Moody’s Middle East Fined by DFSA

Moody’s Investors Service Middle East Limited was fined USD 585,825 (AED 2,149,977) by the Dubai Financial Services Authority (DFSA), which found it failed to protect confidential data. The DFSA announced the fine yesterday. The conduct period ran from December 2023 to May 2026. In that period the firm reported seven inadvertent disclosures (accidental releases of information) to the regulator, four of them sending confidential data to external recipients.

The firm has held a DFSA licence as a credit rating agency, a firm that grades borrowers’ creditworthiness, since 31 December 2012. The DFSA, which regulates firms in the Dubai International Financial Centre (DIFC), the Dubai free zone, found the firm broke its rules for credit rating agencies in two ways. It did not implement and maintain adequate systems and controls, the internal processes and tools that prevent failures, to safeguard data confidentiality. It also did not ensure its employees refrained from disclosing confidential information.

The DFSA named three causes, “including, but not limited to” these. The firm discontinued a data security tool without an immediate replacement. Its systems and controls were inadequate to prevent and detect data breaches. And its internal disciplinary processes for the employees responsible were ineffective.

The firm settled early and received an early settlement discount, a reduction in the fine for agreeing the case quickly. Without it the fine would have been USD 836,892, which works out as a discount of about 30 per cent. The notice records that the firm reported the incidents to the DFSA. It records no remediation steps.

Alan Linning, Managing Director, Enforcement at the DFSA, tied the case to what rating agencies hold:

Credit Rating Agencies such as Moody’s Investors Service Middle East Limited are entrusted by issuers with confidential and market-sensitive data in relation to their rating activities. They must ensure all such information is protected from unauthorised access or disclosure, which could harm the integrity, stability, and orderly functioning of financial markets.

Alan Linning, Managing Director, Enforcement, DFSA

For compliance and risk teams at DIFC firms, the causes the DFSA named point to two checks: whether any data-loss or security tool has been retired without an immediate replacement, and whether staff who cause accidental disclosures face a disciplinary process that works.

Sources: DFSA press notice