Ghana Fines EY $32,600 Over Unlicensed Cybersecurity Services

Ghana’s Cyber Security Authority has fined Ernst & Young Ghana about US$32,600 and ordered the firm to immediately stop providing regulated cybersecurity services without a valid licence.

The authority announced the penalty on Tuesday, August 18, saying EY Ghana had continued providing cybersecurity services despite repeated directives to comply with Ghana’s licensing requirements.

The services included work for owners of Critical Information Infrastructure (CII), whose systems are considered essential to Ghana’s national security, economy and delivery of key services.

According to the Cyber Security Authority (CSA), EY Ghana was specifically instructed in a letter dated March 20, 2026, to submit an application for a Cybersecurity Service Provider (CSP) licence within 15 days.

The authority said EY Ghana subsequently failed to comply with three separate regulatory directives.

The CSA determined that the conduct breached Sections 49 and 92 of Ghana’s Cybersecurity Act, 2020 (Act 1038), which prohibit the provision of regulated cybersecurity services without the required licence and provide sanctions for failure to comply with directives issued by the authority.

The CSA imposed a penalty of 10,000 penalty units, equivalent to about US$10,900, for each of the three instances of non-compliance.

The three penalties bring the total administrative fine against EY Ghana to approximately US$32,600.

The firm has been given 14 calendar days from the date of the final enforcement directive to pay the penalty.

Beyond the financial sanction, the authority has ordered EY Ghana to immediately cease providing all regulated cybersecurity services without the required licence, including Governance, Risk and Compliance (GRC) services.

EY Ghana has also been directed to provide written confirmation that the affected services have stopped and complete the application process for a Cybersecurity Service Provider licence.

The CSA stressed that submitting a licence application does not give a company permission to operate as a licensed cybersecurity service provider.

Companies are required to obtain the licence from the authority before beginning to provide regulated cybersecurity services.

The action against EY Ghana also comes with a broader warning to other companies operating in Ghana’s cybersecurity sector.

The CSA said compliance is particularly important when cybersecurity services are provided to owners of Critical Information Infrastructure because the security and resilience of such systems are important to Ghana’s national security, economy and delivery of essential services.

The authority said the size, reputation, expertise or clientele of a service provider does not exempt it from Ghana’s cybersecurity laws.

It warned organisations and professionals providing regulated cybersecurity services without the required licence to stop those activities and regularise their operations immediately.

The CSA said it would continue monitoring compliance and taking enforcement action against both organisations that engage unlicensed providers and entities that provide cybersecurity services without the required licence.

Such enforcement, it said, could include administrative penalties, court proceedings and publication of the names of unlicensed service providers where permitted by law.

The authority also urged organisations, particularly owners of Critical Information Infrastructure, to ensure that cybersecurity services are obtained only from appropriately licensed providers.

The enforcement action places renewed focus on Ghana’s efforts to regulate companies providing cybersecurity services as the country seeks to protect critical systems and sensitive information.

The CSA issued the enforcement notice from Accra on August 18, 2026.