Dubai Regulator Slaps Moody's Middle East Unit with Dh2.15 Million Fine for Data Security Lapses

The Dubai Financial Services Authority (DFSA) has imposed a significant penalty of $585,825 (Dh2.15 million) on the Middle East division of Moody's Investors Service. This fine stems from the unit's failure to adequately protect confidential information over a period exceeding two years.

Moody's Investors Service Middle East Limited (Mismel), which has held a license from the DFSA since 2012, was found to have violated regulations applicable to credit rating agencies. The breaches involved seven instances of unintentional data disclosure occurring between December 2023 and May 2026, as confirmed by the DFSA on Wednesday. An investigation revealed that Mismel lacked sufficient systems and controls to safeguard confidential data and prevent unauthorized disclosures by its employees.

The DFSA highlighted that Mismel handles a substantial volume of sensitive and confidential data belonging to its clients, which include public and private companies, governments, and other counterparties. Among the seven violations, four specifically involved the inadvertent disclosure of confidential data to external parties.

Alan Linning, managing director for enforcement at the DFSA, emphasized the critical nature of protecting such information. "Credit rating agencies… are entrusted by issuers with confidential and market-sensitive data in relation to their rating activities," he stated. "They must ensure all such information is protected from unauthorised access or disclosure, which could harm the integrity, stability and orderly functioning of financial markets."

This action is part of a broader effort by UAE authorities to enforce regulatory compliance and maintain the integrity and reliability of the Emirati financial system. Recent enforcement actions by the DFSA include a $210,000 fine against former financier Gary Joseph Peters for providing misleading information and failing to produce documents, a $454,367 penalty on Hayman-Woodward Global Mobility Services' Dubai unit for operating without authorization for over six years, and a Dh401,000 penalty on Vault Wealth for conducting unauthorized transactions.

Other regulatory bodies in the UAE, such as Abu Dhabi's ADGM and the Central Bank of the UAE, have also taken disciplinary actions against firms for regulatory breaches. Mr. Linning reiterated the importance of these measures, stating, "Measures to regulate financial services in the UAE… are essential to safeguarding data integrity, maintaining investor confidence and preserving trust in the financial services industry."