DFSA Fines Moody’s Middle East Dh2.15 Million Over Data Breaches

The Dubai Financial Services Authority (DFSA) has fined Moody’s Investors Service Middle East Limited Dh2.15 million for shortcomings in its systems to protect confidential information.

The regulator said the credit rating agency failed to maintain adequate safeguards against the unauthorised disclosure of sensitive data.

The case highlights the importance of strong information security practices across the financial services sector.

The company agreed to settle the matter, receiving a reduction in the penalty.

Seven Data Disclosure Incidents Identified

Between December 2023 and May 2026, the company reported seven incidents involving the accidental disclosure of information to the regulator.

Four of these cases involved confidential data being shared with external recipients.

The DFSA found that the firm’s systems and controls were not sufficient to prevent or detect such incidents effectively.

The disclosures raised concerns about how sensitive information was handled and protected within the organisation.

Weaknesses in Internal Security Measures

The regulator identified several factors behind the incidents, including the discontinuation of a data security tool without an immediate replacement.

It also found gaps in the company’s ability to prevent and identify data breaches, along with weaknesses in internal disciplinary procedures for employees responsible for security failures.

The findings underline the need for businesses to maintain effective monitoring systems and clear accountability measures when handling confidential information.

Confidential Data Is Critical to Financial Markets

Moody’s Investors Service Middle East Limited has held a credit rating agency licence from the DFSA since December 31, 2012.

Its work involves handling sensitive information about public and private companies, governments and other counterparties.

The regulator stressed that credit rating agencies must protect information entrusted to them from unauthorised access or disclosure.

Such safeguards are important for maintaining market integrity, investor confidence and trust in financial services.

Settlement Reduces the Financial Penalty

The fine was set at $585,825, equivalent to Dh2.15 million, after an early settlement discount.

Without the reduction, the penalty would have been $836,892, according to the regulator.

The case serves as a reminder that financial firms must regularly review their data protection systems and respond promptly when security gaps emerge.

Strong confidentiality controls are essential for organisations that manage market-sensitive information and operate within regulated financial markets.