CSA fines EY Ghana GH₵360,000 over unlicensed cybersecurity services

The Cyber Security Authority (CSA) has imposed a fine of GH₵360,000 on Ernst & Young (EY) Ghana for providing unlicensed cybersecurity services. This penalty stems from EY Ghana's continued provision of services, including to Critical Information Infrastructure (CII) owners, despite CSA directives to comply with licensing requirements under the Cybersecurity Act, 2020 (Act 1038).

The Authority had previously directed EY Ghana to apply for a Cybersecurity Service Provider (CSP) licence within 15 days, but the company failed to meet this deadline. The CSA imposed penalties for each of three instances of non-compliance under Sections 49, 92, and 93 of the Act, totaling 10,000 penalty units per instance. EY Ghana now has 14 days to pay the GH₵360,000 administrative fine.

The CSA has issued a cease-and-desist order, prohibiting EY Ghana from providing regulated cybersecurity services without a valid licence, including Governance, Risk, and Compliance (GRC) services. The Authority warns that mere application for a licence does not permit operation as a licensed provider. The CSA emphasizes that compliance is crucial, especially for services provided to CII owners, whose security and resilience are vital to Ghana's national security, economy, and essential services.

The Authority has directed all unlicensed cybersecurity providers to cease activities immediately and regularise their operations, threatening further enforcement actions, including sanctions, court proceedings, and public disclosure of unlicensed providers' names. Organizations are urged to obtain cybersecurity services only from licensed providers, as licensing is a legal requirement, not an administrative formality.