Ghana

Section 35(1)(b) requires a company to keep a register of beneficial owners; a member who is not the beneficial owner must give the particulars and update them within 28 days of a change (s. 35(2)). The company must file entries with the Registrar within 28 days, indicating politically exposed persons (s. 35(6)). False or missing information is an offence (s. 35(14)).

Section 31(2) requires notice to both the Commission and the data subject as soon as reasonably practicable after discovery of a security compromise; section 31(4) allows delay where security agencies or the Commission say notification would impede a criminal investigation.

Sections 27 and 46 require data controllers to register with the Commission before processing personal data, and section 46 establishes the Data Protection Register. Section 56 makes processing without registration an offence, punishable by a fine of up to 250 penalty units, up to two years' imprisonment, or both. The DPC site says all data controllers and processors must register.

Section 49 requires accountable institutions to adopt and implement internal policies, procedures and programmes covering internal controls, staff screening, ongoing training and independent audit, and to make them available to the FIC or supervisor on request. Section 50 requires ongoing staff training and a managerial-level Anti-Money Laundering Reporting Officer with access to books, records and staff; section 51 provides an administrative penalty for failure. The 2025 Bank of Ghana/FIC guideline (s. 2.3.4) sets the officer at a minimum of senior management grade, sitting on the highest management decision-making body and reporting to the Board or a Board committee.

Section 32(3) requires records to be kept for not less than five years, counted from the end of the business relationship for identity and correspondence records, from the transaction date for transaction records, and from the date of the report for suspicious transaction and cash reports. Under s. 32(7), records pass to the Public Records and Archives Administration Department when the period ends.

Section 30 prohibits anonymous and fictitious-name accounts and requires due diligence when establishing a business relationship, on certain occasional transactions including wire transfers, on suspicion of money laundering or terrorist financing, and when earlier customer data is doubtful. Due diligence must be ongoing. Institutions must identify politically exposed persons and report unusual transactions to the Centre within 24 hours; a wire transfer lacking originator information is refused and reported.

Section 38 requires an accountable institution that knows or reasonably suspects that property is proceeds of unlawful activity to report to the Centre within twenty-four hours, and the duty covers attempted transactions (s. 38(3)). Section 38(4) prohibits tipping off. The 2025 Bank of Ghana/FIC guideline (ss. 2.4.6, 2.7.1) repeats the 24-hour rule.

Non-bank bodies need a payment system licence (s. 7); dedicated e-money issuers must be limited liability companies with a customer float account at a holding bank (s. 23). E-money funds are held in trust and kept separate from the issuer's funds (s. 23(b)), the float must be backed one for one by unencumbered liquid assets reconciled daily (s. 36), and funds sit in accounts with banks in Ghana (s. 37). Licences last five years (s. 27).

Section 39 requires owners of critical information infrastructure to report a cybersecurity incident within 24 hours of detection to the relevant sectoral CERT or, if none applies, the National CERT, and to arrange an audit of the infrastructure and send the report to the Authority. Section 47(5) separately requires any person in charge of an institution to report incidents within 24 hours.