Office of the Registrar of Companies fined GH¢240k for engaging unlicensed cybersecurity provider

The Cyber Security Authority (CSA) has imposed a fine of GH¢240,000 on the Office of the Registrar of Companies (ORC) for engaging an unlicensed cybersecurity provider, Purpleline Solutions Limited. The ORC, a designated Critical Information Infrastructure (CII) institution, was directed to only work with appropriately licensed Cybersecurity Service Providers (CSPs) by the CSA.

Despite this directive issued on June 15, 2026, the ORC proceeded to engage Purpleline Solutions Limited, a company that was not licensed by the Authority to provide cybersecurity services. The CSA fined the ORC GH¢240,000, with a penalty of GH¢10,000 for each of the two instances of non-compliance. Purpleline Solutions Limited was also fined GH¢120,000 for providing cybersecurity services without the required license.

The Authority emphasized that companies cannot expect an unlicensed provider to regularize its status after being engaged. They must obtain the necessary license before providing cybersecurity services. The CSA warned institutions against engaging unlicensed providers and companies against providing regulated cybersecurity services without the appropriate license.

Compliance with cybersecurity licensing is mandatory and not an administrative formality, according to the Authority.