Ghana’s Cyber Security Authority (CSA) has fined EY Ghana GH¢360,000 for providing regulated cybersecurity services without the required licence, in a move that underscores the regulator’s tougher stance on compliance within the country’s cybersecurity sector.
The penalty followed three separate instances of non-compliance by EY Ghana. According to the CSA, the company was directed on March 20, 2026, to apply for a Cybersecurity Service Provider (CSP) licence within 15 days, but continued providing regulated cybersecurity services, including services to owners of Critical Information Infrastructure (CII), without securing the necessary approval.
Under the enforcement action, the CSA imposed 10,000 penalty units, equivalent to GH¢120,000, for each of the three breaches. The combined penalty therefore came to GH¢360,000, with EY Ghana given 14 calendar days from the date of the final enforcement directive to pay the fine.
The Authority has also ordered EY Ghana to immediately stop providing regulated cybersecurity services without a licence, including Governance, Risk and Compliance (GRC) services. The company must confirm in writing that the affected services have stopped and complete the application process for a CSP licence. The CSA stressed that simply submitting a licence application does not give a company permission to operate as a cybersecurity service provider.
The enforcement sends a strong message to businesses operating in Ghana’s cybersecurity space that reputation, expertise or a large client base does not place any organisation above the law. The CSA said providers serving Critical Information Infrastructure must be properly licensed because such systems are vital to national security, the economy and essential services. It added that it would continue monitoring compliance and take action against both unlicensed cybersecurity providers and organisations that engage them.
source: ghanabusiness
