The Cyber Security Authority (CSA) has sanctioned the Office of the Registrar of Companies (ORC) and Purpleline Solutions Limited for breaches of Ghana’s cybersecurity requirements.

The ORC was fined GH¢240,000 for failing to comply with two directives requiring it, as a designated Critical Information Infrastructure (CII) institution, to engage only appropriately licensed Cybersecurity Service Providers (CSPs).

In a statement, the CSA said the ORC engaged Purpleline Solutions Limited, which was not licensed by the Authority to provide cybersecurity services, despite being specifically directed to engage a Tier 1 licensed CSP.

The Authority said it directed the ORC on June 15, 2026, to engage Tier 1 licensed CSPs to strengthen the security and resilience of its critical information infrastructure.

The ORC was subsequently required to provide details of its cybersecurity service providers, the Terms of Reference for its proposed Security Operations Centre (SOC), and relevant Public Procurement Authority approvals.

According to the CSA, the ORC nevertheless proceeded to engage Purpleline Solutions Limited, constituting a violation of Section 92 of the Cybersecurity Act, 2020 (Act 1038).

The Authority said the ORC was fined 10,000 penalty units for each of the two instances of non-compliance, amounting to GH¢240,000, and directed to comply with the outstanding directives within one month of receiving the sanction letter.

“The Authority determined that the ORC failed to comply with two separate directives issued by the CSA. Consequently, pursuant to Section 92(2) of Act 1038, the ORC has been fined Ten Thousand (10,000) penalty units for each instance of non-compliance, standing at GH₵ 240,000.00, and directed to comply with the outstanding directives within one month of receiving the CSA’s sanction letter,” part of the statement read.

The CSA also sanctioned Purpleline Solutions Limited for providing cybersecurity services without the required licence.

The company was fined 10,000 penalty units, equivalent to GH¢120,000, after the Authority determined that it had provided cybersecurity services without first obtaining the necessary licence.

The CSA noted that Purpleline applied for a cybersecurity service provider licence on July 15, 2026, after the Authority had established that the company had already been engaged by the ORC.

It stressed that an application for a licence does not authorise a company to operate as a Cybersecurity Service Provider.

“Entities are required to obtain the requisite license before commencing the provision of regulated cybersecurity services,” the statement read.

The Authority has warned institutions against engaging unlicensed cybersecurity service providers while cautioning companies against providing regulated cybersecurity services without the appropriate licence.

The CSA said organisations cannot engage an unlicensed provider and subsequently expect the provider to regularise its status.

“An application for a license is not the same as holding a license and does not authorise an entity to commence regulated cybersecurity operations,” the Authority emphasised in the statement.

The Authority has therefore directed designated Critical Information Infrastructure institutions, public-sector organisations and other entities covered by the Cybersecurity Act to verify both the licensing status and appropriate licence tier of cybersecurity service providers before awarding contracts or allowing them to commence work.

The CSA said it will continue to monitor compliance and take enforcement action against institutions that engage unlicensed providers, as well as companies that provide cybersecurity services without the requisite licence.

“Cybersecurity licensing is a legal requirement, not an administrative formality,” the Authority said, adding that it will use its regulatory powers to ensure organisations entrusted with critical systems and sensitive information meet their cybersecurity obligations.