The Cyber Security Authority (CSA) has sanctioned the Office of the Registrar of Companies (ORC) for failing to comply with directives requiring institutions designated as Critical Information Infrastructure (CII) to engage appropriately licensed cybersecurity service providers.

The CSA has also fined Purpleline Solutions Limited Company for providing cybersecurity services without a licence from the Authority.

The two sanctions amount to GH¢360,000.

The CSA said the sanction against the ORC followed its determination that the institution engaged Purpleline Solutions, despite being directed to use a Tier 1 licensed Cybersecurity Service Provider (CSP).

On June 15, 2026, the Authority directed the ORC to engage Tier 1 licensed CSPs to strengthen the security and resilience of its Critical Information Infrastructure.

The ORC was subsequently required to provide information on its cybersecurity service providers, the Terms of Reference for its proposed Security Operations Centre (SOC), and relevant Public Procurement Authority approvals.

According to the CSA, the ORC nevertheless proceeded to engage Purpleline Solutions, which was not licensed to provide cybersecurity services.

The Authority determined that the ORC failed to comply with two separate directives, constituting a violation of Section 92 of the Cybersecurity Act, 2020 (Act 1038).

Under Section 92(2) of the Act, the ORC has been fined 10,000 penalty units for each instance of non-compliance, amounting to GH¢240,000 in total.

The CSA has also directed the ORC to comply with the outstanding directives within one month of receiving the sanction letter.

The CSA also determined that Purpleline Solutions Limited provided cybersecurity services without the required licence.

The company applied for a cybersecurity service provider licence on July 15, 2026, but the application was submitted after the Authority had determined that the company was already providing services to the ORC.

The CSA stressed that applying for a licence does not amount to being licensed and does not authorise a company to provide regulated cybersecurity services.

Purpleline Solutions has consequently been fined 10,000 penalty units, equivalent to GH¢120,000, for operating without the required licence.

The Authority has warned institutions and cybersecurity companies that it will not tolerate the engagement or provision of regulated cybersecurity services without the requisite licence.

“Institutions must not engage unlicensed Cybersecurity Service Providers, and companies must not provide regulated cybersecurity services unless they have first obtained the appropriate license from the CSA,” the Authority stated.

The CSA also cautioned organisations against engaging a provider first and expecting it to regularise its licensing status afterwards.

It stressed that an application for a licence does not confer the authority to operate.

The Authority has therefore urged all designated Critical Information Infrastructure institutions, public-sector organisations and other entities covered by the Cybersecurity Act to verify both the licensing status and appropriate licence tier of cybersecurity providers before awarding contracts or allowing them to commence work.

The CSA said it would continue monitoring compliance and take enforcement action against institutions that engage unlicensed providers as well as companies that provide cybersecurity services without the required authorisation.

“Cybersecurity licensing is a legal requirement, not an administrative formality. Institutions must comply and service providers must be licensed before they operate,” the Authority stated.