In Switzerland, paying a ransom is not prohibited. That is the correct answer, it is written exactly that way in the Federal Council's report, and it ends the discussion in most meetings. That is where the problem starts. The question "ransomware, are we allowed to pay?" is asked as a legal question and ticked off as a legal question. During an incident it is a question of authority, and for most SMEs that question is open.
We see this regularly in our mandates. The technical part is documented somewhere, ransomware as a threat is known, backups exist. Ask who would be allowed to release a payment in cryptocurrency on a Sunday evening, and who checks beforehand whether the recipient appears on a sanctions list, and a pause follows. In a real incident that pause costs hours in which nobody decides and everybody waits.
The legal situation is cleared up quickly. After that, what remains open becomes visible. The money question, whether a payment is ever cheaper than recovery, we have calculated elsewhere.
What the Federal Council put in writing
On 13 November 2024, the Federal Council published its report "Massnahmen gegen Ransomware-Angriffe", in fulfilment of postulate 21.4512 Graf-Litscher. In one sentence, the report settles what is otherwise rumour: "In Switzerland there is no general prohibition on ransom payments in a ransomware attack; such payments are therefore in principle not punishable."
Three further findings from the same report matter more in practice than the first one:
- A ransom payment does not have to be reported to the authorities. For the payment itself there is no reporting duty.
- There is no obligation to involve the authorities in negotiations with the attackers, and therefore no entitlement to official support in those negotiations either. The report frames it as discretion: whether and in what form state bodies are consulted lies with the affected company.
- The Federal Council examined both a ban and a reporting duty for payments and decided against both, arguing that additional obligations after an attack burden crisis management without deterring attackers.
At the time, the legal comparison in the report showed a similar picture in comparable countries. That has shifted since. Australia introduced a reporting duty for ransom payments with the Cyber Security Act 2024, which came into force in 2025, and on 22 July 2025 the United Kingdom announced in its response to the consultation that it will ban payments for the public sector and regulated critical national infrastructure and require everyone else to notify an intent to pay. Switzerland stays with the status quo. So in Switzerland you get no rule that takes the decision off your hands, and no hotline that makes it for you. The decision stays in the house.
The case that shows it
In autumn 2025 the ransomware group Akira hit the US subsidiary of Ruag. The company paid. It then became a political issue, because the Confederation owns the defence group and the BACS has recommended against paying for years.
The review by the Federal Department of Defence reached a remarkably dry conclusion on 4 August 2026. The media release states that the decision was taken "within the scope of its entrepreneurial responsibility" and that "there are no indications of a breach of the law". As a company organised under private law, it carries the responsibility for its operational business decisions. The same text says that the Confederation and the department continue to uphold their recommendation not to pay a ransom.
Both are true at the same time, and that is the point. The recommendation is no. The decision sits with the company's governing bodies. Whoever takes it has to be able to explain it afterwards, and not only in legal terms. That is where the criticism starts: the assessment was "weighted towards legal and economic considerations", while "political and reputational effects as well as other overriding interests" were not sufficiently taken into account. Lawful and well decided are two different tests.
Three articles that remain in the room
"In principle not punishable" is not the same as "unproblematic". The same Federal Council report lists what a payment can trigger under criminal law. That list is rarely read in practice. The articles are in the Swiss Criminal Code:
Money laundering, Art. 305bis SCC. According to the report, ransom is demanded almost always in cryptocurrency. That raises the question whether such a payment counts as money laundering or as aiding it, precisely because the paying company and possibly the instructed bank can assume that the money flows into criminal activities. According to the report, this has not been clarified by the Federal Supreme Court so far.
Support of a criminal organisation, Art. 260ter SCC. The threshold here is lower than most people assume. It is enough that the company must at least accept the possibility that the payment serves the criminal purpose of the organisation. With a professionally organised ransomware group, that is not an exotic assumption.
Financing of terrorism, Art. 260quinquies SCC. The rarest case, but mentioned in the report, where terrorist groups generate money through cyber extortion.
As grounds for justification the report names necessity and excusable necessity (Art. 17 and 18 SCC) for people who are forced into such a payment. That too has not been settled conclusively.
And then there is a footnote that says more about security work than most specialist articles. Under Art. 102 SCC, a company itself can be punished if an offence cannot be attributed to a specific natural person because of deficient organisation. For Art. 260ter and Art. 305bis it goes further: there the company is punished irrespective of the criminal liability of individuals if it can be accused of not having taken all necessary and reasonable organisational measures to prevent the offence.
Translated: the law does not ask about your firewall. It asks whether you organised this case beforehand.
The part that catches Swiss companies most often
Sanctions are the point where a grey area can turn into a clear breach. The report states that a ransom payment could violate international sanctions, counter-terrorism financing measures or embargoes. A footnote gets concrete: a foreign authority can treat a payment made by a person subject to its jurisdiction as a sanctions violation and impose civil penalties on a strict liability basis.
Strict liability means good intentions and an emergency do not help there. This is not a theoretical construct. The US Treasury has published its own advisory on sanctions risks for ransomware payments and puts ransomware actors on its sanctions list, for example a leader of LockBit in May 2024. This becomes relevant faster than you think: with a US parent company, with payments in US dollars, with a service provider or an insurer that has US ties. At Ruag, the legality review ran through US law for exactly this reason.
In practice this means: before any payment, you check against the sanctions lists. The State Secretariat for Economic Affairs maintains the Swiss sanctions measures and, with SESAM, a searchable database of sanctioned persons and organisations. Your bank and your insurer will ask this question anyway. Better to have the answer ready.
What the BACS recommends, and what you actually have to report
The Federal Office for Cyber Security is clear in its ransomware guidance: "The BACS advises against paying a ransom. There is no guarantee that the criminals will not publish the data after the ransom has been paid or profit from it in some other way." Two further points matter more in the process than the stance: do not make contact with the perpetrators, and anyone who still considers a payment should discuss those steps with the cantonal police. Filing a criminal complaint belongs in the same sequence.
The distinction that tends to blur in meetings matters here. The payment is not reportable. The attack may well be: to the Federal Data Protection Commissioner under the data protection act, to the financial market authority for supervised institutions, and since 1 April 2025 under the Information Security Act for operators of critical infrastructure. There a deadline of 24 hours from discovery applies, and an attack connected with extortion, threats or coercion is among the reportable cases. Who has to report what and when, we have taken apart in the reporting duty for cyberattacks.
And what if you pay so that stolen data is not published?
The Federal Council report knows this variant as "double extortion". The data is not only encrypted, it has also been exfiltrated, and the demand is "silence for money" instead of "key for money". Legally the same applies as above, with one extra catch: you are not buying a service, you are buying a promise. The BACS puts it as the missing guarantee that the data will not be published after payment anyway, or monetised in some other way.
A payment changes nothing about your obligations. The data security breach happened when the data left, not only when it appears online. The report to the Federal Data Protection Commissioner under Art. 24 of the data protection act depends on the risk to the people affected, not on publication. Whoever pays and therefore does not report has both: the payment and the open obligation. In our experience that is the most expensive version of this decision.
What has to be decided before the incident
This is the part that takes work, and the only one that helps in a real incident. It fits on half a page, written in calm conditions, approved by the executive team:
- Who may decide. A person named by name, a deputy, an upper limit, and the point at which the board of directors is involved. Without names it stays a hope. What decision paths under time pressure look like, we described in crisis decisions.
- Who checks the sanctions lists, with which source, before which step. That check comes before the release, not after it, and its result is recorded.
- Who talks to whom. The default is: nobody from the company makes contact with the attackers. Who calls the cantonal police, who informs the insurer, who runs a negotiation, if one is run at all, is fixed beforehand.
- Where it is recorded. Decision, reasoning, alternatives examined, timestamp, and also the non-legal consequences you weighed. That is the answer to the question about organisational measures, and it is the same mechanism as with board liability: what is not documented did not happen, in hindsight.
On top of that, a fifth, unglamorous question that is almost never answered: through which channel would a payment technically run? Who has ever paid with a cryptocurrency, which provider does that, what does the cyber insurance cover and what does it not. If you could not execute a payment at all, the discussion about whether it is allowed stays theoretical. Anyone who wants to create this clarity and keep it will find it in our security management and operations; in a CISO mandate it is standard.
Four points and one open question. That can be settled in a morning. If you want to hold the result against an outside view, bring it to the free first conversation.
The decision belongs before the incident
The legal situation in Switzerland is unspectacular. Paying is permitted, the payment itself does not have to be reported, and there is no state help with negotiations. Behind that sit three criminal provisions and a sanctions check that nobody should improvise. This freedom does not take the decision off your hands, it hands it to you, and you make it badly at three in the morning with encrypted servers and a countdown in the browser. Take the half page into the next executive meeting, have it approved, and put it where somebody will look during an incident. After that, "are we allowed to pay?" is a page that somebody opens.
Frequently asked questions
Is paying a ransom a criminal offence in Switzerland?
No, there is no general prohibition. In its 2024 report the Federal Council states that ransom payments are in principle not punishable. In an individual case, money laundering (Art. 305bis SCC), support of a criminal organisation (Art. 260ter SCC) and a sanctions breach remain possible. The Federal Supreme Court has not clarified this so far.
Do you have to report a ransom payment in Switzerland?
The payment itself is not reportable, and there is no duty to involve the authorities in negotiations. The attack, however, may be reportable: to the data protection commissioner under the data protection act, to FINMA for supervised institutions, and since 1 April 2025 to the BACS if you operate critical infrastructure.
What has to be decided before a ransomware incident?
Four points, written down and approved by the executive team: who may release a payment and up to which limit; who checks the sanctions lists beforehand; who speaks with the police, the insurer and the attackers; and where the decision and its reasoning are recorded. Plus how a payment would technically run at all.
