The Cyber Security Authority (CSA) has imposed an administrative penalty of GH¢360,000 on Ernst & Young (EY) Ghana for providing cybersecurity services without a valid Cybersecurity Service Provider (CSP) licence.
The action follows EY Ghana's continued provision of cybersecurity services, including services to owners of Critical Information Infrastructure (CII), despite repeated directives from the CSA requiring the firm to comply with the licensing regime under the Cybersecurity Act, 2020 (Act 1038).
The CSA had specifically directed EY Ghana, in correspondence dated March 20, 2026, to submit an application for a CSP licence within 15 days.
The Authority subsequently determined that EY Ghana failed to comply with three separate regulatory directives, conduct it said breaches Sections 49 and 92 of Act 1038, which prohibit the provision of regulated cybersecurity services without the requisite licence and set out sanctions for failing to comply with directives issued by the Authority.
