Is a payment provider, in Ghana

National Identity Register Regulations, 2012 (L.I. 2111), regs. 7-9 and 13-18 (mandatory use, verification and user agencies) · Read the law's page

• Demand the presentation of a national identity card from the individual concerned before you provide a service in a transaction listed in regulation 7(1), which includes opening individual or personal bank accounts, purchase of insurance policies, consumer credit transactions, registration of SIM cards and applications for public or government services, or in a transaction the Authority publishes in the Gazette under regulation 7(1)(n).
• If you are a user agency, state the purpose for which you require an individual's personal information and satisfy the Authority that the individual is aware of and has authorised the request before you access it.
• If you are a user agency that uses personal information for administrative purposes, retain it only for the period the Authority determines under its guidelines or as specified in the Data Sharing Agreement Form.
• If you are a user agency that obtains personal information, secure and store it in accordance with the Authority's guidelines or as specified in the Data Sharing Agreement.

Cybersecurity Act, 2020 (Act 1038), ss. 47(2) and 47(5)-(6), and Second Schedule item 47(6) · Read the law's page

• Report a cybersecurity incident to the relevant Sectoral Computer Emergency Response Team, or to the National Computer Emergency Response Team where the institution has no Sectoral team, within twenty-four hours after the incident is detected.
• Where the institution is itself a cybersecurity service provider licensed by the Authority, also submit a periodic report on its operations, including any cybersecurity incident, within the period the Authority sets.
• Failing to report within the twenty-four-hour window is an administrative penalty of not less than two hundred and fifty penalty units and not more than five thousand penalty units, payable to the Cyber Security Authority.
• This binds the person in charge of any public or private institution in Ghana that detects a cybersecurity incident, not only the owner of a critical information infrastructure or a licensed cybersecurity service provider.

Bank of Ghana CISD 2026 incident reporting (Cyber and Information Security Directive, March 2026), paras 50 and 115 · Read the law's page

• This binds a regulated financial institution (RFI): an institution licensed or registered under the Banks and Specialised Deposit-Taking Institutions Act, 2016 (Act 930), the Development Finance Institutions Act, 2020 (Act 1032), the Non-Bank Financial Institutions Act, 2008 (Act 774), the Payment Systems and Services Act, 2019 (Act 987), the Credit Reporting Act, 2007 (Act 726), the Foreign Exchange Act, 2006 (Act 732) or the Virtual Service Providers Act, 2025 (Act 1154), or otherwise licensed or regulated by the Bank of Ghana (reached by declaring that you provide financial services). Its provisions apply by the institution's assessed risk tier (paragraph 3 and Annexure A).
• Report cyber and information security incidents to the Bank of Ghana every month, in the required format, by the 15th of each month, and submit a nil report in a month with no incident (paragraph 50(3)-(5)).
• Submit ad-hoc reports to the Bank of Ghana immediately, informing it about an incident as it starts, unfolds and terminates (paragraph 50(6)).
• Notify the Bank of Ghana immediately of an incident damaging information integrity, a shutdown of production systems holding sensitive information for over three hours, a leak of sensitive customer information, significant penetration and attack attempts, the activation of an incident response mechanism, cessation of essential services for one business day or more, and any other significant event with significant impact on data management and protection (paragraph 50(7)).
• Notify the Bank of Ghana immediately of an AI or ML incident that results in or has the potential to result in material financial loss, systemic bias or widespread customer harm, compromise of the model's integrity through adversarial attack, or significant regulatory or legal action (paragraph 115(2)).

Bank of Ghana CISD 2026 security programme (Cyber and Information Security Directive, March 2026), paras 2, 4, 10, 13, 18, 51 and 120 · Read the law's page

• This binds a regulated financial institution (RFI): an institution licensed or registered under the Banks and Specialised Deposit-Taking Institutions Act, 2016 (Act 930), the Development Finance Institutions Act, 2020 (Act 1032), the Non-Bank Financial Institutions Act, 2008 (Act 774), the Payment Systems and Services Act, 2019 (Act 987), the Credit Reporting Act, 2007 (Act 726), the Foreign Exchange Act, 2006 (Act 732) or the Virtual Service Providers Act, 2025 (Act 1154), or otherwise licensed or regulated by the Bank of Ghana (reached by declaring that you provide financial services). Its provisions apply by the institution's assessed risk tier (paragraph 3 and Annexure A).
• Be ISO/IEC 27001 certified and adopt ISO/IEC 27032 (paragraph 4(9)).
• Have the board appoint a Chief Information Security Officer with the prior written approval of the Bank of Ghana, and have the board approve the cyber and information security policies (paragraphs 10 and 13).
• Conduct a cyber and information security risk analysis at least once a year (paragraph 18).
• Conduct controlled penetration tests covering network infrastructure, external and internal perimeters and critical applications, at the frequency Annexure H sets for your tier (paragraph 120).
• Obtain the prior approval of the Bank of Ghana before engaging a managed security service provider (paragraph 51).

Credit Reporting Act, 2007 (Act 726), ss. 2, 12, 21-22, 24-27, 30-32, 34-38, 44 and 62 · Read the law's page

• Do not establish, operate or conduct business as a credit bureau unless the Bank of Ghana has licensed you, and engage only in the activities the Act lists.
• If you are a financial institution that is a data provider, report a borrower's credit information to a licensed credit bureau only with the borrower's prior written consent, except for the cases section 25 lists, and do not induce a customer to consent.
• If you are a data provider, confirm to the credit bureau that you hold the consent of the credit information subject, and keep a record of that consent for not less than ten years.
• If you are a credit bureau, give a credit report only to a recipient registered with you that has produced confirmation of the subject's written consent, and keep a record of the requests and of the credit reports provided.
• If you are a credit bureau, keep information in your database for a maximum of six years from the occurrence of the basis for keeping it on record, and update the database on an ongoing basis.
• If you are a credit bureau, adopt security and control measures to avoid mismanagement of information, and observe the principles of confidentiality, accuracy and transparency of information, and privacy and secrecy of communication.
• If you are a credit bureau, let a person inspect the file you hold on them without charge once within twelve months, investigate a challenge to its accuracy without charge, and give the person credible evidence or remove the information if you find none.
• If you are a credit bureau, submit to the technical audits and inspections the Bank of Ghana requires.