CSA fines Ernst & Young Ghana GH¢360,000 over unlicensed cybersecurity services

The Cyber Security Authority (CSA) has fined Ernst & Young (EY) Ghana GH¢360,000 for providing regulated cybersecurity services without a valid Cybersecurity Service Provider (CSP) licence.

The penalty follows the company’s continued provision of cybersecurity services, including services to owners of Critical Information Infrastructure (CII), despite directives from the CSA to comply with Ghana’s cybersecurity licensing requirements.

In a statement dated August 18, 2026, the CSA said it directed EY Ghana in a letter dated March 20, 2026, to submit an application for a CSP licence within 15 days.

However, the Authority said EY Ghana subsequently failed to comply with three separate regulatory directives.

According to the CSA, the breaches contravened Sections 49 and 92 of the Cybersecurity Act, 2020 (Act 1038), which regulate the provision of cybersecurity services and provide sanctions for non-compliance with directives issued by the Authority.

GH¢360,000 penalty
The CSA said it imposed 10,000 penalty units, equivalent to GH¢120,000, for each of the three instances of non-compliance under Sections 49(2), 92(2) and 93 of Act 1038.

The three sanctions amount to a total administrative penalty of GH¢360,000.

EY Ghana has been directed to settle the penalty within 14 calendar days from the date of the final enforcement directive.

In addition to the financial penalty, the CSA has issued an immediate cease-and-desist order against the company.

The directive requires EY Ghana to stop providing regulated cybersecurity services without the appropriate licence, including Governance, Risk and Compliance (GRC) services.

The company has also been instructed to formally confirm to the CSA that the affected services have been discontinued and to complete the process of obtaining a CSP licence.

The Authority stressed that merely submitting an application does not authorise an organisation to operate as a licensed Cybersecurity Service Provider.

It said entities must first obtain the required licence before offering regulated cybersecurity services in Ghana.

CSA issues warning
The enforcement action has prompted the CSA to issue a broader warning to organisations and professionals providing regulated cybersecurity services without the necessary licence.

The Authority said compliance was particularly critical where such services involve owners of Critical Information Infrastructure, given the importance of those systems to national security, the economy and the delivery of essential services.

It stressed that the size, reputation, expertise or clientele of a service provider does not exempt it from Ghana’s cybersecurity laws.

The CSA said all cybersecurity service providers operating in the country are subject to the same regulatory requirements under Act 1038 and directives issued by the Authority.

It has consequently directed all unlicensed organisations and professionals providing regulated cybersecurity services to stop such activities and regularise their operations immediately.

The Authority warned that it would continue monitoring compliance and take enforcement action against both unlicensed service providers and organisations that engage them.

Such measures, it said, could include administrative sanctions, court proceedings and, where permitted by law, publication of the names of unlicensed service providers.

The CSA further urged organisations, particularly owners of Critical Information Infrastructure, to engage only appropriately licensed cybersecurity service providers.

It emphasised that cybersecurity licensing is a statutory requirement rather than a mere administrative procedure.

The Authority said it would continue to exercise its regulatory powers to protect Ghana’s digital ecosystem and ensure that organisations responsible for critical systems and sensitive information comply fully with their cybersecurity obligations.