The Cyber Security Authority (CSA) has fined Accounting and business consulting firm Ernst & Young (EY) Ghana GH¢360,000 for providing regulated cybersecurity services without a valid licence.
The penalty follows what the Authority described as EY Ghana’s failure to comply with repeated directives to regularise its operations under the Cybersecurity Act, 2020 (Act 1038).
In a statement issued on Tuesday, August 18, the CSA said EY Ghana continued providing cybersecurity services, including services to owners of Critical Information Infrastructure (CII), despite being directed to obtain the necessary licence.
The Authority said it instructed EY Ghana in a letter dated March 20, 2026, to submit an application for a Cybersecurity Service Provider (CSP) licence within 15 days.
However, the CSA determined that the company failed to comply with three separate regulatory directives.
It said the breaches contravene Sections 49 and 92 of Act 1038, which prohibit the provision of regulated cybersecurity services without the requisite licence and empower the Authority to sanction entities that fail to comply with its directives.
“Pursuant to Sections 49(2), 92(2) and 93 of Act 1038, the CSA imposed a penalty of 10,000 penalty units, equivalent to GHC 120,000, for each of the three instances of non-compliance, resulting in a total administrative penalty of GHC 360,000,” the statement said.
EY Ghana has been given 14 calendar days from the date of the final enforcement directive to pay the penalty.
In addition to the financial penalty, the CSA has directed EY Ghana to immediately stop providing all regulated cybersecurity services without a licence.
The directive covers Governance, Risk and Compliance (GRC) services among other regulated activities.
EY Ghana has also been ordered to provide written confirmation that the affected services have ceased and complete the process of obtaining a CSP licence.
The CSA stressed that submitting an application does not amount to authorisation to operate.
According to the Authority, service providers must obtain the appropriate licence before commencing regulated cybersecurity activities.
