GhanaBank of Ghana Cyber and Information Security Directive, Incident Reporting
In force.
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting
As of .
What it requires
- This binds a regulated financial institution (RFI): an institution licensed or registered under the Banks and Specialised Deposit-Taking Institutions Act, 2016 (Act 930), the Development Finance Institutions Act, 2020 (Act 1032), the Non-Bank Financial Institutions Act, 2008 (Act 774), the Payment Systems and Services Act, 2019 (Act 987), the Credit Reporting Act, 2007 (Act 726), the Foreign Exchange Act, 2006 (Act 732) or the Virtual Service Providers Act, 2025 (Act 1154), or otherwise licensed or regulated by the Bank of Ghana (reached by declaring that you provide financial services). Its provisions apply by the institution's assessed risk tier (paragraph 3 and Annexure A).
- Report cyber and information security incidents to the Bank of Ghana every month, in the required format, by the 15th of each month, and submit a nil report in a month with no incident (paragraph 50(3)-(5)).
- Submit ad-hoc reports to the Bank of Ghana immediately, informing it about an incident as it starts, unfolds and terminates (paragraph 50(6)).
- Notify the Bank of Ghana immediately of an incident damaging information integrity, a shutdown of production systems holding sensitive information for over three hours, a leak of sensitive customer information, significant penetration and attack attempts, the activation of an incident response mechanism, cessation of essential services for one business day or more, and any other significant event with significant impact on data management and protection (paragraph 50(7)).
- Notify the Bank of Ghana immediately of an AI or ML incident that results in or has the potential to result in material financial loss, systemic bias or widespread customer harm, compromise of the model's integrity through adversarial attack, or significant regulatory or legal action (paragraph 115(2)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Bank of Ghana, which issues the Directive under section 92(1) of the Banks and Specialised Deposit-Taking Institutions Act, 2016 (Act 930) and other enactments.
Settledness
- As of
- Open questions
- Will the reporting policy the Bank of Ghana may set under paragraph 50(8) change the incident severity levels and reporting duties?
What this law does
A regulated financial institution must report cyber and information security incidents to the Bank of Ghana on a monthly basis, in a report submitted by the 15th of each month that summarises all incidents in the past month. A regulated financial institution that recorded no cyber security incident must submit a nil report. A regulated financial institution must submit ad-hoc reports to the Bank of Ghana immediately, informing it about an incident as it starts, unfolds and terminates.
A regulated financial institution must notify the Bank of Ghana immediately of an incident damaging information integrity, a shutdown of production systems that hold sensitive information for over three hours, a leak of sensitive customer information, and the other events paragraph 50(7) lists.
A regulated financial institution must notify the Bank of Ghana immediately of any AI/ML-specific incident that results in, or has the potential to result in, material financial loss to the institution or its customers. The Directive states that failure to comply with it will attract appropriate sanctions in accordance with applicable laws. The Bank of Ghana's procedures for issuing directives state that a final directive has the force of law as prescribed under Act 930.
When LexLint raises it
When your app profile says your app provides financial services.