The Dubai Financial Services Authority (DFSA) has fined Moody’s Investors Service Middle East Limited $585,825 (AED2.15 million) for failing to protect confidential client data.
The regulator of the Dubai International Financial Centre (DIFC) said on Wednesday that the credit rating agency broke DFSA rules for rating agencies by failing to keep adequate systems and controls to safeguard confidential information, according to a statement. It also failed to ensure its employees did not disclose such information.
Between December 2023 and May 2026, the Moody’s unit reported seven incidents of inadvertent data disclosure to the DFSA. Four of them involved confidential data reaching external recipients.
The DFSA linked the incidents to several causes. The company stopped using a data security tool without immediately replacing it, its controls to prevent and detect data breaches were inadequate, and its disciplinary processes for staff responsible for breaches were ineffective.
The Moody’s unit agreed to settle the case and received a discount for early settlement. Without the discount, the fine would have been $836,892.
The company has held a DFSA license as a credit rating agency since December 31, 2012. It handles large volumes of sensitive data on public and private companies, governments and other counterparties.
“Credit Rating Agencies such as Moody’s Investors Service Middle East Limited are entrusted by issuers with confidential and market-sensitive data in relation to their rating activities,” said Alan Linning, managing director of enforcement at the DFSA.
Linning said rating agencies must protect such information from unauthorized access or disclosure, which could harm the integrity, stability and orderly functioning of financial markets.
The DFSA said full details of the case are set out in a decision notice published on its website.
 for data confidentiality breaches after seven incidents from 2023 to 2026.){kind=link}