CSA fines EY Ghana GH¢360,000 for providing cybersecurity services without licence

Josephine Amuzu 14:06 - 18 August 2026

Add Pulse as a preferred source on Google

Here's why Ghana's Cyber Security Authority fines EY Ghana GH¢360,000 for offering unlicensed cybersecurity services.

The Cyber Security Authority fined EY Ghana after finding that it provided regulated cybersecurity services without a valid licence.
EY Ghana has been ordered to cease unlicensed cybersecurity services, confirm the stoppage and complete its licence application.
The CSA says all cybersecurity service providers, regardless of size or reputation, must obtain the required licence before operating in Ghana.

The Cyber Security Authority (CSA) has fined Ernst & Young (EY) Ghana GH¢360,000 for providing regulated cybersecurity services without a valid licence.

The administrative penalty follows what the CSA described as EY Ghana's failure to comply with three separate regulatory directives requiring the company to regularise its operations under Ghana's cybersecurity licensing regime.

According to the CSA, EY Ghana continued providing cybersecurity services, including services to owners of Critical Information Infrastructure (CII), despite being directed to apply for a Cybersecurity Service Provider (CSP) licence.

The Authority said it wrote to EY Ghana on March 20, 2026, directing the company to submit an application for a CSP licence within 15 days.

The CSA subsequently determined that the company had failed to comply with three regulatory directives.

Under the Cybersecurity Act, 2020 (Act 1038), a person or entity cannot provide a cybersecurity service without a licence issued by the Authority. Section 49 specifically establishes the licensing requirement for cybersecurity service providers.

The CSA has therefore imposed 10,000 penalty units for each of the three instances of non-compliance, amounting to a total of GH¢360,000.

EY Ghana has been given 14 calendar days from the date of the final enforcement directive to pay the penalty.

In addition to the financial penalty, the CSA has directed EY Ghana to immediately stop providing regulated cybersecurity services without the required licence.

This includes Governance, Risk and Compliance (GRC) services. The company has also been ordered to:

Confirm in writing to the CSA that the affected services have stopped.
Complete the application process for a Cybersecurity Service Provider licence.
Pay the GH¢360,000 administrative penalty within the stipulated period.

The CSA stressed that simply applying for a licence does not mean an organisation is licensed.

Why is the CSA taking this action?

The Cybersecurity Act, 2020 (Act 1038), gives the CSA responsibility for regulating cybersecurity activities in the country. The Authority's licensing system covers cybersecurity service providers, while cybersecurity establishments and professionals are also subject to accreditation requirements.

The law is designed to ensure that companies providing sensitive cybersecurity services meet required standards and that organisations hiring them have greater assurance about the people handling their systems, networks and sensitive information.

The CSA says licensing is also intended to ensure that cybersecurity providers operate according to approved standards, procedures and industry best practices.

This becomes even more important when the services involve Critical Information Infrastructure.

What is Critical Information Infrastructure?

Critical Information Infrastructure, or CII, refers broadly to computer systems and information infrastructure that are important to the functioning of essential sectors and services.

A serious cyberattack on such systems could have consequences beyond one company. It could affect essential services, businesses, government operations, the economy and national security.

That is why the CSA is particularly concerned about organisations providing cybersecurity services to CII owners.The Authority's position is that companies entrusted with protecting these systems must themselves meet Ghana's regulatory requirements.

The CSA's warning is particularly significant for large and well-known firms.

The Authority says the size, reputation, expertise or clientele of a service provider does not exempt it from Ghana's cybersecurity laws.

In simple terms, being a major international company does not automatically mean a company is authorised to provide regulated cybersecurity services in Ghana.

The same licensing requirements apply to providers operating in the sector.

The EY Ghana case is also a warning to other companies operating in Ghana's cybersecurity space.

The CSA has said it will continue monitoring compliance and take action against organisations and professionals providing regulated cybersecurity services without the required licence.

Possible enforcement measures include administrative penalties, court proceedings and, where permitted by law, publication of the names of unlicensed service providers.

Companies, particularly owners of Critical Information Infrastructure, are expected to ensure that the cybersecurity services they procure come from appropriately licensed providers.

Why is licensing important?

Cybersecurity companies often have access to some of the most sensitive information within an organisation.

Depending on the service, a provider could be involved in assessing weaknesses in a company's systems, monitoring threats, investigating cyber incidents or advising management on how to protect critical information.

If the provider itself does not meet the required regulatory standards, it could create additional risks for the organisation it has been hired to protect.

That is the reason the CSA says cybersecurity licensing should not be treated as a mere administrative requirement.

Ghana introduced the licensing and accreditation regime as part of efforts to strengthen cybersecurity regulation and ensure that service providers operate according to approved standards and procedures. The licensing regime for CSPs commenced in 2023.

What should organisations do?

For businesses that use cybersecurity consultants or service providers, the message from the CSA is straightforward: check whether the provider is properly licensed before engaging its services.

For cybersecurity companies, the requirement is equally clear: if the service being offered falls within the regulated categories, the necessary licence must be obtained before providing that service.

The Authority intends to enforce Ghana's cybersecurity licensing rules regardless of the size or reputation of the organisation involved.

For businesses handling sensitive information and systems, cybersecurity compliance is now part of doing business in Ghana, not something to address after a cyberattack occurs.