{
  "id": 1739997,
  "title": "CSA fines EY Ghana GH₵360,000 over unlicensed cybersecurity services",
  "url": "https://urgent.news/2026/08/18/csa-fines-ey-ghana-gh-360-000-over-unlicensed-cybersecurity-services",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-18T15:08:23.000Z",
  "source": {
    "name": "Adom Online",
    "slug": "adom-online",
    "url": "https://www.adomonline.com/csa-fines-ey-ghana-gh%e2%82%b5360000-over-unlicensed-cybersecurity-services/"
  },
  "original_language": "en",
  "account": "The Cyber Security Authority (CSA) has imposed a fine of GH₵360,000 on Ernst & Young (EY) Ghana for providing unlicensed cybersecurity services. This penalty stems from EY Ghana's continued provision of services, including to Critical Information Infrastructure (CII) owners, despite CSA directives to comply with licensing requirements under the Cybersecurity Act, 2020 (Act 1038). The Authority had previously directed EY Ghana to apply for a Cybersecurity Service Provider (CSP) licence within 15 days, but the company failed to meet this deadline. The CSA imposed penalties for each of three instances of non-compliance under Sections 49, 92, and 93 of the Act, totaling 10,000 penalty units per instance. EY Ghana now has 14 days to pay the GH₵360,000 administrative fine. The CSA has issued a cease-and-desist order, prohibiting EY Ghana from providing regulated cybersecurity services without a valid licence, including Governance, Risk, and Compliance (GRC) services. The Authority warns that mere application for a licence does not permit operation as a licensed provider. The CSA emphasizes that compliance is crucial, especially for services provided to CII owners, whose security and resilience are vital to Ghana's national security, economy, and essential services. The Authority has directed all unlicensed cybersecurity providers to cease activities immediately and regularise their operations, threatening further enforcement actions, including sanctions, court proceedings, and public disclosure of unlicensed providers' names. Organizations are urged to obtain cybersecurity services only from licensed providers, as licensing is a legal requirement, not an administrative formality.",
  "summary": "The Cyber Security Authority (CSA) has imposed an administrative penalty of GH¢360,000 on Ernst & Young (EY) Ghana for providing regulated cybersecurity services without a valid Cybersecurity Service Provider (CSP) licence. The sanction follows the company’s continued provision of cybersecurity services, including services to owners of Critical Information Infrastructure (CII), despite directives…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}