Australia's 72-hour ransom payment reports are the model Britain should copy first

Australia now counts what Britain can only estimate

Since 30 May 2025, any business carrying on trade in Australia with annual turnover of AUD 3 million or more that hands money to an extortionist has had 72 hours to tell the government, under Part 3 of the Cyber Security Act 2024. Within five months, a Home Affairs disclosure under freedom of information showed 46 payment reports between 30 May and 24 October 2025. Britain, by contrast, has a 2025 consultation response, a stated preference for a targeted ban on payments by the public sector and regulated critical national infrastructure, and an admission from its own officials that they cannot yet measure whether any of it works. My argument is simple, and I hold it fairly firmly: switch on payment reporting first, run it for a year, then decide how far a ban should reach.

That ordering matters to every UK board that holds cyber insurance or sits in a critical sector. If the ban arrives first, it will be calibrated on survey sentiment and leak-site counts. If reporting arrives first, it will be calibrated on what British organisations actually paid and to whom.

Australia's design is deliberately narrow. Reports are required only when money (or a non-monetary benefit) moves, and an unpaid demand triggers nothing. Each report must cover, where known, the demand, the amount actually handed over, the ransomware variant, the vulnerabilities exploited and a brief account of any pre-payment negotiation, according to the Home Affairs factsheet. Canberra also said plainly why it wanted the data, with the factsheet listing as one purpose "to assist the Government in future legislative proposals and other programs that directly target the scourge of ransomware and cyber extortion within the Australian economy." In other words, Australia collected evidence before writing the next law. Britain is minded to do it the other way round.

Critics argue that only a ban changes what attackers do

Here is the strongest objection, and it deserves a fair hearing. Reporting a payment does not stop the payment, and a criminal group that has already been paid loses nothing because a form lands in a government inbox three days later. Ransomware is a business, and the Home Office's own options assessment puts the logic well, stating that "the perception that a victim will pay the ransom demanded is a key factor in a criminals' decision to invest time and resources in instigating an attack." Only a prohibition removes that perception. British public opinion appears to agree. In the 2025 consultation, 72 per cent of respondents backed a targeted ban for critical infrastructure and the public sector, with 23 per cent opposed, and 68 per cent thought it would cut the money reaching criminals.

Much of that is right, and a reporting duty on its own is weak deterrence. Australia's penalty for failing to report is 60 penalty units, which iTnews put at AUD 19,800 in February 2026, a sum that would not trouble a company paying a seven-figure ransom. And Australia's experience gives ban supporters some ammunition, because its reports kept arriving every month despite official advice not to pay.

But the objection proves less than it claims, for two reasons. First, the UK is not choosing between reporting and a ban. Its government response proposes both, plus a payment prevention regime, so the real question is sequence and scope. Second, the Home Office has conceded that it cannot tell whether a ban is working. Its options assessment says a reduction in payments from UK business would count as success, "however due to current underreporting and the lack of a true baseline, measurement will not necessarily be possible." A policy whose own authors say they cannot measure its central outcome needs a baseline before it needs teeth.

There is also a displacement risk that a ban-first approach makes worse. The Home Office recorded respondents' concern that a threshold-based payment regime "would push ransomware attackers to change their tactics and targets to target organisations below any threshold." Britain does not yet know, with data, which sectors and which sizes of British firm pay most often. A year of payment reports would answer exactly that question, and it would show whether a ban on critical infrastructure is shifting attacks onto their suppliers.

What a year of Australian reports actually shows

Australia's numbers are modest in size and striking in regularity. The Home Affairs FOI release FA 25/10/01937, published on 1 December 2025, broke the first 46 reports down by month: 11 from 30 May to the end of June, then 8 in July, 10 in August, 10 in September and 7 in the first 24 days of October 2025. iTnews later obtained updated figures showing at least 75 businesses above the turnover threshold reported payments in the eight months to January 2026, with between 7 and 13 paying every month. Critical infrastructure entities, which also face the duty, made a further 19 payment reports over the same eight months to January 2026.

Those counts cover only part of the economy. Firms below AUD 3 million in turnover, unless they run critical infrastructure, are outside the duty, so the figures are a floor. Home Affairs also told iTnews it expects the number of payments reported to increase as familiarity with the obligation grows, which I take to mean some payers are not yet filing. I would not read too much into a monthly series this short. What it does give Australia, for the first time, is a steady count drawn from law rather than from vendor surveys or criminal leak sites.

Compare what Britain can see. The Home Office's evidence base leans on the Information Commissioner's breach reports, which peaked at 511 ransomware incidents in the second quarter of 2023, and on private sector reporting that UK victims on leak sites have doubled since 2022, and neither source tells you who paid. Meanwhile the government's Cyber Security Breaches Survey 2025/2026, published in April 2026, found 49 per cent of businesses had a rule not to pay ransoms, while 24 per cent did not know what their organisation's policy was. That is a measure of intention and confusion, useful in its way, but a long distance from a count of payments.

Why payment data beats incident data for this decision

Britain's proposed reporting regime is broader than Australia's, and in one respect that is a weakness. The UK response describes an economy-wide duty for suspected victims to file an initial report within 72 hours of an attack and a fuller one within 28 days. That will produce a large volume of incident data, much of it noisy, from organisations still working out what hit them. It took 63 per cent net agreement in the 2025 consultation, the strongest support of any reporting option, so it may well happen.

Australia's narrower trigger has a virtue the British design lacks. A payment is a discrete, verifiable event with an amount, a date, a wallet and a counterparty. Firms know when they have paid in a way they often do not know, at hour 72, whether an intrusion was ransomware at all. If the question for policy makers is whether to ban payments, and in which sectors, then the most relevant data is a record of payments. Incident reports answer a different question about threat levels, which the National Cyber Security Centre and the Information Commissioner already partly cover.

The UK payment prevention regime would capture something close to this, since victims would have to report their intent to pay, after which the government would review the proposed payment and could block it where sanctions or terrorism finance rules apply. Officials are clear that payments would not be approved under the scheme. Intent is still not the same as payment, though, and a regime that also reviews and blocks will make some firms reluctant to engage at all. A plain duty to report a completed payment, with Australian-style limits on how the data may be used, is the cleaner first step.

Protection of the data is what makes reporting work

Australia's lawmakers understood that a payer is also a victim. Under sections 29 and 30 of the Act, report contents may be used only for permitted purposes, and the factsheet states that the information will not be used for enforcement action except where Part 3 explicitly allows it. Home Affairs also ran an education-first phase from 30 May to 31 December 2025, pursuing regulatory action only for egregious non-compliance, before moving to a compliance phase from 1 January 2026.

British respondents asked for exactly this kind of reassurance. One organisation told the Home Office that penalising non-compliance "could push incidents underground, reducing visibility into ransomware threats and hindering collective efforts to combat them," a warning published in the 2025 government response. Around nine in ten respondents wanted guidance and expert support from the NCSC or law enforcement attached to any reporting duty. A UK scheme that copied Australia's use limits and its grace period would answer most of those concerns before they hardened into avoidance.

I am less certain about the turnover threshold. A cut-off like Canberra's would spare micro firms, but the same consultation warned that thresholds shape behaviour and displace attacks. On balance I would start with a threshold and publish the data needed to test whether it is in the wrong place.

What a ban looks like once the data exists

None of this means a ban is wrong. With a year of payment data, the Home Office could see whether payments cluster in local government or in particular parts of critical infrastructure, and could set the scope of a ban accordingly. It could also see whether ban-covered sectors push payments through suppliers or overseas parents, a route the Australian factsheet already anticipates by requiring reports when a third party pays on a business's behalf.

That is the real lesson from Canberra. Its regime does not settle whether paying should be lawful. It simply makes sure the next argument about that question is conducted with numbers rather than instinct, which is more than Britain can say today.

What UK boards and insurers should do before 2027

Assume a payment reporting duty is coming, whatever form the final legislation takes, and build the route now. Name the person who files, agree in advance who signs off a payment decision, rehearse the filing in a tabletop exercise and write down where the 72-hour clock starts in your organisation (the Australian rule starts it at the payment, or at the moment you learn one was made on your behalf).

Keep a decision record for every ransom demand, paid or not, covering the amount demanded, the advice taken, the sanctions checks made and the reasons for the final call. Insurers and incident response firms that negotiate on clients' behalf should agree with each client who reports and when, because Australia's model holds the victim responsible even when a third party pays.

Groups with Australian operations above AUD 3 million in turnover are already inside Part 3 and have been in the compliance phase since January 2026. For them, building one British and Australian process now costs little. For everyone else, the useful exercise is to ask how your board would explain a payment in a mandatory report filed within three days, and whether that explanation would survive being read by a regulator later.