Cyber Security Authority fines ORC GH¢240,000 for engaging unlicensed cybersecurity provider 

The Cyber Security Authority (CSA) has fined the Office of the Registrar of Companies (ORC) and Purpleline Solutions Limited Company a combined GH¢360,000 over breaches of Ghana’s cybersecurity regulations.

The ORC was sanctioned for engaging Purpleline Solutions, which was not licensed by the CSA to provide cybersecurity services.

Purpleline Solutions was also fined for providing cybersecurity services without first obtaining the required licence from the Authority.

The CSA said the ORC, which is designated as a Critical Information Infrastructure (CII) institution, had been directed on June 15, 2026, to engage a Tier 1 licensed Cybersecurity Service Provider (CSP).

The ORC was also required to provide information on its cybersecurity service providers, the terms of reference for its proposed Security Operations Centre (SOC) and relevant Public Procurement Authority approvals.

However, the Authority said the ORC proceeded to engage Purpleline Solutions despite the directives.

“The Authority determined that the ORC failed to comply with two separate directives issued by the CSA,” the Authority said in a statement issued on Wednesday, August 12, 2026.

The CSA said the ORC had therefore been fined 10,000 penalty units for each instance of non-compliance under Section 92(2) of the Cybersecurity Act, 2020 (Act 1038).

The two fines amount to GH¢240,000, with the ORC also directed to comply with the outstanding directives within one month of receiving the sanction letter.

For Purpleline Solutions, the CSA said the company had provided cybersecurity services without holding the required licence.

The Authority noted that Purpleline Solutions applied for a cybersecurity service provider licence on July 15, after it had already been engaged by the ORC.

It said the application did not authorise the company to provide regulated cybersecurity services.

An additional fine of 10,000 penalty units, amounting to GH¢120,000, was therefore imposed on Purpleline Solutions.

“Cybersecurity licensing is a legal requirement, not an administrative formality. Institutions must comply and service providers must be licensed before they operate,” the Authority said.