DFSA fines Moody’s Middle East ratings unit $585,825 over confidentiality failures

The Dubai Financial Services Authority announced a $585,825 penalty against Moody’s Investors Service Middle East Limited on 28 October for failing to protect confidential information. The action concerns the credit rating agency licensed in the Dubai International Financial Centre.[1]

The firm reported seven inadvertent disclosures to the DFSA between December 2023 and May 2026, four involving external recipients. The regulator found weaknesses in preventive and detective controls and in disciplinary processes for employees responsible for breaches.[1]

The first example in the decision predates that reporting window: on 12 October 2023, a draft sovereign-rating announcement was sent to an external recipient before publication.[2]

The gap in the email control

The decision says an email-security tool was removed on 31 May 2024 and a replacement introduced in July 2025. The original tool had compatibility limitations, including with newer Outlook and some other environments. Relevant internal stakeholders were not told of its removal until December 2024.[2]

All seven incidents came to light through reports from employees: four from those responsible and three from colleagues. The DFSA found excessive reliance on self-reporting. Retrospective email monitoring did not prevent an incorrect message being sent, and two further incidents were reported despite remediation.[2]

Why an email-address error matters to a ratings firm

The applicable confidentiality rule requires credit rating agencies to control how information is used as well as to whom it is disclosed. Pending rating actions may be shared with the rating subject, or as agreed with it. Other permitted disclosures depend on the original purpose, prior written consent or a legal obligation.[3]

The rule separates authorised discussion during a rating process from disclosure to an unintended recipient. Confidential material remains restricted by the purpose and permissions under which the agency received it.[3]

Settlement and the final amount

The firm settled. The DFSA said the penalty would otherwise have been $836,892.[1]

The 26 October decision specifies a 30% settlement discount and MISMEL’s agreement not to seek Financial Markets Tribunal review. Its findings concern MISMEL alone.[2]

Report an error or submit an update