Line4

Search line4.ai

In forceOperational risk and cyber securityLast checked 13 November 2026

Cyber and information security incident report

A regulatory return listed by the Bank of Ghana (BoG), Ghana.

A monthly summary of all cyber and information security incidents in the past month, including a 'NIL report' where none occurred, so the Bank of Ghana can monitor institutions' cyber resilience. RFIs must also notify BoG immediately of specific significant incidents (for example a breach of information integrity, a production system outage over 3 hours, or a customer-data leak). Source

Official title: Monthly Report on Cyber and Information Security Incidents

The facts

Who files
Every institution licensed or regulated by the Bank of Ghana, including under the Banks and Specialised Deposit-Taking Institutions Act 2016, the Development Finance Institutions Act 2020, the Non-Bank Financial Institutions Act 2008, the Payment Systems and Services Act 2019, the Credit Reporting Act 2007, the Foreign Exchange Act 2006 and the Virtual Service Providers Act 2025, collectively referred to as RFIs. Source
How often
Monthly, by the 15th, in the format the Bank of Ghana requires: every RFI sends a summary of all cyber and information security incidents from the previous month. Significant incidents must also be reported straight away in an ad-hoc report. Source
Deadline
By the 15th of each month, covering the previous month's incidents (or a 'NIL report' if there were none). Significant incidents must be reported to BoG immediately, as they start, unfold and terminate. Source
Format
Other. BoG may prescribe the details of the information required and the form in which it is to be reported; no published form was found on the pages read. Source
How it is filed
Filing route recorded for the BoG: PSA Returns. See how firms file with the BoG.
Status
In forcePart VIII of the Directive (paragraph 50) sets this report as monthly, due by the 15th of each month. A later part of the same Directive on AI/ML governance (paragraph 115) refers to 'its quarterly cyber and information security report to the Bank of Ghana', which conflicts with the monthly requirement elsewhere in the same document (see gaps). This library records the monthly requirement, which is stated with a specific deadline. Source
Legal basis
Group
Operational risk and cyber security

Templates (0)

The library lists no templates for this return.

No published form for the RFI's own monthly report to BoG. Annexure D's 'Incident Notification Template' is for a third-party supplier to notify the RFI, not for the RFI's report to BoG. Source

Validation rules

No published validation rules were found for this return. No validation rules were found on the Bank's public pages. Source

Public data

No published data from this return was found. Cyber incident reports are confidential supervisory submissions; no public data was found. Source

Official documents (2)

The BoG's own files, with the size and SHA-256 fingerprint of each as downloaded on 13 November 2026, so anyone can tell whether a copy is the same version.

  • Cyber and Information Security Directive

    Legal text · PDF · 1.5 MB · March 2026

    Issued under the Bank of Ghana Act 2002, Act 930 section 92(1) and the Development Finance Institutions Act, 2020 (Act 1032), section 84. Applies to every institution the Bank of Ghana licenses or regulates. Annexure D's Incident Notification Template is for a third-party supplier to notify an RFI, not for the RFI's own monthly report to BoG, which has no published form.

    SHA-256 53825227466bshow in full53825227466bae8ce293037571ea3b75db319ba3747337c1c6a5117200275249
  • Banks and Specialised Deposit-Taking Institutions Act, 2016 (Act 930)

    Legal text · PDF · 741.3 KB · 2016

    SHA-256 35da5f9d7b64show in full35da5f9d7b641f9d32cf798fa8323392642f6166d33ed63f94601e95c89e8ae1

Sources

Every page and document this return's facts were read from.

Knowing exactly what is collected, in what format and under which rules is the first step to real-time supervision. Line4 builds SupTech software for financial regulators that runs checks like these as each return arrives.

Line4's own text, and the way Line4 has collected and arranged these records, are free to reuse under CC BY 4.0. Please credit: “Source: Line4 regulatory submissions library (CC BY 4.0), https://www.line4.ai”. The facts themselves belong to no one. The regulators' document titles, template names, quoted terms and documents belong to them and are not covered by this licence: see BoG's reuse terms. This describes what regulators publish. It is not legal or regulatory advice: always rely on the regulator's own text. Not affiliated with or endorsed by any regulator.

Line4 wrote this page in its own words from the BoG's public website and links to the BoG's own pages as the source; the BoG has not reviewed or endorsed it, so always check the BoG's own published text before relying on it.

Last checked 13 November 2026.