Ghana’s Cyber Security Authority (CSA) has sanctioned the Office of the Registrar of Companies (ORC) and Purpleline Solutions Limited Company over breaches of the country’s cybersecurity licensing and compliance requirements.
The ORC was sanctioned for engaging a cybersecurity service provider that did not hold the required licence from the CSA, while Purpleline Solutions Limited Company was fined for providing regulated cybersecurity services without first obtaining the necessary licence.
ORC Fined for Engaging Unlicensed Cybersecurity Provider
The CSA said its action against the ORC followed a determination that the institution engaged Purpleline Solutions Limited Company, despite the company not being licensed to provide cybersecurity services.
The Authority had previously directed the ORC, which operates Critical Information Infrastructure (CII), to engage a Tier 1 licensed Cybersecurity Service Provider (CSP) to strengthen the protection and resilience of its critical systems.
On June 15, 2026, the CSA formally instructed the ORC to engage one or more Tier 1 licensed cybersecurity service providers.
The ORC was also required to submit details of its cybersecurity providers, the Terms of Reference for its proposed Security Operations Centre (SOC) and relevant approvals from the Public Procurement Authority (PPA).
According to the CSA, the ORC proceeded to contract Purpleline Solutions Limited Company despite the directives.
The Authority determined that the ORC had failed to comply with two separate directives, constituting a violation of Section 92 of the Cybersecurity Act, 2020 (Act 1038).
Consequently, the ORC has been fined 10,000 penalty units for each violation, amounting to GH¢240,000 in total.
The CSA has also directed the ORC to comply with the outstanding directives within one month of receiving its sanction letter.
Purpleline Solutions Fined GH¢120,000
The CSA has separately sanctioned Purpleline Solutions Limited Company for providing cybersecurity services without the required licence.
The Authority noted that the company applied for a cybersecurity service provider licence on July 15, 2026, after it had already been engaged by the ORC to provide cybersecurity services.
The CSA stressed that submitting a licence application does not automatically grant an entity permission to operate as a regulated Cybersecurity Service Provider.
Companies must obtain the appropriate licence before beginning regulated cybersecurity operations.
Purpleline Solutions Limited Company has therefore been fined 10,000 penalty units, equivalent to GH¢120,000, for operating without the required cybersecurity licence.
CSA Warns Institutions Against Unlicensed Cybersecurity Providers
The Cyber Security Authority has issued a strong warning to public institutions, businesses and other organisations covered by the Cybersecurity Act to comply with cybersecurity licensing requirements.
The CSA said institutions must not hire unlicensed cybersecurity service providers, while companies must not provide regulated cybersecurity services without first securing the appropriate licence.
The Authority also warned organisations against engaging an unlicensed provider with the expectation that the company will obtain its licence after starting work.
According to the CSA, applying for a cybersecurity licence is not the same as holding a valid licence and does not authorise a company to commence regulated cybersecurity operations.
CII Institutions Urged to Verify Cybersecurity Licences
The CSA has urged all designated Critical Information Infrastructure institutions, public-sector organisations and other entities subject to Ghana’s cybersecurity laws to verify the licensing status of cybersecurity providers before awarding contracts.
Organisations are also expected to confirm that service providers hold the appropriate licence tier for the cybersecurity services they intend to provide.
The Authority said it will continue monitoring compliance and take enforcement action against both institutions that engage unlicensed cybersecurity companies and service providers that operate without the required licence.
The CSA emphasised that cybersecurity licensing is a legal requirement rather than an administrative formality.
The enforcement action forms part of broader efforts to protect Ghana’s digital infrastructure, critical information systems and sensitive data while ensuring that organisations comply with national cybersecurity regulations.
Source: newsthemegh.com