Ghana’s commercial banking industry has thrown its weight behind the Bank of Ghana’s newly launched Cyber and Information Security Directive (CISD) 2026, with the industry’s representative body warning that a single vulnerability anywhere in the financial ecosystem is enough to compromise the entire system.
John Awuah, Chief Executive Officer of the Ghana Association of Banks (GAB), said lenders had been closely involved in the development of the directive and are prepared to work alongside the central bank and the broader financial technology ecosystem to implement it.
“Because in cybersecurity, one small broken chain can be the entry route for a cyber miscreant to gain access to the bigger architecture,” Awuah said at the launch event in Accra, making the case for why the directive’s expansion beyond traditional banks to include fintech firms, payment service providers, and smaller financial institutions was both necessary and timely.
The GAB chief pushed back against treating the directive as a compliance burden, arguing that the industry’s relationship with technology had fundamentally changed. “As banks, we see technology not as our business enabler. We see technology as our business,” he said, adding that cybersecurity must become embedded in how banks operate rather than sitting separately as a regulatory obligation. “It’s not going to be a compliance matter. It’s going to be part of the banking system DNA in how we operate.”
The directive expands oversight to cover banks, fintechs, and payment firms, tightens governance standards, and strengthens the role of the Financial Industry Command Security Operations Centre (FICSOC), a 24-hour monitoring hub that will serve as the coordinated response centre for cyber incidents across the industry.
GAB represents 24 member institutions and serves as the sector’s primary advocacy body in engagements with the Bank of Ghana, the Ghana Revenue Authority (GRA), and the Ghana Interbank Payment and Settlement Systems (GhIPSS).
