Dubai regulator fines Moody’s Middle East unit Dh2.15 million

Dubai: The Dubai Financial Services Authority (DFSA) has fined Moody’s Investors Service Middle East Limited $585,825 (Dh2.15 million) for failing to adequately protect confidential information.

The regulator said the credit rating agency had insufficient systems and controls to safeguard data confidentiality and failed to ensure that employees did not disclose confidential information.

Between December 2023 and May 2026, the company reported seven incidents of inadvertent data disclosures to the DFSA. Four involved confidential data being disclosed to external recipients.

Moody’s Investors Service Middle East Limited agreed to settle the matter and received an early settlement discount. Without that discount, the fine would have been $836,892, the regulator said.

Gaps in data protection

The DFSA identified several reasons for the incidents, including the company discontinuing a data security tool without immediately replacing it.

The regulator also found inadequate systems and controls to prevent and detect data breaches, alongside ineffective internal disciplinary processes for employees responsible for breaches.

The company has held a DFSA credit rating agency licence since December 31, 2012. Its work involves handling large volumes of information, including highly sensitive and confidential data concerning public and private companies, governments and other counterparties.

The DFSA, which regulates financial services in the Dubai International Financial Centre, said the company’s failings breached rules applicable to credit rating agencies.

Market-sensitive information

Alan Linning, Managing Director, Enforcement, at the DFSA, said credit rating agencies have a responsibility to protect information entrusted to them.

“Credit Rating Agencies such as Moody’s Investors Service Middle East Limited are entrusted by issuers with confidential and market-sensitive data in relation to their rating activities,” he said.

“They must ensure all such information is protected from unauthorised access or disclosure, which could harm the integrity, stability, and orderly functioning of financial markets.”

Linning said agencies must maintain effective systems and controls and build a strong culture of data confidentiality among employees to safeguard data integrity, investor confidence and trust in financial services.

The DFSA said the full details of the case are set out in a decision notice available through the regulatory actions section of its website.