The Dubai Financial Services Authority (DFSA) has fined Moody's Investors Service Middle East Limited Dh2.15 million ($585,825) for failing to protect confidential information handled by the credit rating agency's regional unit. The firm, authorised by the DFSA since 2012 to operate from the Dubai International Financial Centre, was found to have had inadequate systems in place to safeguard sensitive data belonging to corporate and government clients. seven separate breach incidents occurred between December 2023 and May 2026, including four cases in which confidential information was inadvertently disclosed to external recipients outside the company. Alan Linning, DFSA's Executive Director of Supervision, said information held by authorised firms must be protected from unauthorised access or disclosure, adding that this standard applies to every entity licensed within the Dubai International Financial Centre.
The penalty underscores a tougher stance by UAE financial regulators on data governance as Dubai continues to position itself as a leading regional financial hub. Moody's, one of the world's three dominant credit rating agencies, plays a significant role in assessing sovereign and corporate risk across the Gulf region, making the fine notable beyond its relatively modest size.
Analysts say the case is likely to prompt other DIFC-licensed firms to review their internal data-handling protocols, particularly around how confidential client and government information is shared with parties outside the organisation.