The Cyber Security Authority (CSA) and EY Ghana have reached an agreement to resolve regulatory concerns surrounding the firm’s provision of cybersecurity services without a valid licence.
The resolution follows engagements between the two institutions after the CSA imposed a GH¢360,000 fine on EY Ghana for allegedly operating as a regulated cybersecurity service provider without the required authorisation.
In a joint statement issued on Tuesday, August 18, the two organisations said their discussions focused on clarifying issues relating to licensing fees and other administrative requirements.
They subsequently confirmed that the regulatory matters had been satisfactorily resolved.
The dispute arose after the CSA directed EY Ghana to regularise its operations in line with the Cybersecurity Act, 2020 (Act 1038).
The Authority said EY Ghana had continued providing cybersecurity-related services, including services to owners of Critical Information Infrastructure (CII), despite earlier directives to obtain the appropriate licence.
According to the CSA, it formally instructed the company in a letter dated March 20, 2026, to submit an application for a Cybersecurity Service Provider (CSP) licence within 15 days.
The Authority subsequently engaged the firm to address the outstanding regulatory issues, resulting in clarification on the applicable licensing and administrative requirements.
The latest development underscores the CSA’s efforts to ensure that organisations providing regulated cybersecurity services operate within Ghana’s legal and regulatory framework.
While enforcing compliance, the Authority said its mandate also includes supporting organisations to understand and meet their regulatory obligations.
The CSA reiterated its commitment to strengthening Ghana’s digital security environment through effective regulation, industry cooperation and enforcement of the country’s cybersecurity laws.
EY Ghana and the CSA also welcomed the collaborative process that led to the settlement of the matter and reaffirmed their commitment to supporting Ghana’s cybersecurity regulatory framework.
The resolution brings an end to the immediate regulatory dispute between the two institutions and allows both sides to focus on strengthening compliance and cybersecurity standards within Ghana’s rapidly evolving digital ecosystem.
