GhanaBank of Ghana Cyber and Information Security Directive, Security Programme
In force.
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance, Licensing
As of .
What it requires
- This binds a regulated financial institution (RFI): an institution licensed or registered under the Banks and Specialised Deposit-Taking Institutions Act, 2016 (Act 930), the Development Finance Institutions Act, 2020 (Act 1032), the Non-Bank Financial Institutions Act, 2008 (Act 774), the Payment Systems and Services Act, 2019 (Act 987), the Credit Reporting Act, 2007 (Act 726), the Foreign Exchange Act, 2006 (Act 732) or the Virtual Service Providers Act, 2025 (Act 1154), or otherwise licensed or regulated by the Bank of Ghana (reached by declaring that you provide financial services). Its provisions apply by the institution's assessed risk tier (paragraph 3 and Annexure A).
- Be ISO/IEC 27001 certified and adopt ISO/IEC 27032 (paragraph 4(9)).
- Have the board appoint a Chief Information Security Officer with the prior written approval of the Bank of Ghana, and have the board approve the cyber and information security policies (paragraphs 10 and 13).
- Conduct a cyber and information security risk analysis at least once a year (paragraph 18).
- Conduct controlled penetration tests covering network infrastructure, external and internal perimeters and critical applications, at the frequency Annexure H sets for your tier (paragraph 120).
- Obtain the prior approval of the Bank of Ghana before engaging a managed security service provider (paragraph 51).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Bank of Ghana, which issues the Directive under section 92(1) of the Banks and Specialised Deposit-Taking Institutions Act, 2016 (Act 930) and other enactments.
Settledness
- As of
- Open questions
- Which provisions bind a given institution, given the risk tier the Bank of Ghana assigns it under paragraph 3 and Annexure A?
- What sanction applies to a breach of the Directive, which it leaves to the applicable laws?
What this law does
The Bank of Ghana issued this Directive under section 92(1) of the Banks and Specialised Deposit-Taking Institutions Act, 2016, among other powers. The Directive applies to institutions licensed or registered under the Banks and Specialised Deposit-Taking Institutions Act, 2016, and to those licensed under six further Acts, among them the Payment Systems and Services Act, 2019 and the Virtual Service Providers Act, 2025 as the Directive names it.
A regulated financial institution must be ISO/IEC 27001 certified and adopt ISO/IEC 27032. The board of a regulated financial institution must appoint a Chief Information Security Officer, subject to the prior written approval of the Bank of Ghana. A regulated financial institution must conduct a cyber and information security risk analysis at least once a year.
A regulated financial institution must conduct controlled penetration tests that cover network infrastructure, external and internal perimeters, and critical applications. A regulated financial institution must seek the prior approval of the Bank of Ghana to engage a managed security service provider. The Directive states that failure to comply with it will attract appropriate sanctions in accordance with applicable laws.
The Bank of Ghana's procedures for issuing directives state that a final directive has the force of law as prescribed under Act 930.
When LexLint raises it
When your app profile says your app provides financial services.