My understanding is that companies often pay another company to pay the ransom for them, with it billed as "professional services" or other such. If there were

My understanding is that companies often pay another company to pay the ransom for them, with it billed as "professional services" or other such. If there were laws against paying ransom, they'd need to be quite comprehensive, or loopholes would be found.