National Crime Agency
UK's lead agency for serious and organised crime; arrested a man after the Royal Marines' Smyrtos boarding.
On 20 October, the National Crime Agency joined five US, German and UK bodies in attributing at least 600 victims to SafePay ransomware and naming five long-known entry flaws.
Last refreshed: 22 October 2026 · Appears in 3 active topics
Can the NCA successfully prosecute a foreign national found on a shadow-fleet tanker in international waters?
Timeline for National Crime Agency
Six agencies tie SafePay to old flaws
Cybersecurity: Threats and DefencesMentioned in: Police seize KillSec ransomware leak site
Cybersecurity: Threats and DefencesReferred itself to the IOPC and is examined by its own Professional Standards Unit
UK Local Elections 2026: Crime agency to investigate its own data leakCalled the case Britain's largest-ever cybercrime prosecution
Cybersecurity: Threats and Defences: TfL hackers jailed five and a half yearsReceived a bank referral over anti-money-laundering concerns
UK Local Elections 2026: Banks flag £1m Cottrell payment to NCABackground
The National Crime Agency is the United Kingdom's lead agency for serious and organised crime. It handles intelligence that crosses police-force and national borders, including financial reports from regulated businesses and evidence about organised cybercrime.
Banks and other regulated firms can send suspicious-activity reports to the agency when transactions meet internal compliance thresholds. The NCA assesses that intelligence; a referral starts scrutiny rather than proving wrongdoing. For cybercrime, it works with British and overseas bodies to attribute criminal activity and publish defensive guidance. These roles place financial intelligence, international coordination and operational crime work inside the same national agency, while specialist Conduct questions can be examined through its Professional Standards Unit.
The agency tracks ransomware infrastructure
On 20 October, the National Crime Agency joined five partner bodies in a joint advisory attributing at least 600 victims to the SafePay ransomware group. The advisory named five entry flaws disclosed between 2020 and 2024, all long present on CISA's exploited-flaw list.
The case fits the agency's role in pursuing organised cybercrime across borders. Two listed weaknesses affected Veeam backup servers, which victims may need for recovery. For the NCA, the finding links criminal attribution to a practical warning: attackers are entering through old weaknesses in systems meant to restore operations.
The agency investigates its data leak
Banks sent the National Crime Agency a routine suspicious-activity report on 10 July after a payment linked to Reform donor Fiona Cottrell crossed internal compliance thresholds. The NCA opened an assessment; the referral did not establish wrongdoing.
After related banking data leaked, the agency referred itself to the police watchdog on 24 July. The watchdog returned the complaints for investigation by the NCA's own Professional Standards Unit rather than opening an external inquiry. The episode puts the agency's handling of sensitive financial intelligence under its own Conduct process.
What did the National Crime Agency do after the Smyrtos tanker was boarded?
What is the National Crime Agency responsible for in the UK?
How does the NCA enforce Russian sanctions?
Did the National Crime Agency find wrongdoing in the Cottrell-Tice transaction?
What did the NCA say about the Transport for London hacking prosecution?
What did the National Crime Agency's SafePay advisory say?
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.