The Cyber Security Authority (CSA) has imposed an administrative penalty of GH¢360,000 on Ernst & Young (EY) Ghana for providing regulated cybersecurity services without a valid Cybersecurity Service Provider (CSP) license.

According to a CSA statement dated August 18, 2026, EY Ghana continued to provide cybersecurity services, including services to owners of Critical Information Infrastructure (CII), despite directives from the Authority to comply with Ghana’s cybersecurity licensing requirements.

The CSA said it directed EY Ghana on March 20, 2026, to apply for a CSP licence within 15 days. However, the Authority determined that the company failed to comply with three separate regulatory directives.

The breaches were deemed violations of Sections 49 and 92 of the Cybersecurity Act, 2020 (Act 1038). The CSA subsequently imposed 10,000 penalty units, equivalent to GH¢120,000, for each of the three instances of non-compliance, bringing the total penalty to GH¢360,000.

EY Ghana has been ordered to pay the penalty within 14 calendar days of the final enforcement directive. The CSA has also issued an immediate cease-and-desist order, requiring the company to stop providing regulated cybersecurity services, including Governance, Risk and Compliance (GRC) services, until it obtains the required licence.

The Authority further clarified that merely submitting a licence application does not permit an organisation to operate as a CSP. Providers must obtain the licence before offering regulated cybersecurity services.

CSA issues warning

The CSA used the enforcement action to warn organisations and professionals providing cybersecurity services without the required licence.

It stressed that no organisation is exempt from Ghana’s cybersecurity laws because of its size, reputation, expertise or clientele. This is particularly important for service providers working with Critical Information Infrastructure, whose protection is considered essential to Ghana’s national security, economy and delivery of vital services.

The Authority has directed all unlicensed cybersecurity service providers to immediately cease regulated activities and regularise their operations. It also warned that further violations could attract administrative sanctions, court proceedings and, where legally permitted, publication of the names of unlicensed providers.

The CSA has urged organisations, particularly owners of Critical Information Infrastructure, to engage only licensed cybersecurity service providers.

The enforcement action reinforces the CSA’s position that cybersecurity licensing is a legal requirement, rather than merely an administrative formality.

Source: Sintim Media | CSA