You're not going to be penalized.
It's more likely that Google would simply ignore you.
Even more accurately, they might ignore/devalue the site you're paying to give you links, so your money goes down the toilet and -picture this hypothetical scenario- unable to determine whether your paid links are helping or not, you'll have no idea whether to pull the plug on all their monthly maintenance fees, held hostage and scared your site might drop like a stone if you do..
One exception could be your participation in a link farm. Consensus is, you could get penalized for that. As for what exactly defines & distinguishes a link farm as opposed to a directory, you're on your own. It's a vague distinction subject to much interpretation.
Apparently G is getting better at determining ROS (run of site) backlinks from 1000's of pages all on the same site, and then paying them no mind. And relevancy is very important. Don't advertise automobiles on a children's candy site.
That's just my $0.02. Personally, I'll pay reasonable one-time fees for listings in directories, a bit of advertising too, but I don't pay recurring fees for links designed solely to increase my PR. I guess my excellent rankings across all my trade's terms (1-3 for circa 50 keywords) is the proof in the pudding for me. I did it by long nights of tedious, obsessive labor in front of my monitor, carefully researching relevant links, and personally eMailing webmasters. I was the live human being on the other end of the line.
Lots of old-timers here advise SEO link-buying as sheer orthodoxy, but I strongly believe G is smarter than that (or will be soon)--it's debatable whether with enough money you can just buy your SERPS. Even if you can do it now, in the long term I believe it will be ineffective. Call me a freak, but sometimes it's nice to look over Brett Tabke's ranking primer to get back to basics. It makes sense to me.