As Reuters reports, the U.S. Treasury Department recently issued two advisories driving home that paying hackers or facilitating a ransomware payout could run afoul of federal sanctions if the recipient is located in a sanctioned country. “A person subject to U.S. jurisdiction may be held civilly liable even if it did not know or have reason to know it was engaging in a transaction with a person that is prohibited under sanctions laws and regulations,” one of the advisories reads.

Karen Walsh, principal at cybersecurity marketing firm Allegro Solutions, told FOX News that while financial institutions will already be well aware of the Treasury’s lists regarding “malicious cyber actors,” other organizations may benefit from the reminder.

Fabian Wosar, chief technology officer at computer security firm Emsisoft, told Krebs on Security that Treasury’s advisories mainly serve as a warning to firms that may have been victimized by ransomware attacks and have not yet reached out to law enforcement or third-party security firms.

Charles Carmakal, senior vice president and chief technology officer with cybersecurity firm FireEye Mandiant, told Insurance Journal that while Treasury’s advice was “well-intentioned,” it will ratchet up “pressure and complexity to victim organizations.” He noted that without knowing a cyber extortionist’s true identity, it’s tough to figure out if paying them would accidentally violate U.S. sanctions.

Melody Kaufmann, cybersecurity specialist at IT firm Saviynt, told ThreatPost that penalizing organizations for paying ransoms will have the opposite attack from what the Treasury has intended. Kaufmann said the Treasury’s move “disincentivizes [business from] reporting ransomware attacks,” “fails to provide an effective data recovery alternative” and “favors big corporations while crushing small- to medium-sized businesses beneath its heel.”

Cybersecurity risk assessment firm ACA Aponix, in an alert to clients, recommending studying the advisories closely and implementing the Treasury’s recommended safeguards, among other steps to protect against ransomware.