The Dubai Financial Services Authority has imposed a $585,825 (Dh2.149 million) fine on Moody’s Investors Service Middle East Limited for breaches involving the protection of confidential client information. The regulator said the credit rating agency did not maintain sufficient systems and controls to safeguard the data.

The DFSA, which regulates financial services in the Dubai International Financial Centre, said Moody’s Investors Service Middle East Limited, known as Mismel, also failed to ensure that its employees did not disclose confidential information.

Mismel agreed to settle the enforcement case at an early stage, qualifying for a reduction in the penalty. The DFSA said the fine would otherwise have been $836,892 (Dh3.07 million).

Seven reported incidents

Between December 2023 and May 2026, Mismel notified the regulator of seven incidents involving inadvertent disclosure of data. Four of those cases involved confidential information being sent to external recipients, according to the DFSA.

The regulator identified several factors behind the incidents. These included Mismel ending its use of a data-security tool before an immediate replacement was in place, as well as inadequate procedures to prevent and identify data breaches. The DFSA also cited internal disciplinary processes that it said were ineffective for employees responsible for the breaches.

Mismel has held a DFSA licence as a credit rating agency since December 31, 2012. The firm handles substantial amounts of sensitive and confidential information connected to customers including public and private companies, governments and other counterparties.

Importance of protecting market-sensitive information

Alan Linning, the DFSA’s managing director of enforcement, said credit rating agencies receive confidential and market-sensitive information from issuers as part of their rating work.

“They must ensure all such information is protected from unauthorised access or disclosure, which could harm the integrity, stability, and orderly functioning of financial markets,” Linning said.

He said the DFSA expects such businesses to have effective controls in place and to build a strong culture of data confidentiality among employees. “These measures are essential to safeguarding data integrity, maintaining investor confidence, and preserving trust in the financial services industry,” he said.

The DFSA said it would continue to develop, administer and enforce financial-services regulation within the DIFC, and would take enforcement action to ensure firms operating in the centre meet the required standards.