Cyber Security Authority Fines EY Ghana GH"360,000 for Unlicensed Service Provision

The Cyber Security Authority (CSA) has imposed a GH"360,000 fine on Ernst & Young (EY) Ghana for operating as a Cybersecurity Service Provider (CSP) without the required regulatory licence. This enforcement action follows persistent non-compliance by the international professional services firm, which allegedly disregarded multiple warnings to formalise its operations. The CSA emphasized that the regulation of such services is essential for the protection of Ghana's digital ecosystem and the integrity of systems integral to national security.

According to the CSA, the penalty is based on three specific instances of non-compliance with regulatory directives. Each instance attracted a fine of GH"120,000, culminating in the total GH"360,000 penalty. Despite receiving three separate directives from the Authority to apply for a valid CSP licence as mandated by the Cybersecurity Act, 2020 (Act 1038), EY Ghana reportedly continued to offer regulated services to clients, prompting the regulatory body to move from warnings to active sanctions.

Beyond the financial penalty, the CSA has issued a stern directive for EY Ghana to immediately cease providing all unlicensed cybersecurity services. The firm is required to confirm this cessation in writing to the Authority and has been given a 14-day window to initiate the formal application process for the appropriate licence. The CSA highlighted that compliance is particularly critical for organisations serving Critical Information Infrastructure (CII), which constitutes the backbone of the nation's essential services and digital economy.

This enforcement action signals a tightening of regulatory oversight in Ghana's technology sector. The CSA has issued a broad warning to all cybersecurity service providers, stressing that it will not tolerate unlicensed operations and urging firms to adhere strictly to the licensing framework. As the administration of President John Mahama continues to prioritise digital resilience, the CSA's actions underscore a commitment to ensuring that only qualified and vetted entities are permitted to manage the country's most sensitive digital assets.