Ghana’s financial sector is entering a new phase of digital risk management following the rollout of the Bank of Ghana’s revised Cyber and Information Security Directive (2026), with regulators and industry leaders warning that cyber threats have become a daily operational reality.
At the forefront of the call for stronger safeguards is the Ghana Association of Banks, which is urging financial institutions to fundamentally rethink how they approach cybersecurity—treating it as critical infrastructure rather than a regulatory obligation.
Speaking at the launch of the directive in Accra, the Association’s Chief Executive Officer, John Awuah, stressed that the rapid digitisation of banking services has significantly increased exposure to cyber risks.
He cautioned that vulnerabilities within any single institution—whether a bank, fintech, or payment service provider—could compromise the entire financial ecosystem.
“In cybersecurity, a single weak link can become the entry route for miscreants to access the larger financial architecture,” he said, calling for coordinated action across the industry.
The new directive by the Bank of Ghana expands the scope of cybersecurity oversight to include emerging technologies such as cloud systems, artificial intelligence, and third-party digital platforms—areas increasingly targeted by cybercriminals.
First Deputy Governor Zakari Mumuni underscored the broader implications, describing cybersecurity as a matter of national and economic security rather than a purely technical concern.
“Cyber incidents are no longer distant threats but daily realities. Preparedness is the key to resilience,” he stated.
The updated framework builds on earlier regulations introduced in 2018 but reflects the fast-changing digital financial landscape, where mobile banking, fintech integration, and data-driven services have become central to operations.
Industry leaders say the directive marks a shift toward shared responsibility, requiring stronger collaboration between banks, regulators, fintech firms, and other stakeholders to safeguard customer data and maintain confidence in the financial system.
Mr Awuah noted that embedding cybersecurity into core business systems would not only strengthen defences but also reinforce trust among customers, which remains essential for financial stability.
The directive is expected to drive significant investment in cybersecurity systems across the sector, as institutions align with stricter requirements aimed at protecting Ghana’s increasingly digitalised financial architecture.
