DFSA penalizes credit rating agency after seven inadvertent data breaches, four involving external disclosures.
DUBAI, Oct 28 : The Dubai Financial Services Authority has fined Moody’s Investors Service Middle East Limited $585,825 (Dh2.15 million) after an investigation revealed systemic failures in the credit rating agency’s internal confidentiality controls, leading to repeated inadvertent data disclosures over a 29-month period.
The Dubai Financial Services Authority (DFSA) announced the financial penalty following a probe into how Moody’s Investors Service Middle East handled sensitive corporate and sovereign files between December 2023 and May 2026.
During that period, Moody’s notified the watchdog of seven separate incidents where confidential data leaked unintentionally. Four of those disclosures reached outside recipients.
Moody’s agreed to settle the enforcement matter at an early stage, which qualified the firm for a settlement reduction. Without that discount, the DFSA stated the fine would have reached $836,892 (Dh3.07 million).
The regulatory inquiry found clear operational lapses in the firm’s data infrastructure. Moody’s had decommissioned a key data security application without deploying an immediate replacement, leaving a vulnerability in its data handling environment. The watchdog also pointed to absent controls required to intercept and trace data leaks, combined with weak internal disciplinary procedures for staff involved in the breaches.
Moody’s has held a DFSA credit rating agency licence since December 31, 2012, operating from the Dubai International Financial Centre (DIFC). Its operational mandate requires processing voluminous, highly confidential datasets involving government entities, publicly traded corporations, and private counterparties.
Alan Linning, Managing Director of Enforcement at the DFSA, said rating agencies carry a strict regulatory duty to shield non-public data from exposure.
“Credit Rating Agencies such as Moody’s Investors Service Middle East Limited are entrusted by issuers with confidential and market-sensitive data in relation to their rating activities,” Linning said. “They must ensure all such information is protected from unauthorised access or disclosure, which could harm the integrity, stability, and orderly functioning of financial markets.”
Linning added that market institutions must maintain airtight controls while enforcing an internal corporate culture that treats confidential records with absolute diligence to preserve investor confidence across regional capital markets.
The watchdog noted that the complete regulatory findings and directives are published in an official decision notice on its enforcement registry.
