Just wrong. It is both a criminal and a civil matter. The party who has been hacked may sue for any loss, e.g. Commercial information.
City did not accept a payment for concealing a crime, but for the tort. Compare theft which is a crime but also the common law tort of trespass to goods and the party who is the victim may issue civil proceedings.
PS EDIT. Not sure where the proposals about NDA's currently stand, but any new regs unlikely to apply here as it was some years ago.
PPS EDIT2. You will note that all those celebs whose phones were hacked, received damages from the papers concerned.