Ghana's Banks Need Board Approval Before Touching Quantum Computing. The Migration Clause Next to It Names No Algorithm.

Ghana's central bank wrote two binding clauses about quantum computing into the same directive. One tells banks what outcome they're responsible for. The other tells them who has to sign off before they even start using the technology. Neither tells them what algorithm actually solves the problem.

Two clauses, two different kinds of obligation

The Bank of Ghana's Cyber and Information Security Directive (CISD), dated March 2026, is binding on Regulated Financial Institutions (RFIs) -- Ghana's banking sector under BoG supervision. Part IX, "Cryptographic Key Management," Section 42.4.b, states directly:

"RFI shall monitor developments in cryptanalysis and update cryptographic algorithms to remain resilient against evolving threats, including quantum advancements."

That's a binding, present-tense, outcome-based obligation -- "shall," not "should" or "is encouraged to." It names quantum computing explicitly as one of the threats institutions must track and respond to.

A separate clause, Part XVII, "Digital Innovations," Section 98.1, imposes a different kind of requirement entirely:

"An RFI considering the adoption of digital innovations such as Blockchain, AI, Virtual Assets, Quantum Computing, and Robotics shall present the adoption to the Board prior to implementing the technology."

Here, quantum computing sits alongside blockchain, AI, and robotics as an emerging technology requiring board-level governance before adoption -- the Board must discuss the risks and grant preliminary approval. That's a governance gate, not a migration requirement, and it applies to adopting quantum computing as a capability, not to migrating away from quantum-vulnerable cryptography.

Two real, binding, verbatim clauses, doing two structurally different jobs, both naming quantum computing directly in a single regulatory document -- a combination that's rare on this tracker.

What neither clause specifies

Here's the gap: the cryptographic-monitoring clause binds RFIs to an outcome -- "remain resilient against evolving threats, including quantum advancements" -- without naming which algorithm achieves that outcome. No ML-KEM, no ML-DSA, no FIPS reference. An institution reading this directive knows it's legally required to end up quantum-resilient, and knows nothing from the text itself about what quantum-resilient cryptography to actually deploy.

That's a different kind of gap than "no deadline" (which several countries on this tracker share) or "no inventory requirement" (same). It's closer to Kuwait's CORF or Nigeria's CRF-NCS, both of which bind regulated entities to a quantum-resistance outcome without a government-endorsed algorithm shortlist -- Ghana joins a pattern where several of the strongest binding mandates on this tracker are, paradoxically, also the vaguest about implementation.

The monitoring clause is also difficult to satisfy honestly without an inventory. "Monitor developments in cryptanalysis and update cryptographic algorithms" implies ongoing knowledge of which algorithms an institution currently runs -- but the CISD doesn't name a cryptographic inventory or CBOM requirement to formalize that knowledge.

What to do with this

If you're a Bank of Ghana-regulated institution, both clauses are already binding -- there's no future deadline to point to as "not yet." The board-approval requirement is the more concrete near-term action: any live or planned quantum-computing initiative needs to go through the Board before implementation, not after. The cryptographic-resilience obligation is the harder, ongoing one, precisely because the directive gives you an outcome to hit without a map for hitting it.

The practical first step is the same one this gap always points back to: a real, current inventory of which cryptographic algorithms your institution actually runs, so "remain resilient against evolving threats" is something you can demonstrate rather than assert.

The Ghana country page tracks the directive with its primary source.