The Cyber Security Authority (CSA) has imposed an administrative penalty of GH¢360,000 on Ernst & Young (EY) Ghana for providing regulated cybersecurity services without the required licence.
According to the Authority, EY Ghana continued to provide regulated cybersecurity services, including services to owners of Critical Information Infrastructure (CII), despite directives to regularise its operations.
In a statement dated August 18, 2026, the CSA said it directed EY Ghana on March 20, 2026, to submit an application for a Cybersecurity Service Provider (CSP) licence within 15 days.
The Authority subsequently determined that the firm had failed to comply with three separate regulatory directives.
Three breaches attract GH¢360,000 penalty
The CSA said EY Ghana’s conduct constitutes breaches of Sections 49 and 92 of the Cybersecurity Act, 2020 (Act 1038), which regulate the provision of cybersecurity services and establish sanctions for non-compliance.
Under Sections 49(2), 92(2) and 93 of Act 1038, the Authority imposed a penalty of 10,000 penalty units, equivalent to GH¢120,000, for each of the three instances of non-compliance.
The total administrative penalty therefore amounts to GH¢360,000.
EY Ghana has been directed to pay the penalty within 14 calendar days from the date of the final enforcement directive.
EY Ghana ordered to cease unlicensed services
The CSA has also ordered EY Ghana to immediately stop providing all regulated cybersecurity services without the requisite licence.
The directive specifically covers Governance, Risk and Compliance (GRC) services.
The firm has further been instructed to provide written confirmation to the Authority that the affected services have ceased and to complete the application process for a CSP licence.
The CSA stressed that submitting an application does not grant a provider permission to operate.
“An application for a licence does not confer a licence to operate,” the Authority said.
It emphasised that providers must obtain the required licence before offering regulated cybersecurity services.
CSA warns other unlicensed providers
The enforcement action comes with a broader warning to cybersecurity service providers operating in Ghana without the required licence.
The CSA said compliance is particularly important where cybersecurity services are provided to owners of Critical Information Infrastructure, whose systems are essential to national security, the economy and the delivery of critical services.
“The Authority therefore makes clear that the size, reputation, expertise or clientele of a service provider does not exempt it from Ghana’s cybersecurity laws,” the statement said.
The Authority maintained that all cybersecurity service providers are subject to the same regulatory requirements under Act 1038 and its directives.
It has consequently directed unlicensed operators to cease providing regulated services and take steps to regularise their operations.
Further enforcement action possible
The CSA said it would continue monitoring compliance and take enforcement action against both unlicensed service providers and institutions that engage them.
Possible measures include administrative sanctions, court proceedings and, where permitted by law, publication of the names of unlicensed service providers.
The Authority has also urged organisations, particularly owners of Critical Information Infrastructure, to procure cybersecurity services only from appropriately licensed providers.
“The message is clear: cybersecurity licensing is a legal requirement, not an administrative formality. Institutions must comply, and service providers must be licensed before they operate,” the CSA said.
The latest action forms part of the Authority’s broader regulatory efforts to strengthen cybersecurity compliance and protect Ghana’s digital infrastructure and sensitive information.
