Does Ghana have a post-quantum cryptography (PQC) law?

Partially. The rule is binding for a specific regulated subset, not the whole economy. The issuing body is Bank of Ghana (BoG).

What is Ghana's PQC migration deadline?

None. No migration deadline has been published for Ghana by any regulator we checked, including Bank of Ghana (BoG).

Does Ghana require a Cryptographic Bill of Materials (CBOM)?

Implicitly. The sources imply organizations will need a cryptographic inventory to comply, without naming CBOM as a formal requirement.

GHRegulated

Ghana

Ghana's Bank of Ghana Cyber and Information Security Directive (March 2026) binds regulated financial institutions to monitor cryptanalysis developments and update algorithms against quantum threats, and requires Board-level review before adopting quantum computing technologies, but sets no deadline and no explicit CBOM mandate.

Ghana's post-quantum cryptography posture is classified as regulated, led by Bank of Ghana (BoG). It scores 40/100 on this tracker's rubric, a moderately binding rule, with real gaps in scope or enforcement, and that is not a measure of how secure or advanced the country actually is.

What's verified

The Bank of Ghana's Cyber and Information Security Directive (CISD), dated March 2026 and binding on Regulated Financial Institutions (RFIs), requires (under Part IX, "Cryptographic Key Management," §42.4.b) that "RFI shall monitor developments in cryptanalysis and update cryptographic algorithms to remain resilient against evolving threats, including quantum advancements." It separately requires (Part XVII, "Digital Innovations," §98.1) that "An RFI considering the adoption of digital innovations such as Blockchain, AI, Virtual Assets, Quantum Computing, and Robotics shall present the adoption to the Board prior to implementing the technology," with the Board discussing risks and deciding on preliminary approval. Both quotes are verbatim from the source. Minor note: in the source PDF the key-management sentence ends "...managed in line with the national encryption." (an apparently truncated clause in the original document) rather than a complete "national encryption policy," so the claim's bracketed "[policy]" is a reasonable editorial completion, not a verbatim document phrase.

Score rationale

Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.

Axis	Score	Why
Mandate strength	10/20	The CISD is a binding directive from Bank of Ghana on 'Regulated Financial Institutions' (RFIs) requiring key management and quantum-resilience monitoring, but this obligation applies only to the banking/financial sector, not economy-wide, so it scores as binding-for-a-subset (10).
Deadline concreteness	0/20	No specific year or phased timeline is given anywhere in the quoted evidence: the directive only requires RFIs to 'monitor developments' and 'update cryptographic algorithms' on an ongoing basis with no target date stated (0).
Scope of coverage	10/20	The directive binds only 'Regulated Financial Institutions' under Bank of Ghana oversight, i.e., a specific regulated sector (banking), not all critical infrastructure or the whole economy (10).
Inventory/CBOM requirement	10/20	No explicit cryptographic inventory or CBOM is named; however §42.4.b's requirement to 'monitor developments in cryptanalysis and update cryptographic algorithms' and manage keys 'in line with the national encryption [policy]' plainly implies institutions must know/track their cryptographic assets, functioning as an implied general risk-assessment obligation (10).
Regulatory activity	10/20	Bank of Ghana is a named authority with a published binding directive (CISD) and a Board pre-approval mechanism (§98.1) for adopting technologies including Quantum Computing, but no explicit fines, audit regime, or certification enforcement mechanism is quoted in the evidence for cryptographic/quantum non-compliance specifically (10).
Total	40/100	A blunt sum of the five columns to its left.

Related regulators

Sector bodies checked independently, not assumed from the primary source above.

National Communications Authority (NCA)
Not yet addressed, a gap to watch
No circular, directive, or advisory addressing PQC or cryptographic inventory was found for Ghana's telecom regulator.
Cyber Security Authority (CSA) Ghana
In progress, no guidance yet
No PQC-specific publication exists, but a draft Cybersecurity (Amendment) Bill, 2025 (public consultation through mid-November 2025) would give CSA statutory authority to "establish standards for certifying the security of innovative products... quantum computing..." and formally defines "quantum computing" in law. This treats quantum computing as one of several emerging technologies requiring future certification standards; it is not a PQC migration mandate, timeline, or algorithm standard, and no such standard has been published yet.
Cybersecurity (Amendment) Draft Bill, 2025 →

FAQ: Ghana and PQC

Does Ghana have a post-quantum cryptography (PQC) law?: Partially. The rule is binding for a specific regulated subset, not the whole economy. The issuing body is Bank of Ghana (BoG).
What is Ghana's PQC migration deadline?: None. No migration deadline has been published for Ghana by any regulator we checked, including Bank of Ghana (BoG).
Does Ghana require a Cryptographic Bill of Materials (CBOM)?: Implicitly. The sources imply organizations will need a cryptographic inventory to comply, without naming CBOM as a formal requirement.