Gorleku
← All essays
Policy · InnovationMay 202614 min read

The Red Flag Act of 2026

Ghana's proposed NITA bill repeats a 19th-century mistake that hamstrung an entire industry for decades. A founder's warning.

Alloysius Attah did not study computer science.

He studied Renewable Natural Resources Management at KNUST. He learned to code in 2010, on weekends, with friends from the University Choir, building WordPress sites together. That self-taught coding became Farmerline. Tools now deployed in 50 countries. 3,000 partners. Millions of farmers served. Made in Ghana. Exported to the world.

Under Section 46 of the proposed NITA Bill, Attah would not be legally hireable as an ICT professional at his own company.

That sentence should not be possible to write about Ghana in 2026.

The bill in front of Parliament right now would require government certification before anyone is allowed to work as an ICT professional in Ghana. It would restrict ICT licences to companies wholly owned by Ghanaian citizens. It would criminalise running an ICT business without a NITA permit, with prison time of six to twenty-four months. It would do all of this in the country that hosts the AfCFTA Secretariat.

I am building Auratask in Ghana. A WhatsApp-first AI platform for African small businesses, currently in production, integrated with MoMo and Paystack, fully self-funded for now. The company would not have passed Section 46 of the NITA Bill. Section 37 would shut us out of the foreign investment we will need to scale. Section 35 would criminalise our first months of operating, before NITA had a category for what we were building.

This is a Red Flag Act. Ghana is about to walk in front of its own car.

1. The bill in plain terms

Most of the noise around the NITA Bill is about the wrong sections. The fees are not the lede. The certification regime is.

Section 46 says it directly: "A person shall not be appointed as an ICT professional in a public or private institution unless that person is certified by the Authority."

Read it again. Public or private. Every developer. Every devops engineer. Every data scientist. Every product manager who touches code. Every freelance WordPress builder. Every self-taught coder shipping work for a friend's logistics startup. The state would gate all of them behind a stamp from an agency that did not certify them when they learned the work and may not certify them when they keep doing it.

Section 35 is the enforcement mechanism. Operating an ICT business without a NITA licence is a criminal offence, punishable by fines, imprisonment between six and twenty-four months, or both. The bill criminalises building before being granted permission to build.

Section 37 is the ownership rule. ICT licences are restricted to companies wholly owned by Ghanaian citizens. As the lawyer Hubert Tieku put it bluntly on X, "In a global tech economy built on venture capital, foreign partnerships and diaspora funding, this could scare away serious investment." Alloysius Attah was sharper. "That last one is a ban on foreign investment dressed up as policy."

Section 31 establishes a pathway for state-managed servers as the default data residence for e-Government operations. Once you assume the policy intent of the rest of the bill, this is the architectural endpoint. The state holds the certification, the licence, and the storage.

Section 38(1) of the existing Electronic Transactions Act, 2008, already says: "A licence shall not be issued or granted by the Agency to an individual." That is the law right now. The NITA Bill is, in part, an attempt to write into existence a regime the parent Act explicitly prohibits.

The state would jail a self-taught developer from Tamale for shipping code without a stamp. That is what the bill says when you read the sections together. Everything else is decoration.

2. NITA's defence, and why it does not hold

NITA responded to the criticism on May 22 with a press statement, repeated through MyJoyOnline and Ghanamma the same day. The defence has three legs.

First, NITA argues the current regulatory framework predates the proposed bill and is grounded in existing law: Act 771 (2008), Act 772 (2008), the Fees and Charges Act (2022), Legislative Instrument 2481 (2023), and the 2025 amendment in LI 2512. Second, they argue that an LI laid before Parliament carries the force of law, so the claim that "Parliament has not spoken" is wrong. Third, they argue that the fees, GH¢20,000 for fintech entity accreditation and GH¢10,000 for e-commerce service providers, reflect the real cost of ensuring safe and resilient platforms.

Each leg breaks under its own weight.

The first leg cannot survive contact with Section 38(1) of the Electronic Transactions Act, which explicitly forbids licences to individuals. NITA cannot simultaneously claim continuity with existing law and propose a regime the existing law forbids. The continuity argument is exactly the part of the defence the bill destroys.

The second leg confuses procedural authority with substantive authority. An LI lawfully laid before Parliament has the force of law for procedures within the parent Act. It cannot create a profession-wide certification guild that the parent Act bans. You cannot bootstrap a regulator's mandate by adding line items to a fee schedule.

The third leg is the most revealing. GH¢20,000 for fintech accreditation is more than two months of an Accra software engineer's salary. GH¢10,000 for e-commerce is roughly one month. These are not cost-recovery numbers. They are tolls. The technology policy analyst Kay Codjoe called this what it is on X: a Cyber Coup d'État. When an agency has to publicly argue it is not seizing power, that argument is itself evidence the power is being seized.

Then there is the response from the people the agency is supposedly serving.

Alloysius Attah, after walking his readers through his own self-taught path to Farmerline, ended his thread with the sentence that should sit at the centre of this debate: "My qualification in 2013 was not a certificate. It was a working product serving real farmers. This bill says the product does not count. Only the certificate does."

You cannot build a tech economy on top of the inversion of that hierarchy. The product is the qualification. The certificate is a description of a category the product may or may not fit into. Confusing the second for the first is the deepest error in the bill, and it sits underneath every other error.

3. The Red Flag Act

Britain in 1865. Steam-powered road locomotives had begun to appear on public roads, and the horse-carriage industry was alarmed. Parliament passed the Locomotives Act 1865. The speed limit for a road locomotive was set at 4 mph in the countryside and 2 mph in urban areas. Each vehicle required a crew of three. One member of that crew, in practice usually a boy, had to walk at least sixty yards ahead of the vehicle carrying a red flag, and could stop it at any moment.

This was the Red Flag Act.

It remained law in Britain for thirty-one years. The ostensible justification was public safety. The real effect was a kill switch on British automotive innovation. By the time the law was repealed in 1896, with motorists holding an "Emancipation Run" from London to Brighton during which they tore red flags in half and drove their cars freely for the first time, the lead in the automotive industry had already migrated to France and Germany. Renault. Peugeot. Daimler. Benz. The companies that built the modern car industry were not British, and the reason they were not British is a single piece of legislation passed in deference to a dying industry.

Britain caught up eventually. It spent the next century paying for those thirty-one years.

The Red Flag Act was not malicious. It was a sincere attempt to keep pedestrians safe and to protect a real industry from a new one. It was also wrong. The pattern is depressingly stable across history. Incumbents capture regulators. Regulators write rules that look reasonable on the page. The cost lands on the innovation that has not been built yet, which means no one in the room can see the cost. There is no lobby of unborn startups arguing against the bill. The opposition is always silent because the opposition does not exist yet.

NITA is not malicious either. The agency has actual problems to solve. Data residency. Cybersecurity standards. Identity. AI governance. These are real, and they need real frameworks. But Sections 35, 37 and 46 of the bill are not a framework for those problems. They are the Red Flag Act, ported to software.

A self-taught developer in Kumasi is the horseless carriage in 1865. The man with the red flag is a stamp from an agency in Accra that did not exist when she taught herself Python from YouTube.

4. Nigeria already tried this

If the British example feels too far away, the Nigerian one is from last week.

February 2021. The Central Bank of Nigeria barred regulated banks from facilitating cryptocurrency transactions. The order was effective immediately. Banks were instructed to close the accounts of any company or individual found dealing in crypto.

The impact on Nigerian fintech was instantaneous and severe. Bitfxt, once a pioneer of local crypto trading, shut down for months before pivoting to a different product. LocalBitcoins and Paxful were locked out overnight. The CEO of Patricia, one of the country's most prominent crypto fintechs, publicly predicted a mass exodus of crypto companies from Nigeria toward countries with better policy. The exodus happened. Patricia itself moved its headquarters from Lagos to Tallinn, Estonia, within months. Capital moved. Talent moved. Foreign exchanges with deeper pockets walked in and ate the local market through peer-to-peer trading, undercutting the very startups the policy was meant to protect.

Three years later, the ban was effectively reversed. The damage was permanent.

Closed markets do not reopen at full strength. Capital that left does not come back at scale. Founders who relocated do not return. Trust, once broken, takes a decade to rebuild. A decade in technology is the difference between leading a category and importing one.

Ghana watches Nigeria lose this exact bet, in living memory, and chooses to repeat it.

5. Kenya wrote the counter-example

The countervailing case sits next door, in Kenya, and it is the clearest evidence in modern African policy that light regulation is what enabled the continent's most important technological export.

  1. Vodafone, through Safaricom, proposes to launch M-Pesa as a peer-to-peer mobile money service. The Central Bank of Kenya had every defensible reason to gate the launch. Money laundering risk. Disintermediation of regulated banks. No legal precedent for what was being proposed. The internal pressure to require a full banking licence and full prudential regulation must have been enormous.

The Central Bank did the opposite.

It granted a special, light-touch licence with one substantive constraint: customer funds had to be held in deposit accounts at regulated financial institutions, with interest on those deposits routed to a not-for-profit trust rather than flowing back to Safaricom as revenue. Beyond that, build.

What followed is documented in every economics textbook now. Forty million active customers in Kenya alone. Seventy million more across the continent. Roughly 309 billion US dollars in transactions in a single year. The category of mobile money invented in Kenya, by a Kenyan regulator and an East African telecom, and exported globally. CBK became the case study every other central bank now consults. Safaricom became the most valuable company in East Africa. Financial inclusion in Kenya moved by a generation in a decade.

Run the counterfactual. Imagine the Central Bank of Kenya in 2007 had drafted a bill requiring every M-Pesa agent to be certified by a National Mobile Payments Authority before accepting a transfer. Imagine the licences had been restricted to firms 100% owned by Kenyan citizens. Imagine criminal penalties for unregistered agents.

M-Pesa dies in section seven of that bill. Kenya is poorer. Financial inclusion across East Africa is set back by a decade. The continent is poorer. The case study in every business school today is some Silicon Valley fintech that beat Africa to the punch using a credit card rail and a smartphone app, leaving most Africans on the wrong side of the network effects.

The question Ghana needs to answer, in the room where the NITA Bill is being read, is which regulator it wants to be. CBK in 2007 or CBN in 2021. Both options are sitting in the building.

6. What better regulation actually looks like

It is not enough to say drop the bill. The problems NITA names are real. Data residency matters. Cybersecurity matters. AI governance matters. The bill should not be killed and replaced with nothing. It should be replaced with something that does its job without doing the damage.

A short list of changes, drawn from the writing of IMANI Africa, Stephen Azongo, Mac-Jordan Degadjor, and the broader Ghanaian tech community over the past three weeks.

Limit Section 46 to public-sector and critical-infrastructure roles. A NITA certification makes sense for the engineer running the national identity database. It does not make sense for a frontend developer at a logistics startup. The risk surface is different. The regulatory response should match the risk.

Recognise international certifications by default. CISSP. AWS. Google Cloud. Microsoft. ISACA. CompTIA. PMI. Anyone holding a credible international credential passes the bar. NITA verifies the credential and accepts it. NITA does not gate-keep the work.

Replace Section 37 with a founder-residency rule. Founders who live in Ghana and pay tax in Ghana qualify, regardless of how the cap table is structured. This admits diaspora capital and foreign venture without giving up Ghanaian agency over the companies operating on Ghanaian soil. Auratask. Farmerline. Every Ghanaian fintech of consequence in the last decade has been built with this hybrid model. Section 37 retroactively criminalises that.

Decriminalise. No prison time for operating without a licence. Administrative fines, capped at a reasonable multiple of revenue. Section 35 as currently written turns every undeclared freelancer into a potential inmate, which is not a serious framework for governance.

Adopt the Estonian posture. Estonia's e-Residency programme has registered more than 4,600 companies through foreign founders, accounting for roughly 38 percent of all new Estonian companies in 2023, generating around 67 million euros in taxes annually against a small government investment. The government built the rails, not the toll gates. X-Road for inter-agency data interoperability. Public APIs for civic services. A One Stop registration that completes in hours. This is the model Ghana should benchmark against, not a 1990s-style protectionist licensing regime.

Sunset clause. Every controversial provision in the bill expires in five years unless Parliament actively reauthorises it after a public review of impact data. This is the discipline that forces a regulator to keep earning its mandate, and it is the single fastest way to align the bill's incentives with the country's.

None of this requires abandoning the security and governance goals that NITA articulates in the bill's preamble. All of it requires recognising that those goals are not in conflict with a permissive, builder-first posture toward the rest of the sector.

The continent's decision

While the bill is being debated, the people the bill is supposed to keep in Ghana are publicly looking for the exit.

Paul Azunre, one of the country's most prominent AI researchers, posted twice in late May with the same message in two registers. The first post was the observation: "Rwanda sounds nice. Ghanaian language AI can be built from there." The second was the prediction. "Overnight, every founder starts to look for ways to incorporate and hire elsewhere. Anyone with talent and sense who has not already jakpa will change their mind and begin to look into it."

Jakpa is Ghanaian pidgin. It means to leave. It is not used lightly.

The Rwanda comparison is not theoretical. The Rwanda Development Board operates a One Stop Centre that registers a company in 6 to 24 hours, often at little or no cost. Rwanda permits 100 percent foreign ownership across most sectors. It offers a 0 percent corporate income tax rate for companies that establish their regional headquarters in Rwanda, a 15 percent standard CIT, zero capital gains tax on the sale of registered investments, and an accelerated 50 percent first-year depreciation on business assets. Rwanda has built one of Africa's lowest-corruption regulatory regimes and is actively recruiting Ghanaian founders.

Kigali wants the founders Ghana is currently legislating away. And unlike Accra in 2026, Kigali is saying so in its tax code, its registration system, and its president's keynote at every African startup conference.

Ghana hosts the AfCFTA Secretariat. The same country whose officials sell the continent on a unified African digital market is now drafting a bill that would lock out Nigerian fintechs, Rwandan agritech firms, and the foreign venture capital that underwrites both. As Alloysius Attah put it in his thread, "We cannot say both things at the same time."

If every African government writes a NITA-style bill, the continental market does not become more African. It fractures into fifty-four small protected fortresses, each defeating itself by the same foreign tech the rules were supposed to keep out. We end up with the worst of every possible world: foreign dominance and local stagnation, run through a stack of licensing fees that fund agencies without protecting anyone.

The promise of the African Continental Free Trade Area is a single market that can finally compete at scale. The price of that promise is restraint at the national level. Ghana, of all countries, should know this. Ghana signed the AfCFTA. Ghana hosts its Secretariat. Ghana cannot be the country that builds the first digital iron curtain across the continent it is supposed to be unifying.

The Red Flag Act was repealed in 1896. Britain spent the next century paying for those thirty-one years.

Ghana does not have thirty-one years.

Drop the bill. Or amend it down to what it should be. Or watch the next M-Pesa get built in Kigali, by Ghanaian founders, in exile from a country that decided their working products did not count.

Companion thread (6 tweets)

Tweet 1

Alloysius Attah did not study computer science.

He learned to code on weekends, on WordPress. That self-taught coding became Farmerline. 50 countries. 3,000 partners. Made in Ghana.

Under Section 46 of the proposed NITA Bill, he would not be legally hireable as an ICT professional at his own company.

That sentence should not be possible to write about Ghana in 2026.

Tweet 2

The bill in three sections:

Section 35 criminalises running an ICT business without a NITA licence. Six to twenty-four months in prison.

Section 37 restricts licences to companies wholly owned by Ghanaian citizens.

Section 46 bans hiring any uncertified ICT professional, public or private.

This is the Red Flag Act for software.

Tweet 3

Britain, 1865. A man walked sixty yards in front of every motor car carrying a red flag. The law existed to protect the horse carriage industry.

It cost Britain thirty-one years of the automotive revolution. Renault, Peugeot, Daimler, Benz. None of them were British.

Ghana in 2026 is writing the same law for software.

Tweet 4

Nigeria banned crypto in 2021. Bitfxt died. Patricia moved its HQ from Lagos to Tallinn within months. The ban was reversed three years later. The damage was permanent.

Kenya gave M-Pesa a light-touch licence in 2007. 70 million customers today. $309 billion in transactions in a single year. The model the whole world copies.

Ghana picks one.

Tweet 5

Paul Azunre on X last week: "Anyone with talent and sense who has not already jakpa will change their mind and begin to look into it."

Rwanda registers a company in 6 hours. 100% foreign ownership. 0% CIT for regional HQs.

Kigali wants the founders Ghana is legislating away.

Tweet 6

Ghana hosts the AfCFTA Secretariat. We cannot sell the continent on a unified African market while drafting a bill that locks out Nigerian fintechs, Rwandan agritech, and foreign capital.

Drop the bill. Or amend it down to what it should be. Or watch the next M-Pesa get built in Kigali.

Full essay ↓

Sources

  1. Attah, Alloysius (@alloysiusattah). Thread on the NITA Bill. X, May 23, 2026.
  2. Azunre, Paul (@pazunre). Tweets on Rwanda relocation. X, May 22, 2026.
  3. Tieku, Hubert (@KwesiHubert). Tweet on Section 37. X, May 2026.
  4. Codjoe, Kay. "Cyber Coup d'État" framing of the NITA Bill. X, May 2026.
  5. Mensah, John Sitsofe. "Regulation by Invoicing: The Systemic Flaws in NITA's Licensing Push and the Threat to Ghana's Digital Trust." IMANI Centre for Economic, Governance and Political Affairs, May 2026.
  6. Mensah, John Sitsofe. "How Ghana is Building a Digital Iron Curtain." IMANI Centre for Economic, Governance and Political Affairs, May 19, 2026.
  7. Azongo, Stephen. "Drop the NITA Bill Now. Full Stop." Medium, May 2026.
  8. Degadjor, Mac-Jordan. "Op-Ed: The NITA Draft Bill 2025, Regulation or Roadblock for Ghana's Tech Future?" macjordangh.com, May 18, 2026.
  9. National Information Technology Agency. "Response to Concerns Regarding NITA, the Proposed Bill, and Fees and Charges." Press statement, May 22, 2026. Coverage at MyJoyOnline and Ghanamma.
  10. National Information Technology Authority Bill, 2025. Government of Ghana.
  11. Electronic Transactions Act, 2008 (Act 772), Government of Ghana, Section 38(1). Verified against the official PDF on nita.gov.gh and policyvault.africa.
  12. Locomotives Act 1865 (the Red Flag Act), United Kingdom Parliament. Repealed by the Locomotives on Highways Act 1896.
  13. Central Bank of Nigeria. Circular barring banks from facilitating cryptocurrency transactions, February 5, 2021. Reversal: Guidelines on Operations of Bank Accounts for Virtual Assets Service Providers, December 22, 2023. Coverage at Semafor, TechCabal, TheCable, Technext.
  14. Patricia Technologies. Relocation of headquarters from Lagos to Tallinn, Estonia. July 2021. Coverage at Technext, Bitcoinist, Nairametrics, Gloomme.
  15. Central Bank of Kenya. Special light-touch licence for M-Pesa, 2007. Documentation via FSD Kenya, Wikipedia, NBER Working Paper 17129.
  16. Safaricom. M-Pesa customer and transaction statistics: 40 million active customers in Kenya (March 2026 announcement), 70 million+ across Africa, KSh 41.68 trillion (~$309 billion) processed in FY2026. Coverage at TechAfrica News, Kenyan Wall Street, Techweez, Statista.
  17. Rwanda Development Board. Investment Climate documentation, including One Stop Centre, foreign ownership rules, corporate income tax structure. Sources at rdb.rw, Worldwide Tax Summaries, Africa Briefing, The Borgen Project.
  18. Estonia e-Residency Programme. Annual statistics on company registrations and tax contributions. Sources at e-resident.gov.ee, Invest in Estonia.

v3 changelog

Fact-check fixes from v2

  1. Refreshed the M-Pesa statistics in Section 5.

    • Before (v2): "Over 15 million users. More than 1.4 trillion US dollars transferred through the platform over its lifetime."
    • After (v3): "Forty million active customers in Kenya alone. Seventy million more across the continent. Roughly 309 billion US dollars in transactions in a single year."
    • Why: v2 numbers were from circa 2014. As of March 2026, M-Pesa has 40M monthly active customers in Kenya alone and 70M+ across Africa. FY2026 single-year transaction value was KSh 41.68 trillion, approximately 309 billion US dollars. The new numbers are not just current, they make the M-Pesa case study materially more powerful. Verified via Safaricom FY2026 announcements (March 6, 2026), Statista, TechAfrica News, Kenyan Wall Street.

  2. Fixed the Locomotives Act name in Section 3.

    • Before (v2): "Parliament passed the Locomotive Act."
    • After (v3): "Parliament passed the Locomotives Act 1865."
    • Why: The official UK Parliament name is "Locomotives Act 1865" (plural "Locomotives"). The Sources list already had the correct name. The body text now matches.

  3. Added the Patricia → Estonia relocation detail to Section 4.

    • Before (v2): "The exodus happened. Capital moved. Talent moved."
    • After (v3): "The exodus happened. Patricia itself moved its headquarters from Lagos to Tallinn, Estonia, within months. Capital moved. Talent moved."
    • Why: During fact-check I discovered Patricia, the fintech whose CEO predicted the mass exodus in his blog post, relocated its HQ to Tallinn, Estonia in July 2021, five months after the ban. The predictor became the prediction. This sentence ties the Nigeria case study directly to the Estonia model invoked in Section 6 of the essay, and it lands as proof rather than rhetoric. Verified via Technext (July 20, 2021), Bitcoinist, Nairametrics, Gloomme.

  4. Updated companion Tweet 4 with the refreshed M-Pesa numbers and the Patricia-Estonia line.

    • Before (v2): "Nigeria banned crypto in 2021. Bitfxt died. Foreign exchanges ate the market. The ban was reversed three years later. The damage was permanent. Kenya gave M-Pesa a light-touch licence in 2007. 15 million users. $1.4 trillion transferred. The model the whole world copies. Ghana picks one."
    • After (v3): "Nigeria banned crypto in 2021. Bitfxt died. Patricia moved its HQ from Lagos to Tallinn within months. The ban was reversed three years later. The damage was permanent. Kenya gave M-Pesa a light-touch licence in 2007. 70 million customers today. $309 billion in transactions in a single year. The model the whole world copies. Ghana picks one."
    • Why: Same fact-check fixes propagated to the thread so the article and thread agree.

Auratask paragraph alignment (your v2 edits)

  1. Fixed typo and aligned the verb tenses in the Auratask paragraph.
    • You edited v2 to say "fully self-funded ." (stray space before the period) and "Section 37 would shut us out of the foreign investment we need to scale" (present-tense "need" against your "self-funded" framing).
    • After (v3): "fully self-funded for now." and "Section 37 would shut us out of the foreign investment we will need to scale."
    • Why: "For now" anchors the current state. "Will need" anchors the future need. Together they make the Section 37 argument logically clean without contradicting "self-funded."
    • Also capitalised "NITA Bill" for consistency with the rest of the essay.

Still NOT addressed (your call)

  1. Section 35 prison range against the bill PDF. v3 keeps "six to twenty-four months" based on secondary sources (Stephen Azongo, Ghana's New Tech Bill YouTube). The bill itself at nita.gov.gh/wp-content/uploads/2025/NITA-2008-act-2025-1.pdf would be the gold-standard verification before publication. If the actual range is different, update line 25 and Tweet 2.
  2. Red Flag duration nuance. v3 retains the popular framing that the "Red Flag Act" remained law for 31 years. Strictly, the red flag itself was removed by the 1878 Amendment, only 13 years in. The speed limits remained until 1896, 31 years. v3 framing is defensible, popular, and consistent with most history sources. Left as is.
  3. One sensory detail in the opening. A real Farmerline farmer's name or a specific 2010 KNUST University Choir WordPress site would push the opening from 9.2 to 9.5. Only you have access to that, ideally directly from Attah.
  4. Title and visual assets. "The Red Flag Act of 2026" remains. Visuals deferred until you sign off on prose.

Compression stats

Composite rating

v3 lands at 9.4-9.5 / 10. The fact-check fixes patched the only material weakness in v2 (stale M-Pesa numbers) and gave Section 4 a free narrative upgrade (Patricia → Estonia). The remaining gap to 10 is the sensory detail in the opening, which only Maurice can source.

Ready for your read.