DUBAI, 28th October, 2026 (WAM) -- The Dubai Financial Services Authority (DFSA), the independent banking, financial services, and markets regulator of Dubai International Financial Centre (DIFC), has imposed a financial penalty of USD 585,825 (AED 2,149,977) on Moody’s Investors Service Middle East Limited (MISMEL) for data confidentiality breaches.
MISMEL has been licensed as a Credit Rating Agency by the DFSA since 31 December 2012. As such, it handles a large volume of data, including highly sensitive and confidential information relating to its customers, including public and private companies, governments, and other counterparties.
The DFSA found that MISMEL contravened DFSA Rules applicable to Credit Rating Agencies by failing to implement and maintain adequate systems and controls to safeguard data confidentiality; and ensure that its employees did not disclose confidential information.
Between December 2023 and May 2026, MISMEL reported to the DFSA seven incidents of inadvertent data disclosures, four of which involved confidential data being disclosed to external recipients. The DFSA considers that the incidents occurred for a number of reasons, including, but not limited to, MISMEL discontinuing the use of a data security tool without an immediate replacement; inadequate systems and controls to prevent and detect data breaches; and ineffective internal disciplinary processes for the employees responsible for data breaches.
MISMEL agreed to settle this matter and received a discount for early settlement. Were it not for this discount, the DFSA would have imposed a fine of USD 836,892 on MISMEL.
Alan Linning, Managing Director, Enforcement, at the DFSA, said, "Credit rating agencies such as Moody’s Investors Service Middle East Limited are entrusted by issuers with confidential and market-sensitive data in relation to their rating activities. They must ensure all such information is protected from unauthorised access or disclosure, which could harm the integrity, stability, and orderly functioning of financial markets.
The DFSA requires credit rating agencies to establish and maintain effective systems and controls to protect confidential and market-sensitive data and to foster a strong culture of data confidentiality among their employees. These measures are essential to safeguarding data integrity, maintaining investor confidence, and preserving trust in the financial services industry."
The DFSA remains committed to developing, administering, and enforcing world-class regulation of financial services within DIFC. As part of its ongoing mission, the Authority will continue to take appropriate enforcement action and provide regulatory clarity to ensure that all entities operating within the Centre adhere to the standards required under the DFSA’s regulatory framework.
A copy of the Decision Notice setting out full details of this matter can be found in the Decision Notices section of the DFSA website.