CSA fines EY Ghana GH¢360,000 over cybersecurity licensing breaches

Ghana's Cyber Security Authority (CSA) has imposed a fine of GH¢360,000 on Ernst & Young (EY) Ghana for providing cybersecurity services without a valid license. The penalty, equivalent to 10,000 penalty units under the Cybersecurity Act, 2020, was ordered after EY continued to offer regulated cybersecurity services, including to owners of Critical Information Infrastructure (CII), despite regulatory directives.

The CSA had directed EY to apply for a Cybersecurity Service Provider (CSP) license within 15 days in March 2026, but the company failed to comply with three separate directives. The CSA's administrative penalty consists of GH¢120,000 for each instance of non-compliance, totaling GH¢360,000. EY Ghana must cease providing regulated cybersecurity services immediately and confirm in writing to the CSA that the affected services have ceased.

The company is also required to apply for a CSP license within the stipulated timeframe. The CSA emphasizes that cybersecurity licensing is a legal requirement, and failure to comply can result in enforcement actions, including administrative sanctions, court proceedings, and public naming of unlicensed service providers. The Authority urges organizations, particularly those with CII, to only engage licensed providers to protect critical systems and sensitive information.