Dubai's financial regulator, the DFSA, has fined Moody's Investors Service Middle East roughly Dh2.15 million after finding the credit rating agency failed to properly safeguard confidential client information over a period of more than two years. the firm, which operates out of the Dubai International Financial Centre, inadvertently disclosed confidential client data on seven separate occasions between December 2023 and May 2026. In four of those incidents, the information reached recipients outside the company altogether. The DFSA attributed the breaches to weaknesses in the firm's internal controls, including the discontinuation of certain security tools without adequate replacements and insufficient disciplinary action against staff involved.
Alan Linning, the DFSA's managing director of enforcement, said credit rating agencies carry a particular responsibility to keep confidential information secure, warning that lapses of this kind can undermine the integrity and stability of financial markets more broadly.
The final penalty reflects a discount for early settlement and cooperation with the regulator; the fine would otherwise have been closer to Dh3.07 million. Moody's Middle East has held a DIFC operating licence since December 2012, and the case ranks among the more significant enforcement actions the DFSA has taken against a credit rating agency in recent years.