Banning ransomware payments is an incredibly attractive idea.
Proponents need to explain why it’s going to work any better than bans on buying drugs. Why will two “willing” participants not going to find a way? What do we gain by adding criminal penalties to victims trying to recover their businesses?
My off-the-top answer to your first question is that for victims who are routinely audited (public companies and municipalities, say) it will be difficult to bury the payments. I have no opinion on whether this ban on ransom payments will actually reduce harm over time - that's a very different matter.
Adam Shostack 
🐀 ␆