DFSA imposes $585,825 penalty on Moody’s Middle East for client data leaks

The Dubai Financial Services Authority (DFSA) has fined Moody’s Investors Service Middle East Limited (Mismel) $585,825 (Dh2.149 million) for failing to safeguard confidential client information, the regulator announced on Wednesday.

Fine imposed for data leaks

The DFSA, which oversees the Dubai International Financial Centre (DIFC), determined that the credit rating agency violated rules applicable to such firms. Moody’s failed to put in place and maintain adequate systems and controls to protect data confidentiality, and did not ensure its employees refrained from disclosing confidential information.

Mismel agreed to settle the matter and received a discount for early settlement. Without the discount, the DFSA would have imposed a fine of $836,892 (Dh3.07 million).

Repeated incidents over several years

Between December 2023 and May 2026, Moody’s Investors Service Middle East reported seven incidents of inadvertent data disclosure to the regulator. Four of those incidents involved confidential data being sent to external recipients.

The DFSA said the breaches occurred for several reasons, including the company discontinuing the use of a data security tool without immediately replacing it; inadequate systems and controls to prevent and detect data breaches; and ineffective internal disciplinary processes for employees responsible for the breaches.

Mismel has been licensed by the DFSA as a credit rating agency since 31 December 2012. It handles a large volume of highly sensitive and confidential information relating to its customers, including public and private companies, governments and other counterparties.

Regulator stresses importance of confidentiality

Alan Linning, managing director of enforcement at the DFSA, said credit rating agencies are entrusted by issuers with confidential and market-sensitive data for their rating activities.

“They must ensure all such information is protected from unauthorised access or disclosure, which could harm the integrity, stability, and orderly functioning of financial markets,” he said.

He added that the DFSA requires such firms to establish effective systems and controls and to foster a strong culture of data confidentiality among their employees. “These measures are essential to safeguarding data integrity, maintaining investor confidence, and preserving trust in the financial services industry,” he said.

The DFSA said it remains committed to developing, administering and enforcing world-class regulation of financial services within the DIFC, and will continue to take enforcement action to ensure all entities operating in the Centre adhere to required standards.