The DFSA fines Moody’s Investors Service Middle East Limited USD 585,825 for…

Key dates

2012-12-31

MISMEL was licensed by the DFSA as a credit rating agency.

2023-12-01

Beginning of the period during which MISMEL reported seven inadvertent data-disclosure incidents to the DFSA; the source specifies December 2023 but not an exact day.

2026-05-31

End of the incident period described by the DFSA; the source specifies May 2026 but not an exact day.

2026-10-28

The DFSA announced the enforcement action and USD 585,825 penalty against MISMEL.

Suggested considerations

• Credit rating agencies should consider mapping confidential-information flows, permitted uses, recipients and disclosure exceptions against DFSA COB 8.9.1 and COB 8.9.2.
• Compliance and technology teams may wish to test email, endpoint, access-control, data-loss-prevention and external-recipient controls using realistic scenarios involving inadvertent disclosures.
• Firms should consider documenting compensating controls and an approved replacement before disabling or materially changing any security tool, with formal risk acceptance where continuity cannot be achieved.
• Control owners may wish to review incident detection, escalation, investigation and regulatory-notification processes, including whether repeated near misses are aggregated and reported to senior management and the DFSA where applicable.
• Senior management and compliance teams should consider reviewing employee training, attestations, supervision and disciplinary arrangements so that confidentiality obligations are demonstrably enforced and not merely documented.
• Credit rating agencies may wish to retain sufficient records and audit trails to evidence the operation and testing of confidentiality controls, noting the DFSA Rulebook requirement to maintain relevant records for at least six years.
• Firms outside the credit-rating sector should consider the enforcement action as an indicator of DFSA expectations for proportionate data-confidentiality governance, although the cited COB 8.9 requirements specifically apply to credit rating agencies.

What changed

This is an enforcement action rather than a new rule or prospective regulatory amendment. The DFSA found that MISMEL failed to implement and maintain adequate systems and controls to safeguard confidential information and failed to ensure that employees did not disclose it. The relevant DFSA framework requires a credit rating agency to maintain policies, procedures and controls preventing use of confidential information for unauthorised purposes and disclosure to other persons, subject to limited exceptions such as prior written consent or a legal obligation; COB 8.9.1 also addresses pending rating actions, while COB 8.9.2 prohibits disclosure of confidential information by any means. The decision identifies discontinuation of a data-security tool without an immediate replacement, inadequa

Who is affected

• DFSA-authorised credit rating agencies operating in or from the DIFC
• DIFC firms that receive, process or transmit confidential issuer, government or counterparty information in connection with regulated activities
• Employees, managers and control functions of DFSA-regulated firms who handle confidential or market-sensitive information

Related regulations

• DFSA Conduct of Business Rule COB 8.9.1
• DFSA Conduct of Business Rule COB 8.9.2
• DFSA Conduct of Business Rule COB 8.9.3