Speaking at the 43rd Annual General Meeting of the Ghana Association of Banks in Accra on Thursday, 8 October 2026, Bank of Ghana Governor Dr Johnson Pandit Asiama announced two things that matter to anyone who runs, supplies or supports IT for a bank:

  • The Bank of Ghana is developing a Directive on the Use of Artificial Intelligence in the Financial Sector.
  • The Bank intends to run thematic reviews of how banks are implementing the revised Cyber and Information Security Directive.

The AI directive is not out yet

Be clear about where this stands. The AI directive is still being developed. No draft text has been published, there is no date for it, and nothing in it is in force. Anyone telling you what it requires is guessing.

What the Governor did say is the direction:

  • AI can improve credit assessment, fraud detection, customer service, risk management and operational efficiency.
  • It also brings risks in data quality, model risk, cybersecurity and consumer protection.
  • The Bank's approach will "promote responsible experimentation and innovation" while ensuring governance "throughout the AI lifecycle".

That list of risks is a fair guide to what the final rules are likely to ask about. It is not a rulebook.

The cyber directive is in force, and reviews are coming

The revised Cyber and Information Security Directive (CISD) 2026 is already in place. The Governor launched it on 25 March 2026, replacing the first directive from 2018. At the launch he described its main pillars:

  • AI and machine learning governance: the existing directive already covers AI used for fraud detection, credit scoring and customer service, so AI is not waiting on the new directive to be regulated.
  • Cloud computing security: cloud is allowed for less critical, non-sensitive front-end services through an approved, risk-based framework. Databases holding personal and financial information must stay physically in Ghana, and the directive does not endorse moving core systems or sensitive data wholesale to the cloud.
  • Proportionality: requirements scale with an institution's size and risk profile.
  • Board-level accountability: at least one board member must have verifiable expertise in cyber risk management.
  • Wider oversight: the Financial Industry Command Security Operations Centre (FICSOC), the sector's computer emergency response team, is onboarding savings and loans companies, microfinance institutions and fintechs as well as banks.

At the AGM the Governor said cybersecurity, digital fraud, data protection, third-party dependencies, cloud computing and operational resilience are getting more supervisory attention, and that boards and senior management must treat cybersecurity and operational resilience as core business risks, not technology issues.

What a bank or fintech can do now

Thematic reviews look at how well a rule is applied, not only whether a policy exists. Before one arrives:

  • List your AI use. Credit scoring models, fraud rules, chatbots, AI features inside vendor software. Note who owns each one, what data it uses and how its decisions are checked. You cannot govern what you have not listed.
  • Map where your data lives. For every system that holds customer or financial data, know the physical location of the database. Cloud services that hold that data are a question for your compliance team now, not after a review.
  • Map your third parties. Which suppliers can reach your network, your data or your branches? Include the IT contractor, the CCTV installer, the ATM servicer and the software vendor's remote support.
  • Check what the board sees. Does cyber risk reach the board as a standing item, and does the board have the expertise the directive asks for?
  • Test incident response with suppliers in the room. A plan that assumes the vendor will answer the phone at 2:00 AM needs to be tested.

Our guide to online fraud in Ghana and our piece on deepfake and AI phishing scams cover the fraud side of the same risks.

What a supplier to banks should expect

If you supply IT, security or software to a bank, microfinance company or fintech, expect your client's review to reach you. Be ready to show:

  • Who on your team has access to the client's systems and how that access is controlled, logged and removed when someone leaves.
  • Where any client data you handle is stored, including backups and support tools.
  • How you keep the equipment you installed patched: firmware on cameras, recorders, door controllers, switches and firewalls, with dates.
  • What you do when something goes wrong: who you call, how fast, and what you hand over.

Branch CCTV, access control and network equipment are part of a bank's attack surface. A recorder with a default password or a door controller that has not been updated since installation is a finding waiting to happen.

How we help

Teknikal Ghana works with organisations across Ghana on the parts of this a review will look at on the ground: mapping systems and suppliers, network layout and access, and documentation through our IT consultancy service, and branch CCTV, access control and IoT through our security systems service.

Sources

  • Bank of Ghana, remarks by Governor Dr Johnson Pandit Asiama at the 43rd Annual General Meeting of the Ghana Association of Banks, Ecobank Auditorium, Accra, Thursday 8 October 2026, bog.gov.gh.
  • Bank of Ghana, remarks by Governor Dr Johnson Pandit Asiama at the launch of the Cyber and Information Security Directive (CISD), 25 March 2026, bog.gov.gh.
  • Ghana News Agency, "BoG develops AI rules for financial sector", 10 October 2026.
  • Graphic Online, "BoG cautions banks against complacency over economic recovery", 9 October 2026.