What's the punishment for paying? A fine? Then you might as well add that to the ransom and pay...

Snark aside, there's just no simple, hand-waving solution to this. Even if you held the company owners criminally liable for paying a ransom, pretty much any small company will shut down for not being able to afford top-notch security.

It also opens the door to blackmail:

> We've encrypted your files. Pay us $AMOUNT BTC by tomorrow, or your files are gone. And with a recurring payment of $AMOUNT BTC per month, I promise not to report you to the FBI for paying!