Logs Are Not Evidence: Digital Forensics Readiness as a Product Requirement in Ghana's Mobile Money and Digital Channel Architecture

CISD 2026, the Bank of Ghana's revised cyber directive, expects every regulated institution to already have forensic capability built in. Every cyber response team must include a digital forensics expert. Every incident requires a forensic study, organised for legal purposes, not just an incident report. Logging must meet a retention standard tied to the Electronic Transactions Act, 2008 (Act 772). Ghana's own forensic infrastructure has not caught up to that expectation. The most detailed academic assessment available, now six years old, found digital forensics in Ghana still at an infant stage: legislation scattered across statutes, no accreditation body for forensic labs (Apau & Koranteng, 2020). A modernised police forensic lab, highlighted in October 2025, suggests some catch-up is happening, though whether it closes the specific gaps that the 2020 study identified is untested. For Ghana's mobile money and digital channel product teams, that gap is not abstract. It means forensic readiness cannot wait to be discovered the moment a fraud dispute lands. Software engineering research already has a name for closing this gap early: forensic readiness, designed into a system rather than assembled after an incident (Rowlingson, 2004; Pasquale et al., 2018). This paper argues Ghana's mobile money and digital channel platforms should be built to that standard, using ISO/IEC 27037's identification, collection, acquisition, and preservation processes as the technical baseline. Technical soundness is not the whole answer, though. Ghana's own digital-evidence admissibility scholarship treats legal admissibility as a separate, still-developing question from technical integrity (Antwi-Boasiako & Venter, 2017). A composite case shows what happens when a platform has logs but not, in the full sense, evidence. The paper closes with a practical checklist and a research agenda.