
CSA fines EY Ghana GH垄360,000 for providing cybersecurity services without a license
The Cyber Security Authority CSA has fined Ernst & Young EY Ghana GH垄360,000 for operating without a valid cybersecurity service provider CSP license. The CSA stated that EY Ghana continued to offer regulated cybersecurity services, including to owners of Critical Information Infrastructure CII, despite being directed to comply with licensing requirements. The company failed to adhere to three separate regulatory directives, including a March 20, 2026, instruction to apply for a CSP license within 15 days. This conduct breaches Sections 49 and 92 of the Cybersecurity Act, 2020 Act 1038. The penalty of GH垄360,000 was imposed at GH垄120,000 for each instance of non-compliance. EY Ghana has been ordered to pay the fine within 14 days, immediately cease all unlicensed regulated cybersecurity services, provide written confirmation of cessation, and complete its CSP license application. The CSA emphasized that obtaining a license is a legal requirement for all cybersecurity service providers in Ghana, regardless of their size or reputation, and warned of further enforcement actions for non-compliance.



