CSA Fines EY Ghana GH¢360,000 Over Cybersecurity Licensing Breaches
The Cyber Security Authority (CSA) has imposed a GH¢360,000 administrative penalty on EY Ghana after the company was found to have provided regulated cybersecurity services without the required licence.
The sanction follows several directives issued by the Authority requiring the company to regularise its operations under Ghana’s cybersecurity regulatory framework. According to the CSA, EY Ghana was first directed in March 2026 to apply for a Cybersecurity Service Provider licence but failed to comply with the instructions within the stipulated period.
The Authority said the company subsequently breached three separate directives. Each violation attracted a penalty of GH¢120,000, resulting in a total administrative fine of GH¢360,000 under provisions of the Cybersecurity Act, 2020 (Act 1038).
Beyond the financial penalty, EY Ghana has been ordered to stop offering regulated cybersecurity services until it obtains the appropriate licence. The company is also required to formally confirm that the affected services have been suspended and complete the licensing process before resuming such activities.
The CSA has stressed that cybersecurity providers, regardless of their size, reputation or clientele, are required to comply with the same legal requirements. The Authority has also urged organisations, particularly those responsible for critical information infrastructure, to engage only properly licensed cybersecurity service providers as it steps up enforcement of the country’s cybersecurity laws.
