By Seli Baisie
The Cyber Security Authority (CSA) has fined Ernst & Young (EY) Ghana GH¢360,000 for providing regulated cybersecurity services without a valid licence.
The Authority said EY Ghana continued to provide cybersecurity services, including services to owners of Critical Information Infrastructure (CII), despite repeated directives to comply with Ghana’s cybersecurity licensing requirements.
The penalty was announced in a statement issued by the CSA on Tuesday, August 18, 2026.
According to the Authority, it directed EY Ghana in a letter dated March 20, 2026, to apply for a Cybersecurity Service Provider (CSP) licence within 15 days.
The CSA said EY Ghana failed to comply with three separate regulatory directives issued to the company.
It said the conduct amounted to breaches of Sections 49 and 92 of the Cybersecurity Act, 2020 (Act 1038), which prohibit the provision of regulated cybersecurity services without the required licence and provide sanctions for non-compliance with directives from the Authority.
GH¢360,000 penalty
The CSA said it imposed a penalty of 10,000 penalty units, equivalent to GH¢120,000, for each of the three instances of non-compliance.
This brings the total administrative penalty to GH¢360,000.
EY Ghana has been given 14 calendar days from the date of the final enforcement directive to pay the penalty.
EY Ghana ordered to stop unlicensed services
In addition to the financial penalty, the CSA has ordered EY Ghana to immediately stop providing regulated cybersecurity services without a licence.
The directive includes Governance, Risk and Compliance (GRC) services.
EY Ghana has also been directed to provide written confirmation to the CSA that the affected services have been discontinued and to complete the application process for a CSP licence.
The Authority stressed that applying for a licence does not give an organisation permission to operate as a cybersecurity service provider.
“Entities are required to obtain the requisite licence from the CSA before commencing the provision of regulated cybersecurity services,” it said.
CSA warns other cybersecurity providers
The CSA said the enforcement action should serve as a warning to organisations and professionals providing regulated cybersecurity services without the required licence.
It said compliance was particularly important where cybersecurity services were being provided to owners of Critical Information Infrastructure because such systems are essential to Ghana’s national security, economy and delivery of critical services.
“The size, reputation, expertise or clientele of a service provider does not exempt it from Ghana’s cybersecurity laws,” the Authority said.
“All Cybersecurity Service Providers operating in Ghana are subject to the same regulatory requirements under Act 1038 and directives issued by the CSA.”
The Authority urged all unlicensed cybersecurity service providers to stop providing regulated services and regularise their operations.
It also warned that it would continue to monitor compliance and take enforcement action against both unlicensed service providers and organisations that engage them.
Such action, the CSA said, could include administrative sanctions, court proceedings and the publication of the names of unlicensed service providers where permitted by law.
The Authority also urged organisations, particularly owners of Critical Information Infrastructure, to ensure that cybersecurity services are obtained only from appropriately licensed providers.
“Cybersecurity licensing is a legal requirement, not an administrative formality,” the CSA said.
The Authority said it remained committed to protecting Ghana’s digital ecosystem and would continue to use its regulatory powers to ensure that organisations responsible for critical systems and sensitive information comply with cybersecurity requirements.
Below is the statement;
