The Cyber Security Authority (CSA) has sanctioned the Office of the Registrar of Companies (ORC) and Purpleline Solutions Limited Company for breaches of Ghana’s cybersecurity regulations.
The ORC has been fined GH¢240,000 for engaging a cybersecurity service provider that did not hold the required licence from the CSA, while Purpleline Solutions has been fined GH¢120,000 for providing cybersecurity services without the requisite licence.
The sanctions form part of the Authority’s enforcement of the Cybersecurity Act, 2020 (Act 1038) and its directives requiring institutions designated as Critical Information Infrastructure (CII) to engage appropriately licensed Cybersecurity Service Providers (CSPs).
ORC fined GH¢240,000
According to the CSA, the sanction against the ORC followed its determination that the institution engaged Purpleline Solutions, which was not licensed by the Authority to provide cybersecurity services.
The CSA said the ORC had been specifically directed to engage a Tier 1 licensed Cybersecurity Service Provider to strengthen the security and resilience of its Critical Information Infrastructure.
On June 15, 2026, the Authority formally directed the ORC to engage Tier 1 licensed CSPs.
The ORC was subsequently required to provide information on its cybersecurity service providers, its proposed Security Operations Centre (SOC) and relevant Public Procurement Authority (PPA) approvals.
Despite the directives, the CSA said the ORC proceeded to engage Purpleline Solutions.
The Authority considers the failure to comply with its directives a violation of Section 92 of the Cybersecurity Act, 2020 (Act 1038), which provides for sanctions for non-compliance with directives issued by the CSA.
The CSA determined that the ORC failed to comply with two separate directives and imposed a penalty of 10,000 penalty units for each instance of non-compliance, bringing the total fine to GH¢240,000.
The Authority has also directed the ORC to comply with the outstanding directives within one month of receiving the sanction letter.
Purpleline fined GH¢120,000
The CSA also sanctioned Purpleline Solutions Limited for providing cybersecurity services without the required licence.
The Authority said the company applied for a Cybersecurity Service Provider licence on July 15, 2026, after the CSA had determined that it had already been engaged by the ORC to provide cybersecurity services.
The CSA stressed that an application for a licence does not confer the right to operate as a Cybersecurity Service Provider.
Under the Authority’s regulatory requirements, entities must obtain the requisite licence before commencing the provision of regulated cybersecurity services.
Consequently, Purpleline Solutions has been fined 10,000 penalty units, equivalent to GH¢120,000, for providing cybersecurity services without the required licence.
CSA issues warning
The Authority has issued a strong warning to institutions and service providers against engaging in or providing regulated cybersecurity services without the appropriate licence.
It said institutions must not engage unlicensed Cybersecurity Service Providers, while companies must not provide regulated cybersecurity services unless they have first obtained the appropriate licence from the CSA.
The Authority also warned organisations against attempting to circumvent the licensing requirement by engaging a provider first and expecting it to regularise its status afterwards.
It stressed that an application for a licence is not the same as holding a licence and does not authorise an entity to commence regulated cybersecurity operations.
The CSA has therefore urged all designated CII institutions, public-sector organisations and other entities subject to the Cybersecurity Act to verify the licensing status and appropriate licence tier of cybersecurity service providers before awarding contracts or allowing them to commence work.
The Authority said it would continue to monitor compliance and take enforcement action against both institutions that engage unlicensed providers and entities that provide cybersecurity services without the requisite licence.
It reiterated that cybersecurity licensing is a legal requirement and not merely an administrative formality, adding that its enforcement measures are aimed at protecting Ghana’s digital ecosystem and ensuring that organisations entrusted with critical systems and sensitive information meet their cybersecurity obligations.
