1. Short title This Act may be cited as the Ransomware and Financial Stability Act of 2024 . 2. Ransomware attack deterrence (a) In general Section 108 of title I of division Q of the Consolidated Appropriations Act, 2021 ( Public Law 116–260 ; 135 Stat. 2173; 12 U.S.C. 1811 note) is amended— (1) in the subsection heading, by striking report ; (2) by redesignating subsections (d) and (e) as subsections (e) and (f), respectively; (3) by inserting the following after subsection (c): (d) Ransomware attack deterrence (1) Requirements (A) In general A covered U.S. financial institution subject to a ransomware attack may not make a ransomware payment in response to such ransomware attack— (i) before submitting the notification described in paragraph (2); and (ii) in an amount greater than $100,000, unless the payment is subject to a ransomware payment authorization. (B) Rule of construction Nothing in this subsection shall be construed to permit a ransomware payment that is otherwise prohibited by law. (2) Notification described (A) In general The notification described in this paragraph shall be submitted by a covered U.S. financial institution to the Director of the Financial Crimes Enforcement Network and shall include— (i) a determination by such institution that such institution is subject to a ransomware attack; and (ii) a description of the ransomware attack and any associated ransomware payment demanded. (B) Contents To ensure efficient notification and resolution of a ransomware attack, the Secretary of the Treasury— (i) shall, in consultation with interested persons, issue guidance specifying information required to be included in the notification described in this paragraph