Dubai regulator fines Moody's Middle East unit $585,825 after seven data disclosure incidents

The Dubai Financial Services Authority (DFSA), the regulator of the Dubai International Financial Centre (DIFC), has fined Moody's Investors Service Middle East Limited (MISMEL) USD 585,825, or AED 2,149,977, for breaches of data confidentiality rules. It announced the penalty on 28 October.

MISMEL has held a DFSA licence as a credit rating agency since 31 December 2012. The regulator found that it did not implement and maintain adequate systems and controls to keep data confidential, and that it did not make sure its employees kept confidential information private. From December 2023 to May 2026, the firm reported seven incidents of inadvertent data disclosure to the DFSA. In four of them, confidential data went to external recipients.

The DFSA named several causes. The firm stopped using a data security tool without an immediate replacement, its controls to prevent and detect breaches were inadequate, and its internal disciplinary processes for the employees involved were not effective.

MISMEL agreed to settle and received a discount for early settlement. Without it, the fine would have been USD 836,892. Alan Linning, the DFSA's Managing Director of Enforcement, said rating agencies are "entrusted by issuers with confidential and market-sensitive data" and must protect it. The DFSA has published the full Decision Notice on its website.