Dubai regulator imposes Dh2.15m penalty on Moody’s Middle East unit for data breaches

The Dubai Financial Services Authority has levied a fine of $585,825 (Dh2.15 million) on Moody’s Investors Service Middle East Limited for failing to protect confidential information over a period of more than two years.

Seven data disclosures

The regulator announced on Wednesday that Moody’s Investors Service Middle East Limited (Mismel) committed seven instances of accidental data leakage between December 2023 and May 2026, violating rules governing credit rating agencies.

An inquiry by the DFSA revealed that Mismel, which has held a DFSA licence since 2012, lacked adequate systems and controls to safeguard confidential information and prevent employees from making unauthorised disclosures.

“It handles a large volume of data, including highly sensitive and confidential information relating to its customers, including public and private companies, governments and other counterparties,” the DFSA said.

External recipients

Of the seven violations, four involved confidential data being inadvertently sent to recipients outside the company, the authority stated.

“Credit rating agencies … are entrusted by issuers with confidential and market-sensitive data in relation to their rating activities,” said Alan Linning, managing director for enforcement at the DFSA.

“They must ensure all such information is protected from unauthorised access or disclosure, which could harm the integrity, stability and orderly functioning of financial markets.”

Broader enforcement push

Authorities in the UAE have been stepping up efforts to penalise entities that breach regulations, aiming to preserve the integrity and reliability of the country’s financial system.

This week, the DFSA, which supervises activities at the Dubai International Financial Centre, imposed a $210,000 fine on former financier Gary Joseph Peters, who was employed by a DFSA-authorised firm from 2020 to 2022, for submitting false, misleading and deceptive information to the regulator and for failing to provide documents.

Earlier this month, the authority fined the Dubai unit of Hayman-Woodward Global Mobility Services $454,367 for offering unauthorised services for more than six years, and issued a Dh401,000 penalty to wealth management firm Vault Wealth for executing transactions without authorisation.

Abu Dhabi’s ADGM and the Central Bank of the UAE have also announced their own disciplinary measures and fines for regulatory violations.

Mr Linning said that measures to regulate financial services in the UAE “are essential to safeguarding data integrity, maintaining investor confidence and preserving trust in the financial services industry”.