Recommended Free Tools
Australia’s mandatory ransomware and cyber-extortion payment reporting regime is already in force. A covered entity that makes a qualifying payment—or discovers that someone paid on its behalf—must submit a report within 72 hours.
What the Australian rule requires
The regime began on 30 May 2025. It requires a “reporting business entity” to give the designated Commonwealth body a ransomware payment report within 72 hours of making the payment or becoming aware that the payment was made for it, whichever event applies.
This is a reporting obligation, not a blanket ban on paying a ransom. The decision to pay still carries operational, legal, sanctions and recovery risks that should be assessed with qualified advisers.
Which entities are covered?
Businesses meeting the turnover test
The main category is a business carrying on business in Australia with previous-financial-year turnover of at least AUD $3 million. The threshold is based on the prior financial year, not an estimate of the current year.
Responsible entities for certain critical infrastructure
A responsible entity for an asset covered by Part 2B of the Security of Critical Infrastructure Act is also within the regime, subject to the rules applying to that asset and entity.
Businesses operating for only part of a financial year
If the business operated for only part of the previous financial year, the Rules scale the AUD $3 million threshold by the fraction of days it operated during that year. Calculate that adjusted threshold rather than applying the full-year figure automatically.
Payments arranged outside Australia or by another party
The obligation can still apply when an international office makes the payment or when an insurer, lawyer, negotiator, contractor or other third party pays for the Australian entity. The relevant question is whether the payment was made on the reporting entity’s behalf.
Rank #2
What event starts the reporting duty?
Payment of a ransomware or cyber-extortion demand
The trigger is an actual ransomware or cyber-extortion payment after a cyber-security incident affecting the reporting entity. A payment made directly by the business starts the 72-hour period when it is made.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Payment made by someone else
Where another entity pays on the business’s behalf, the clock runs from the business becoming aware of that payment. Incident records should therefore capture who authorised, arranged or funded the transaction and when the business learned it had occurred.
A demand without payment
A ransom demand, threat or negotiation that ends without payment does not trigger this mandatory payment report. Voluntary incident reporting and other legal or contractual duties may nevertheless apply.
Rank #3
Threats outside this regime
Physical-extortion threats and scam-related attacks are outside the mandatory ransomware-payment report described here. Home Affairs encourages organisations to make other appropriate reports for those events.
How the 72-hour deadline works
The period is a hard operational deadline for the report. The Act’s wording covers the two possible starting points: making the ransomware payment, or becoming aware that it was made on the entity’s behalf. The report needs only information the entity knows or can obtain through reasonable search or enquiry within that period; it is not required to wait for a perfect forensic investigation.
Use an incident log with time zones noted. Record the demand, negotiations, approvals, wallet or account details, payment method, transaction time, and the identity of every intermediary. Those records support both the deadline calculation and the prescribed report fields.
What information goes in the report?
Provide the following categories to the extent known or reasonably discoverable during the 72-hour period:
| Category | Examples of information to assemble |
|---|---|
| Business details | Legal identity, relevant contact details and information establishing that the entity is covered. |
| Incident facts | When and how the incident was detected, affected systems or data, and the response timeline. |
| Extortion demand | The attacker’s demand, communications, requested currency or asset, deadlines and negotiation history. |
| Payment information | Amount and asset paid, transaction date and time, payment route, recipient or wallet information, and any party that paid or facilitated it. |
If a field cannot be confirmed in time, submit what is available after a reasonable search or enquiry rather than delaying past the deadline while pursuing certainty.
A practical response sequence
- Preserve evidence. Secure ransom notes, chat logs, email headers, endpoint images, access logs, wallet addresses, invoices and approval records. Maintain a dated incident timeline.
- Classify the entity. Apply the AUD $3 million prior-year test, the part-year scaling rule where relevant, and the Part 2B critical-infrastructure category.
- Confirm whether payment occurred. Check treasury, insurer, legal, negotiator and contractor records, including payments made through an international office or another entity.
- Start the clock and file. Calculate 72 hours from the applicable payment or awareness event and use the official Cyber.gov.au ransomware payment reporting form.
- Review parallel duties. Coordinate customer and privacy notifications, insurer notices, regulator contacts, contractual reporting and sanctions checks with legal and incident-response advisers.
Other duties can run at the same time
A payment report does not replace obligations triggered by the underlying breach. Depending on what happened, the business may need to notify affected customers, its insurer, privacy or sector regulators, contractual counterparties or law-enforcement bodies. Timing and content come from the applicable privacy, critical-infrastructure, financial-services, employment and contract rules, so assess them separately.
Best Value
Sanctions screening is also important: a ransomware payment can create financial-crime and sanctions issues even when the attacker’s identity is uncertain. AUSTRAC’s guide dated 30 March 2026 describes relevant indicators and expressly presents itself as general guidance rather than legal advice.
What the rule does not establish
- It does not require a report for every ransom demand when no payment is made.
- It does not make ransom payment automatically lawful or automatically unlawful.
- It does not permit a business to postpone filing until every incident detail is proven.
- It does not eliminate separate customer, privacy, insurer, regulator or sanctions obligations.
- It does not provide a universal fine figure in the requirements described here; obtain current legal advice before assessing penalties.
Bottom line for finance and risk teams
Maintain a written ransomware-payment playbook before an incident occurs. It should identify who determines coverage, who can authorise a payment, how third-party payments are confirmed, who owns the 72-hour submission, and which customer, insurer, regulator and sanctions checks must run in parallel.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
