavily on prevention have built strong technical defences but weak governance.

The board question isn’t “can we afford to invest in ransomware governance?” It’s “what does it cost us if we don’t?” The Advanced Computer Software case answers that: £6.09m before mitigation.

Your Supplier’s Problem Is Now Your Liability

The Advanced Computer Software attack in 2022, a LockBit ransomware operation, didn’t breach a bank. It breached a technology supplier whose software served 82 NHS organisations. Through that single point of compromise, the personal data of 79,404 people was exfiltrated, including home-entry details for 890 individuals receiving home care^[7]. The failures the ICO identified were basic: gaps in MFA, inadequate vulnerability scanning, and patch management that hadn’t kept pace. These are things a supplier audit should catch. The enforcement action established that ‘should’ is no longer sufficient. Advanced was a processor, not a data controller, and the ICO made clear that the era of suppliers operating at arm’s length from direct enforcement had ended^[7]. Processors are in scope. And so, by extension, is every regulated firm that relies on them.

Over 40% of the cyber incidents reported to the FCA in 2025 involved a third party, the figure the FCA cited in March 2026 as the rationale for mandatory third-party registers and reporting^[13]. PRA Supervisory Statement SS2/21, updated effective from March 2027, pushes further: firms must assess materiality across all third-party arrangements, maintain detailed registers, and critically map the dependencies of their dependencies. Regulators increasingly expect you to know what your critical supplier’s infrastructure relies on^[14]. The gap that threat-led testing consistently exposes isn’t in firms’ own controls. The FCA’s CBEST and STAR-FS programmes, referenced in the August 2025 Cyber Coordination Group insights, keep finding the same thing: the distance between what firms assume their suppliers can do under stress and what those suppliers can actually do is wider than almost any other vulnerability in the resilience picture^[15]. Annual vendor questionnaires don’t close that gap. They document the assumption of control while retaining the underlying exposure.

The Ransom Decision You Need to Make Before the Attack

In most organisations, the decision to pay a ransom is made under pressure, by whoever’s in the room, with partial information. This decision now carries criminal risk for a UK-regulated financial institution.

The UK cyber sanctions list currently designates 95 individuals and entities linked to malicious cyber activity^[16]. Ransomware is disproportionately attributed to state-sponsored actors and criminal groups that appear on that list or those of allied jurisdictions. A payment that reaches any of them triggers the strict-liability sanctions exposure, including the civil and criminal penalties set out above^[17]. OFSI’s guidance on what firms can do to reduce exposure is direct: report the incident through the government’s Where to Report a Cyber Incident portal, engage law enforcement, and bring in the NCSC and NCA before any payment decision is made^[18]. These steps don’t just look good in a subsequent enforcement review; they shaped the outcome in the Advanced case. They are precisely what halved the bill.

The governance infrastructure — a designated contact for OFSI notification, a board-ratified decision framework, pre-agreed legal counsel, and an escalation path that doesn’t require a committee to convene — must exist before the demand arrives. The organisation that discovers mid-crisis that no one has clear authority to make this call is in a worse position than one with a framework, even an imperfect one.

Six Things That Have to Exist Before the Attack

• Regulatory horizon-scanning — Someone whose job includes reading FCA, PRA, ICO, OFSI and NCSC publications as they land and turning them into programme decisions, because the rules have been moving faster than most cyber governance frameworks.
• Recovery evidence, adversarially tested — A BCP describes recovery. CBEST and STAR-FS exist because regulators stopped taking the description on trust.
• A board-ratified ransom framework — Setting out who can authorise what, the preconditions before any payment is considered, and which Senior Manager owns the decision under the SMCR Phase 1 reforms confirmed in April 2026^[19].
• Notification infrastructure that survives stress — Templates pre-drafted for FCA Connect, ICO formats and the Where to Report a Cyber Incident portal. A named Regulatory Notification Lead who can file without waiting for a committee. Escalation paths rehearsed in a tabletop, because the 24-hour clock runs whether your legal team is reachable at 3am or not.
• Continuous assurance over material third parties — Ransomware-specific attestations on detection, response and recovery times, audit rights you exercise, and sight of the sub-suppliers whose failure would reach you. SS2/21 requires it; it also happens to be how firms discover where their exposure really sits.
• Sanctions screening from hour one of the incident, not hour one of the payment decision — OFSI Consolidated List checks from first confirmed indicators, a pre-identified Designated Person for notification, and an annual tabletop that runs the sanctions protocol alongside the technical response.

Reading the Signals: Where This Goes Next

UK financial regulation tends to telegraph itself. Consultations, enforcement action, supervisory letters and legislation abroad usually run one to three years ahead of the formal requirement, and the firms that get through regulatory shifts without a crisis are rarely the best resourced — they simply treated those early signals as if they were already rules.

The current crop is easy to read. Australia’s Cyber Security Act 2024 made ransomware payment reporting mandatory from May 2026^[20]. The UK sits behind that position but is moving the same way: the Home Office’s July 2025 consultation response confirmed enough support to proceed with mandatory ransomware reporting and targeted payment restrictions^[21],[22], and the Cyber Security and Resilience Bill, in committee since June 2026, already lists ransomware as an explicitly reportable incident carrying a 24-hour initial notification obligation^[23].

Then there’s DORA. In force since January 2025, it requires financial entities to quantify ICT recovery times and prove them through structured threat-led testing^[24]. UK firms with EU-facing operations are running both regimes already, and it’s a reasonable bet that UK impact tolerances end up on the same footing: recovery times you can demonstrate under adversarial conditions rather than describe in a plan.

Personal accountability is heading somewhere more specific too. SMCR Phase 2, expected through 2026–2027, points toward tightly scoped prescribed responsibilities^[25] — in practice, a named Senior Manager holding a documented remit for ransomware governance, for whom having no pre-attack framework would by itself breach their conduct obligations.

What Actually Has to Change

Ransomware has been reclassified through five years of enforcement decisions, supervisory statements, and cross-jurisdictional policy convergence from a technical incident into a test of governance. Most boards haven’t registered it yet.

The CISO presenting the board with detection metrics and containment timelines is still answering the 2019 version of the question. The current version is: when it happened, did you detect it quickly enough, govern the response correctly, get the right notifications out on time, and produce evidence of all of it? Those questions require a different programme architecture — not instead of the technical controls, but layered on top of them.

The Advanced Computer Software case puts a number on what that architecture is worth. Cooperation during the attack halved the penalty. Building the six capabilities described in this article costs a fraction of that fine, and unlike a fine, it also reduces the probability of the underlying event.

The window for doing this work thoughtfully closes when the 24-hour clock starts. For most regulated financial institutions, that window is right now. The cost of not acting has already been priced by the Advanced penalty notice, discounted only because they cooperated. Most organisations won’t get that choice. They’ll be making the ransom decision, the notification call, and the board escalation simultaneously, with none of the frameworks in place to do any of them well.

---

References

All references are cited in-line throughout the article. Sources reflect published regulatory guidance, enforcement decisions, and policy statements as of June 2026.

1. NCSC Annual Review 2025: Nationally significant cyber incidents rose to 204 (September 2024–August 2025), a 130% increase year-on-year. ncsc.gov.uk
2. NCSC Annual Review 2025: Ransomware identified as the most pressing cyber threat to the UK. ncsc.gov.uk
3. FCA PS26/2: Operational Incident and Third Party Reporting (March 2026). FCA, PRA and Bank of England joint policy statement establishing unified reporting regime. fca.org.uk
4. PRA PS7/26: Operational Resilience — Operational Incident and Third-Party Reporting (March 2026). Rules effective 18 March 2027. bankofengland.co.uk
5. Macfarlanes (April 2026): Analysis of PS26/2 notification timelines — 24 hours for most firms; 4 hours for PSPs. macfarlanes.com
6. UK GDPR, Article 33(1), retained in UK domestic law via the Data Protection Act 2018; ICO, ‘Personal Data Breaches: A Guide’ — notification must be made without undue delay and no later than 72 hours after becoming aware of the breach. ico.org.uk
7. ICO Monetary Penalty Notice: Advanced Computer Software Group Ltd, £3,076,320, March 2025. ico.org.uk
8. OFSI Monetary Penalties Guidance & SAMLA 2018 (with strict-liability clarification from the Law Society, June 2026): Civil monetary penalties for financial-sanctions breaches can reach £1 million or 50% of the transaction value, whichever is higher. Criminal breaches under the Sanctions and Anti-Money Laundering Act 2018 carry unlimited fines and up to seven years’ imprisonment. The Law Society notes that OFSI may impose civil penalties on a strict-liability basis, meaning no knowledge requirement. lawsociety.org.uk
9. Mishcon de Reya (February 2026): OFSI investigating up to five suspected cyber sanctions breaches — first since regime introduced; all financial services firms. mishcon.com
10. Elisity / Gartner (2026): Global cybersecurity spending projected at $240 billion in 2026. IBM Cost of a Data Breach Report 2025: average financial sector breach cost $5.56m. elisity.com
11. Cisco Cybersecurity Readiness Index (2025): 93% of organisations raised budgets by at least 10%; 70% remain in formative or beginner resilience maturity stages. techinformed.com
12. FCA Operational Resilience Self-Assessment Review (March 2026): Board-level oversight and Senior Management accountability identified as primary governance gaps. regulationtomorrow.com
13. FCA (March 2026): ‘In 2025, over 40% of cyber incidents reported to us involved a third party.’ fca.org.uk
14. PRA SS2/21 (updated March 2027): Outsourcing and Third Party Risk Management — updated with further material third-party expectations. bankofengland.co.uk
15. FCA Cyber Coordination Group Insights (August 2025): CBEST and STAR-FS findings; third-party dependencies as primary resilience gap. BCLP Analysis, April 2026. bclplaw.com
16. OFSI / Comsure (March 2026): UK cyber sanctions list — 95 designations (82 individuals, 13 organisations). comsuregroup.com
17. Comsure / Mishcon de Reya (March 2026): Civil penalties up to £1m or 50% of breach value; criminal sanctions up to seven years’ imprisonment. comsuregroup.com
18. OFSI Guidance on Ransomware and Financial Sanctions (February 2024, updated): Mandatory mitigation steps — Where to Report a Cyber Incident portal; law enforcement engagement. gov.uk
19. FCA PS26/6 / PRA PS12/26 (April 2026): Phase 1 SMCR reforms — preserve individual accountability, streamline administrative burden. fca.org.uk
20. Australia Cyber Security Act 2024: Mandatory ransomware payment reporting obligations in force May 2026. Broad entity scope. jdsupra.com
21. Home Office Ransomware Consultation Response (July 2025): Government confirmed sufficient support to proceed with mandatory reporting and payment restrictions. publishing.service.gov.uk
22. Coalition Inc / DAC Beachcroft (2025): 72% of consultation respondents supported targeted ransomware payment ban for public sector and CNI operators. coalitioninc.com
23. Cyber Security and Resilience Bill (introduced November 2025): Ransomware explicitly reportable; government to consult on payment restrictions in 2026. taylorwessing.com
24. EU Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554): Applicable from 17 January 2025. aigovhub.io
25. HM Treasury SMCR Consultation Response (April 2026): Government to amend primary legislation for greater SMCR flexibility. Phase 2 reforms anticipated. gov.uk