Dubai: DFSA fines Moody’s Middle East unit $585,825 over data leaks
Dubai’s DFSA fines Moody’s Middle East unit USD 585,825 after the rating agency reported seven data disclosures, four of them to outside recipients.
Photo: Dubai Financial Services Authority
Moody’s Investors Service Middle East Limited (MISMEL) has been ordered to pay a USD 585,825 (AED 2,149,977) penalty for failing to keep client data confidential, the Dubai Financial Services Authority (DFSA) said in a statement on Wednesday, October 28.
That figure already includes a discount the company secured by agreeing to settle early. Had MISMEL not settled, the regulator said, the fine would have reached USD 836,892.
The sanction follows seven inadvertent data disclosures that the firm itself reported to the DFSA between December 2023 and May 2026. In four of those cases, confidential information reached external recipients.
The DFSA, which oversees banking, financial services and markets in the Dubai International Financial Centre (DIFC), said the firm breached its rules governing credit rating agencies on two counts. Its systems and controls for protecting data confidentiality were neither adequate nor properly maintained, and it failed to prevent staff from disclosing confidential information.
Several causes were behind the incidents, according to the regulator, among them MISMEL’s decision to stop using a data security tool without putting an immediate replacement in place. The DFSA also pointed to weak safeguards for preventing and detecting breaches, and to disciplinary procedures against the employees at fault that proved ineffective.
MISMEL has held a DFSA licence as a credit rating agency since December 31, 2012. Its work involves large volumes of highly sensitive data on clients ranging from governments to public and private companies and other counterparties.
Alan Linning, Managing Director, Enforcement, at the DFSA, said issuers hand rating agencies confidential, market-sensitive information as part of the rating process. He added:
“They must ensure all such information is protected from unauthorised access or disclosure, which could harm the integrity, stability, and orderly functioning of financial markets.”
The DFSA has published a Decision Notice with the full details of the case on its website.
