BTA2023 New Directive Targets System-Wide Digital Risk
The Bank of Ghana has introduced a revised Cyber and Information Security Directive (CISD), expanding its scope beyond banks to include fintechs, microfinance institutions, and other financial players.
Governor Dr. Johnson Pandit Asiama described the move as a shift toward protecting the entire digital financial ecosystem, warning that cyber threats now pose national security risks.
From IT Issue to Economic Security Priority
The updated directive replaces the 2018 framework and reflects a major policy shift:
- Cyber risks like ransomware and data breaches are now treated as systemic threats
- Focus moves from compliance to active cyber resilience
- Sector-wide coordination becomes mandatory
The initiative positions cybersecurity as central to financial stability in Ghana.
Key Reforms in the New Framework
The directive introduces stricter and more modern controls:
- AI governance rules for fraud detection and credit scoring
- Data sovereignty requirements, restricting sensitive data from being hosted outside Ghana
- Mandatory participation in the Financial Industry Command Security Operations Centre (FICSOC)
- Board-level accountability, requiring cybersecurity expertise in leadership
A proportional compliance model ensures rules scale with institutional size and risk.
Business Impact: Fintechs and Banks Face New Reality
For financial institutions, the directive means:
- Increased compliance costs and operational adjustments
- Tighter controls on cloud infrastructure and data management
- Greater collaboration across the financial ecosystem
However, it also:
- Strengthens consumer trust
- Reduces systemic vulnerabilities
- Supports long-term digital finance growth
Policy Backing and National Strategy
Chief of Staff Julius Debrah emphasized that innovation without protection creates risk, reinforcing the government’s stance that cybersecurity is integral to economic resilience.
The central bank is also exploring a shared funding model to sustain cybersecurity infrastructure like FICSOC.
Bottom Line
Ghana is raising the bar on financial cybersecurity. The new directive signals a clear message: As finance becomes digital, security becomes non-negotiable.
