Ghana’s Cyber Security Authority Slams Registrar of Companies with GH¢240,000 Fine for Engaging Unlicensed Provider
The Cyber Security Authority (CSA) has imposed a significant GH¢240,000 penalty on the Office of the Registrar of Companies (ORC) for flagrant non-compliance with directives mandating the engagement of licensed Cybersecurity Service Providers for Critical Information Infrastructure (CII). This enforcement action underscores the CSA’s commitment to upholding the integrity of Ghana’s digital security framework and highlights the severe repercussions for entities failing to adhere to regulatory mandates.
In a parallel action, Purpleline Solutions Limited Company has been fined GH¢120,000 for operating as a cybersecurity service provider without the requisite licence from the Authority. The CSA’s investigation revealed that the ORC had engaged Purpleline Solutions Limited Company despite explicit instructions to contract with a Tier 1 licensed Cybersecurity Service Provider. This directive was issued on June 15, 2026, with the clear objective of fortifying the security and resilience of the ORC’s CII.
The ORC was subsequently required to furnish details regarding its cybersecurity service providers, the Terms of Reference for its proposed Security Operations Centre (SOC), and relevant Public Procurement Authority approvals. However, the Authority found that the ORC proceeded to engage Purpleline Solutions Limited Company, an entity demonstrably not licensed to provide such critical services. This failure to comply with two distinct directives constitutes a violation of Section 92 of the Cybersecurity Act, 2020 (Act 1038). Consequently, the ORC was fined 10,000 penalty units for each instance of non-compliance, totalling GH¢240,000, and has been mandated to rectify the outstanding directives within one month of receiving the sanction letter.
Purpleline Solutions Limited Company’s penalty stems from its provision of cybersecurity services without the necessary authorisation. The CSA noted that the company submitted its application for a licence on July 15, 2026, after the Authority had already identified its engagement by the ORC. The CSA emphatically stated that an application for a licence does not equate to its issuance nor does it grant permission to operate as a regulated cybersecurity service provider. The GH¢120,000 fine for Purpleline Solutions Limited Company reflects its operation in violation of licensing requirements.
The CSA has issued a stern warning to both institutions and cybersecurity service providers regarding the critical importance of adhering to licensing regulations under the Cybersecurity Act. Public-sector organisations, designated CII institutions, and other entities subject to the Act are urged to rigorously verify the licensing status and appropriate tier of any cybersecurity service provider before awarding contracts or permitting operations. The Authority reiterated that engaging an unlicensed provider with the expectation of subsequent regularisation is unacceptable and will not be tolerated. The CSA affirmed its ongoing commitment to monitoring compliance and will continue to pursue enforcement actions against both unlicensed providers and the entities that engage them.
