DFSA Fines Moody's Middle East AED 2.15m Over Confidential Data Failures

The Dubai Financial Services Authority (DFSA) has imposed a financial penalty of AED 2.15 million on Moody's Investors Service Middle East Limited following a series of incidents involving the unauthorised disclosure of confidential information.

Announced on 28 October 2026, the enforcement action follows findings that the credit rating agency failed to maintain adequate systems and controls to protect sensitive data entrusted to it by clients and counterparties.

Between December 2023 and May 2026, the company reported seven incidents of inadvertent data disclosure to the regulator. Four involved confidential information being disclosed to external recipients.

The case highlights the importance of effective information security, employee accountability and operational Risk Management for organisations handling commercially sensitive information in the UAE.

What Did the DFSA Find?

Moody's Investors Service Middle East Limited has operated as a DFSA-licensed credit rating agency within the Dubai International Financial Centre (DIFC) since December 2012.

Its activities involve handling information relating to public and private companies, governments and other counterparties. Some of this material is confidential or commercially sensitive.

Following its review, the DFSA concluded that the company had breached regulatory requirements applicable to credit rating agencies by failing to implement adequate safeguards and prevent unauthorised disclosures by employees.

The regulator identified several weaknesses contributing to the incidents:

• Discontinuation of a data security tool without immediately implementing a replacement.
• Inadequate systems and controls for preventing and detecting data disclosure incidents.
• Ineffective internal disciplinary processes relating to employees responsible for the incidents.

The DFSA imposed a penalty of USD 585,825, equivalent to AED 2,149,977.

Moody's Investors Service Middle East Limited agreed to settle the matter and received an early settlement discount. Without that reduction, the regulator stated that the financial penalty would have been USD 836,892.

The published findings concern failures in data confidentiality safeguards and inadvertent disclosures. They do not establish that the incidents resulted from an external cyberattack or deliberate corporate espionage.

Why Confidential Corporate Information Requires Stronger Protection

Organisations operating within financial services, professional advisory, investment management and other information-intensive sectors regularly handle data that could have significant commercial value.

This may include confidential financial statements, investment proposals, business forecasts, corporate transactions and information concerning clients or counterparties.

Unauthorised disclosure can create consequences extending beyond the immediate loss of confidentiality.

Depending on the circumstances, exposed information may affect commercial negotiations, business relationships, regulatory obligations and organisational reputation.

The risks are particularly relevant where information is shared between different departments, external advisers, service providers and international offices.

Protecting sensitive information therefore requires more than restricting access to computer systems.

Businesses must also understand how information moves through their organisation, who can access it and whether existing safeguards remain effective as working practices and technology change.

The Moody's Middle East case demonstrates that information security weaknesses can arise from ordinary operational decisions, including changes to security tools and failures to maintain adequate oversight.

The Risks of Removing Security Controls Without Replacement

One of the most significant findings concerned the discontinuation of a data security tool without an immediate replacement.

Businesses regularly introduce, upgrade and retire technology as part of normal operations.

However, removing an established security measure can create gaps if its protective functions are not properly understood or replaced.

For example, a system may have been responsible for detecting unusual data transfers, restricting the sharing of sensitive documents or alerting administrators to potentially unauthorised activity.

Removing such functionality without effective alternative controls may reduce an organisation's ability to identify and prevent information security incidents.

Before making significant changes, organisations should assess:

• The information and systems protected by the existing control.
• The potential consequences of removing or replacing the technology.
• Whether equivalent safeguards will remain operational.
• How employees will be affected by changes to established procedures.
• Whether monitoring and incident detection capabilities remain adequate.
• Who is responsible for approving and reviewing the change.

These considerations form part of wider Cyber Security governance and operational Risk Management.

For organisations handling confidential client information, maintaining appropriate controls is particularly important during periods of digital transformation, system migration or restructuring.

Employee Awareness and Internal Accountability

The DFSA also identified weaknesses involving employee disclosures and internal disciplinary processes.

While sophisticated external cyber threats attract considerable attention, sensitive business information can also be exposed through mistakes, inadequate procedures or failures to follow established security requirements.

Employees may inadvertently send documents to incorrect recipients, share information through unsuitable communication channels or disclose material without recognising its confidentiality.

These risks cannot be addressed through technical measures alone.

Organisations need clear procedures explaining how sensitive information should be classified, accessed, transmitted and retained.

Appropriate training should ensure employees understand their responsibilities and can identify situations where additional approval or verification is required.

Internal accountability is equally important.

Where a disclosure occurs, the organisation should establish what happened, assess the information involved and determine whether existing procedures were followed.

A proportionate response may include reviewing technical controls, identifying training requirements and examining whether management oversight was sufficient.

The objective should be to reduce the likelihood of similar incidents while distinguishing genuine mistakes from deliberate misconduct.

Why Data Confidentiality Is a Corporate Risk Management Issue

Information security is sometimes treated primarily as a technical responsibility delegated to IT departments.

However, the consequences of a confidentiality failure can affect an organisation at a much broader level.

Senior management may need to consider financial exposure, contractual obligations, regulatory expectations and the confidence of clients who have entrusted the business with sensitive information.

This makes data protection an important component of corporate Risk Management.

Effective oversight requires organisations to identify which information presents the greatest exposure and assess whether existing safeguards are appropriate.

A structured review may consider the sensitivity of information held, the systems used to process it, employee access arrangements and the involvement of external service providers.

It may also examine whether significant technology changes are subject to adequate approval and whether security incidents are documented and reviewed.

Conflict Advisory Group provides Risk Management Services to organisations operating in the UAE, helping businesses assess vulnerabilities, understand operational exposures and develop proportionate measures to improve resilience.

A broader approach can assist management teams in identifying weaknesses that may not be apparent when security responsibilities are considered in isolation.

How Cyber Security Assessments Can Help

Where an organisation identifies concerns about confidential information, an appropriately scoped Cyber Security assessment can provide greater visibility over its technical safeguards.

The assessment may examine user access permissions, data-sharing arrangements, system configurations, monitoring capabilities and procedures for managing security incidents.

Depending on the organisation's systems and objectives, relevant areas may include:

• Reviewing access to confidential documents and sensitive systems.
• Assessing controls governing external data transfers.
• Identifying technical vulnerabilities and configuration weaknesses.
• Evaluating employee access management and authentication.
• Reviewing logging, monitoring and incident detection arrangements.
• Assessing procedures for replacing or retiring security technology.
• Identifying opportunities to improve incident response planning.

The findings can support management decisions about which weaknesses require attention and how improvements should be prioritised.

Conflict Advisory Group provides Cyber Security Services for UAE organisations, including vulnerability assessments, security reviews, incident response planning and specialist technical support.

These services can help businesses understand their security position and identify measures appropriate to their operations and information-handling requirements.

What Does the Enforcement Action Mean for UAE Businesses?

The DFSA's action concerns specific regulatory obligations applicable to a credit rating agency operating within the DIFC.

It should not be interpreted as imposing identical requirements or penalties on every business operating in the UAE.

Different organisations may be subject to different legal, contractual and regulatory obligations depending on their activities, location and the type of information they process.

Nevertheless, the underlying issues are relevant beyond the financial services industry.

Businesses handling confidential corporate information should understand where sensitive data is stored, who can access it and how it may be shared internally or externally.

They should also consider whether security procedures remain effective following changes to technology, staffing or business operations.

The Moody's Middle East case is particularly relevant because the regulator identified several contributing weaknesses rather than attributing the incidents to a single technical failure.

This reinforces the importance of considering people, processes and technology together when assessing information security risks.

Protecting Confidential Information Through Effective Oversight

The AED 2.15 million penalty imposed on Moody's Investors Service Middle East Limited demonstrates the potential regulatory consequences of inadequate information confidentiality controls.

The seven reported disclosure incidents, together with the weaknesses identified by the DFSA, illustrate how gaps in technical safeguards and internal procedures can expose sensitive corporate information.

For UAE organisations, the wider lesson is the importance of maintaining effective security measures, reviewing operational changes and ensuring responsibilities for confidential information are clearly understood.

Regular assessment of Cyber Security and Risk Management arrangements can help businesses identify vulnerabilities before they contribute to significant incidents.

Conflict Advisory Group supports organisations across the UAE with Cyber Security, Risk Management, Due Diligence and related corporate advisory services.

Our team works with businesses to assess risks, identify weaknesses and develop practical recommendations tailored to their operating environment.

For organisations concerned about confidential information, technology vulnerabilities or wider corporate security exposure, contact Conflict Advisory Group to discuss your requirements in confidence.