Ghana's 2026 fintech rulebook: the cyber, data protection and AML evidence the Bank of Ghana and the DPC expect

Ghana regulates fintechs mostly through licences. The Bank of Ghana's payment licences range from the Dedicated Electronic Money Issuer (licence categories) to a technology provider category covering credit scoring and AML platforms (licence categories). Since 1 November 2025 lenders that deliver credit only through apps and websites need their own digital credit licence (DCSP Directive para. 1.7). The Directive defines digital credit as credit that is short-term, under 12 months, of low value and delivered through digital channels (para. 1.8).

The Cyber and Information Security Directive then attaches to whatever the Bank licenses. Failure to comply "will attract appropriate sanctions" (para. 2). It is not applied identically to everyone. Requirements scale with "the size, complexity, risk exposure, and technological maturity of each institution" (para. 3(1)), and the final classification rests on the Bank's own assessment (para. 3(3)). The proportionality annex groups enhanced PSPs and virtual asset firms with microfinance banks and leasing companies (Annexure A), and digital credit providers with rural and community banks (Annexure A).

Data protection reaches everyone. Act 843 requires every data controller that intends to process personal data to register with the Data Protection Commission (s. 27(1)). Anti-money laundering duties attach to "accountable institutions", which the AML Act defines by activity: businesses that issue and administer means of payment (First Schedule), lenders (First Schedule) and virtual asset service providers, starting with exchange between virtual assets and fiat currency (Interpretation).

StackWeaver view · Assume all three regimes apply: the Cyber Directive through your licence, Act 843, and the AML Act. Ask the Bank to confirm your Cyber Directive tier in writing, because the exemptions turn on it.

The Bank of Ghana. The Bank licenses payment providers, e-money issuers and digital lenders, and wrote the Cyber Directive. It can refuse or grant a digital credit application within 90 days of a complete file (DCSP Directive para. 2.1(8)). Notice No. 36 cautioned banks and PSPs against processing transactions for unlicensed lenders (Notice No. 36).

The Data Protection Commission (DPC). The Commission keeps the register of data controllers and serves enforcement notices where it finds a breach of the data protection principles (Act 843 s. 75(1)). Its executive director told the Ghana News Agency it had "shifted its focus from awareness creation to enforcement" (GNA).

The Financial Intelligence Centre (FIC). The Centre receives suspicious, cash and electronic transfer reports, and with the supervisory bodies it can impose administrative penalties that include suspension or revocation of a licence (Act 1044 s. 53(3)). Its joint guideline with the Bank dates from December 2022 (Guideline).

Governance comes first. The board carries "the overall responsibility for complying with the directive" (para. 5), at least one board member must have verifiable cyber and information security expertise (para. 5(3)), and the board receives quarterly reports on all incidents (para. 5(6)). The board appoints a Chief Information Security Officer, but only with the Bank's prior written approval (para. 10(1)); the CISO reports to the chief executive with unfettered access to the board (para. 11(2)). For some tiers the annex lets the CISO function be outsourced case by case (Annexure A).

Testing is specified in detail. All aspects of cyber and information security management must be audited at least once a year (para. 7(3)). The CISO initiates controlled penetration and robustness tests (para. 12(7)), network elements get a vulnerability assessment at least quarterly (para. 28(18)), and websites and internal servers are tested every six months (para. 70). Every existing system must be connected to the SIEM within 12 months of its activation (para. 47(6)).

Reporting to the Bank is monthly, even when nothing happened: incidents are summarised in a monthly return (para. 50(3)), and an institution with no incidents files a "NIL report" (para. 50(5)). Some events need immediate notice, including production systems holding sensitive information that are down for more than 3 hours (para. 50(7)(b)) and customer information exposed outside the institution (para. 50(7)(c)). Privacy incidents go to both the Bank and the Data Protection Commission (Annexure G), and every technology project needs a privacy impact assessment (para. 99(2)).

Outsourced security has its own gate. Using a managed security service provider needs the Bank's prior approval (para. 51), and the provider must be accredited by the Cyber Security Authority (para. 51(3)).

StackWeaver view · The expensive items are the certifications and the CISO approval. Confirm your tier before committing to ISO 27001 or PCI DSS, and clear any outside SOC with the Bank and the CSA before signing.

Digital credit. No entity may operate as a digital credit services provider without a Bank of Ghana licence (para. 2.2(1)), and the Bank began accepting applications from 3 November 2025 (Bank of Ghana). An application must include a data protection impact assessment report cleared by the DPC (para. 2.1(5)(d)(x)) and a Data Protection certificate (para. 2.1(5)(d)(xi)). Licensees need at least 30% Ghanaian equity (para. 2.1(2)) and a valid third-party certification against standards the Bank sets (para. 3.5(1)). Outsourcing connected to digital credit needs prior written approval (para. 3.6(1)).

The conduct rules are where most loan apps fail. Complaints must be received and resolved within twenty days (section 6). Collectors may not message or call a customer's contacts without authorisation (para. 7.2). Credit data goes to licensed bureaus daily (para. 7.3(6)), but only with the customer's consent (para. 7.3(8)). Lenders also need an AMLRO reporting to the board (section 5(1)), an annual independent AML audit (section 5(4)(c)) and compliance with the Cyber Directive (section 4(3)). The Bank says the unlicensed apps it names violate customer data privacy and consumer protection (Notice No. 36).

Virtual assets. Ghana enacted Act 1154 in December 2025 (GNA). The Bank describes it as the legal foundation for registering, licensing and supervising virtual asset service providers (Bank of Ghana), lists custodial and non-custodial wallet providers among those that must register or be licensed (Bank of Ghana), and expects VASPs to meet data protection and cybersecurity standards (Bank of Ghana). The SEC is finalising a regulatory sandbox for VASPs (SEC notice), and the Governor said the Act would be fully operational by 2027 (GNA).

StackWeaver view · "Fully operational by 2027" is not a grace period: the AML Act already covers virtual asset activity, and the Cyber Directive already names Act 1154 licensees.

The clearest recent case is Zeepay. On 14 July 2026 the Bank of Ghana revoked its Dedicated Electronic Money Issuer licence (Notice No. 21), saying the company issued electronic money "without maintaining corresponding cash backing" (Notice No. 21) and failed to comply with the Bank's directives (Notice No. 21); the Ghana News Agency reported the same decision (GNA). In digital credit, the Bank's 6 October 2026 notice listed mobile loan apps operating without a licence (Notice No. 36). On data protection, the DPC began spot checks against organisations "processing personal data without meeting statutory requirements" (GNA).

The penalty schedules:

• AML Act administrative penalties for an entity: 1,000 to 100,000 penalty units (Act 1044 s. 53(3)(e)), alongside licence suspension or revocation (s. 53(3)).
• Processing personal data without DPC registration: a fine of up to 250 penalty units, imprisonment of up to two years, or both (Act 843 s. 56).
• Other Act 843 offences with no specific penalty: up to 5,000 penalty units, imprisonment of up to ten years, or both (s. 95).

StackWeaver view · Zeepay lost its licence for ignoring directives, not for a hack. Keep a register of every directive you receive and the proof that you complied.

We cite the Bank of Ghana's Cyber and Information Security Directive, digital credit Directive, licence categories, notices and virtual asset pages as published on bog.gov.gh, and the joint Bank of Ghana and FIC AML guideline. Act 843 and Act 1038 are quoted from the copies the Cyber Security Authority publishes, and Act 1044 from the FAO FAOLEX legislative database, because the official legal portals refused automated checks. The Zeepay notice is MyJoyOnline's copy. News reports come from the Ghana News Agency and Graphic Online. We have not seen the text of Act 1154 itself and describe it only through regulators' statements.

Every legal statement here is logged in a public claims ledger with its source, section, retrieval date and the exact words relied on, and the build re-checks each one before the page ships. Facts carry the “Sourced” label; opinions and recommendations carry “StackWeaver view”, in line with our editorial policy. AI tools helped research and draft this guide; a named person at StackWeaver is accountable for it, and each legal statement was checked against the cited text.

Found a mistake? Email [email protected]. Other markets are covered in the Africa Fintech Regulatory Atlas.