Dubai Regulator DFSA Fines Moody's Middle East Over Leaks Of Confidential Client Data

(MENAFN- Khaleej Times) The Dubai Financial Services Authority (DFSA) has fined Moody's Investors Service Middle East Limited (Mismel) $585,825 (Dh2.149 million) for data confidentiality breaches, the regulator announced on Wednesday.

The DFSA, the independent regulator of the Dubai International Financial Centre (DIFC), found that the credit rating agency contravened rules applicable to such firms. It failed to implement and maintain adequate systems and controls to safeguard data confidentiality, and did not ensure its employees refrained from disclosing confidential information.

Recommended For You

Mismel agreed to settle the matter and received a discount for early settlement. Without the discount, the DFSA would have imposed a fine of $836,892 (Dh3.07 million).

Between December 2023 and May 2026, Moody's Investors Service Middle East reported seven incidents of inadvertent data disclosure to the regulator. Four involved confidential data being disclosed to external recipients.

The DFSA said the incidents occurred for several reasons, including the company discontinuing the use of a data security tool without an immediate replacement; inadequate systems and controls to prevent and detect data breaches; and ineffective internal disciplinary processes for employees responsible for the breaches.

Sensitive client data

Mismel has been licensed by the DFSA as a credit rating agency since December 31, 2012. It handles a large volume of highly sensitive and confidential information relating to its customers, including public and private companies, governments and other counterparties.

Alan Linning, managing director, enforcement, at the DFSA, said credit rating agencies are entrusted by issuers with confidential and market-sensitive data for their rating activities.

“They must ensure all such information is protected from unauthorised access or disclosure, which could harm the integrity, stability, and orderly functioning of financial markets,” he said.

He added that the DFSA requires such firms to establish effective systems and controls and to foster a strong culture of data confidentiality among their employees.“These measures are essential to safeguarding data integrity, maintaining investor confidence, and preserving trust in the financial services industry,” he said.

The DFSA said it remains committed to developing, administering and enforcing world-class regulation of financial services within the DIFC, and will continue to take enforcement action to ensure all entities operating in the Centre adhere to required standards.

MENAFN28102026000049011007ID1111878129