CSA fines EY Ghana GH¢360,000 for operating without cybersecurity licence

Story by: Isabella Kabukuor Atrikpe

The Cyber Security Authority (CSA) has fined Ernst & Young (EY) Ghana GH¢360,000 for providing regulated cybersecurity services without a valid Cybersecurity Service Provider (CSP) licence.

The administrative penalty follows EY Ghana’s continued provision of cybersecurity services, including services to owners of Critical Information Infrastructure (CII), despite repeated directives from the CSA to comply with the licensing requirements under the Cybersecurity Act, 2020 (Act 1038).

According to the CSA, it directed EY Ghana in correspondence dated March 20, 2026, to submit an application for a CSP licence within 15 days. However, the Authority subsequently determined that the company had failed to comply with three separate regulatory directives.

The CSA said the conduct constituted a breach of Sections 49 and 92 of Act 1038, which prohibit the provision of regulated cybersecurity services without the required licence and provide sanctions for failure to comply with directives issued by the Authority.

Under the enforcement action, the CSA imposed 10,000 penalty units, equivalent to GH¢120,000, for each of the three instances of non-compliance, bringing the total penalty to GH¢360,000.

EY Ghana has been directed to pay the penalty within 14 calendar days from the date of the final enforcement directive.

The Authority has also issued an immediate cease-and-desist directive to EY Ghana, ordering the company to stop providing all regulated cybersecurity services without the required licence, including Governance, Risk and Compliance (GRC) services.

The CSA further directed EY Ghana to provide written confirmation that the affected services had ceased and to complete the application process for a Cybersecurity Service Provider licence.

The Authority stressed that simply applying for a licence does not give an entity the right to operate as a Cybersecurity Service Provider.

“Entities are required to obtain the requisite licence from the CSA before commencing the provision of regulated cybersecurity services,” the Authority said.

The CSA warned that compliance was particularly important where cybersecurity services were being provided to owners of Critical Information Infrastructure because the security and resilience of such systems were essential to Ghana’s national security, economy and the delivery of essential services.

It also made clear that the size, reputation, expertise or clientele of a service provider would not exempt it from Ghana’s cybersecurity laws.

“The message is clear: cybersecurity licensing is a legal requirement, not an administrative formality,” the CSA stated.

The Authority has therefore urged all organisations and professionals providing regulated cybersecurity services without the requisite licence to cease such services and regularise their operations immediately.

It warned that it would continue to monitor compliance and take enforcement action against both institutions that engage unlicensed providers and entities that provide cybersecurity services without the required licence.

Such action, the CSA said, could include administrative sanctions, court proceedings and, where necessary, publication of the names of unlicensed service providers as permitted by law.

The Authority has further urged organisations, particularly owners of Critical Information Infrastructure, to procure cybersecurity services only from appropriately licensed service providers.

The CSA said it remained committed to protecting Ghana’s digital ecosystem and would use its regulatory powers to ensure that organisations entrusted with critical systems and sensitive information met their cybersecurity obligations.