Dubai Regulator Fines Moody’s Middle East Unit Over Confidential Data Disclosures

Key Takeaways

• $585,825 Penalty: The Dubai Financial Services Authority fined Moody’s Investors Service Middle East Limited for failing to adequately protect confidential information and prevent employee disclosures.
• Seven Disclosure Incidents: Between December 2023 and May 2026, the company reported seven inadvertent data disclosures, four of which involved confidential information reaching external recipients.
• Inadequate Security Controls: The regulator identified deficiencies in breach prevention and detection, the discontinuation of a data security tool without an immediate replacement, and ineffective employee disciplinary processes.
• Early Settlement Discount: Moody’s Middle East unit agreed to settle the matter, reducing its penalty by approximately 30% from $836,892 to $585,825.
• Credit Rating Agency Obligations: The DFSA emphasized that credit rating agencies must maintain effective safeguards for confidential and market-sensitive information entrusted to them by issuers.

Deep Dive

Moody’s Investors Service Middle East reported seven incidents of inadvertent data disclosure to Dubai’s financial regulator over a period of nearly two and a half years. Four involved confidential information reaching recipients outside the company. During that period, the credit rating agency had discontinued using a data security tool without immediately replacing it.

The Dubai Financial Services Authority (DFSA) fined the company $585,825 on October 28, finding that it had failed to maintain adequate controls to protect confidential information and ensure employees did not disclose it.

The company, known as MISMEL, has been licensed by the DFSA since December 31, 2012. Its credit rating activities involve handling sensitive information belonging to companies, governments and other counterparties, including material that is not publicly available.

Between December 2023 and May 2026, MISMEL notified the regulator of seven inadvertent disclosure incidents. The DFSA attributed the incidents to several shortcomings, including inadequate systems for preventing and detecting breaches and ineffective internal disciplinary processes for employees responsible for them.

It also identified the company's decision to discontinue a data security tool without an immediate replacement. The regulator did not name the tool, explain why it was withdrawn or specify how long the company operated without it.

The announcement provided no details about the external recipients or the confidential information disclosed. It also did not identify any resulting financial harm.

The DFSA found that MISMEL had breached rules applicable to credit rating agencies by failing to implement and maintain adequate systems and controls to safeguard confidential information and ensure that employees did not disclose it.

Failures in Data Protection Controls

Credit rating agencies routinely receive information that issuers have not made public. Financial projections, business plans and other sensitive records can inform their assessments, making confidentiality an important obligation for firms entrusted with such material.

The DFSA's findings focused on inadvertent disclosures, rather than allegations of deliberate information sharing. The regulator nevertheless concluded that MISMEL's controls were inadequate.

Alan Linning, the DFSA's managing director of enforcement, said credit rating agencies must protect confidential and market-sensitive information entrusted to them by issuers.

"They must ensure all such information is protected from unauthorised access or disclosure, which could harm the integrity, stability, and orderly functioning of financial markets," Linning said.

He also emphasized the need for effective internal controls and a workplace culture that reinforces employees' responsibility to protect confidential information.

The findings covered both the technical systems intended to protect data and the company's handling of employee breaches. The DFSA cited deficiencies in prevention and detection alongside ineffective disciplinary processes, although it did not provide details of individual incidents or employee actions.

Settlement Reduces Penalty by 30%

MISMEL agreed to settle the matter and received an early settlement discount of approximately 30%. Without the discount, the DFSA said it would have imposed a penalty of $836,892. The settlement reduced the fine by $251,067 to $585,825 (AED 2,149,977).

The regulator did not disclose whether MISMEL had completed remedial measures or introduced replacement security technology. The DFSA said it would continue taking enforcement action to ensure firms operating in the Dubai International Financial Centre comply with its regulatory requirements.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey