Arabian Post Staff -Dubai
The Dubai Financial Services Authority (DFSA) announced the action on Wednesday, saying the credit rating agency had breached rules requiring adequate systems and controls to protect sensitive data and prevent employees from disclosing confidential information.
Moody’s Middle East reported seven incidents of inadvertent data disclosure between December 2023 and May 2026. Four involved confidential information reaching external recipients, the regulator said, highlighting weaknesses in safeguards governing information entrusted to the agency during its rating activities.
The authority identified several contributing factors, including the discontinuation of a data security tool without an immediate replacement. It also found shortcomings in arrangements designed to prevent and detect breaches, alongside ineffective internal disciplinary procedures for employees responsible for disclosures.
The company agreed to settle the enforcement matter at an early stage and received a reduction in its financial penalty. Without that settlement discount, the DFSA would have imposed a fine of $836,892, equivalent to approximately Dh3.07 million.
The announced penalty amounts to $251,067 less than the undiscounted figure, reflecting the regulator’s settlement arrangements. The DFSA did not specify in its public announcement the identities of external recipients or the particular confidential records disclosed in the four incidents.
The findings concern the company’s obligations as a regulated credit rating agency rather than the accuracy of its credit assessments. The DFSA identified breaches of confidentiality requirements and failures in internal controls, without alleging in its announcement that the information disclosures had altered any published ratings.
Alan Linning, the DFSA’s managing director of enforcement, said rating agencies receive confidential and market-sensitive information from issuers and have a responsibility to protect it against unauthorised access or disclosure.
“They must ensure all such information is protected from unauthorised access or disclosure, which could harm the integrity, stability, and orderly functioning of financial markets,” Linning said in the regulator’s statement.
He emphasised that safeguards must extend beyond technical protections to include effective organisational practices and employee conduct. The regulator expects firms to establish and maintain appropriate controls and encourage a culture in which the confidentiality of information is consistently respected.
The DFSA said these requirements were necessary to safeguard data integrity and preserve confidence in financial services. Its action illustrates the regulatory significance of inadvertent disclosures, even where the published findings do not establish deliberate misuse of the information concerned.
Moody’s Investors Service Middle East Limited has held a licence from the DFSA to operate as a credit rating agency since 31 December 2012. The company handles substantial volumes of confidential information associated with its clients and counterparties, including public companies, privately owned businesses and governments.
Such information may be provided to a rating agency in the course of assessing an issuer’s creditworthiness. The DFSA’s rules require agencies operating under its supervision to maintain measures that protect material received through those activities from unauthorised disclosure.
The enforcement findings covered incidents reported by the company itself over a period spanning more than two years. The regulator’s statement did not identify a single disclosure as the sole basis for the penalty, instead describing deficiencies across systems, preventive controls and employee disciplinary processes.
The discontinuation of the security tool was one of the specific weaknesses highlighted by the authority. The announcement did not identify the software involved or state precisely how long the company operated without an immediate replacement, leaving those operational details unspecified in the public account.
Likewise, the regulator did not publish in its announcement a breakdown of the seven incidents by date, affected client or category of information. It distinguished the four disclosures involving external recipients from the overall number of inadvertent incidents notified during the review period.
The DFSA is responsible for regulating banking, financial services and markets within the Dubai International Financial Centre. Its supervisory framework includes specific requirements for credit rating agencies, whose activities can involve information that is not available to the wider market.
The authority said a decision notice setting out full details of the matter was available through its regulatory actions section. It also reiterated that regulated firms operating within the financial centre must comply with all applicable standards governing the handling of sensitive information.
Also published on Medium.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
