Country-by-Country Reporting (CbCR)

What is Country-by-Country Reporting (CbCR)?

The CbC report is the third tier of OECD BEPS Action 13 documentation, sitting alongside the master file and local file. OECD TPG 5.25 requires the report to contain aggregate data for each tax jurisdiction: revenue split between related and unrelated parties, profit or loss before income tax, income tax paid (cash basis), income tax accrued, stated capital, accumulated earnings, number of employees, and tangible assets other than cash. The parent entity files in its jurisdiction of tax residence, and that jurisdiction exchanges the report with every country where the group operates.

For auditors, CbCR data feeds two assessments. When evaluating uncertain tax positions under IFRIC 23, the report reveals where the group books profit relative to where it stations employees and holds assets. A jurisdiction showing high profit but few employees invites transfer pricing scrutiny, which drives the probability assessment for tax provisions. Separately, ISA 720.14 requires the auditor to read "other information" published alongside the financial statements, and the public CbC report (Directive 2021/2101, filed in xHTML with iXBRL markup on a national register) falls within that scope.

Worked example: Schäfer Elektrotechnik AG

Client: German electronics group, FY2025, consolidated revenue €310M, IFRS reporter. Schäfer has subsidiaries in the Netherlands and Poland. Although €310M falls below the €750M threshold, the group's Swiss parent (consolidated revenue €820M) triggers the obligation. German tax authorities receive the report via exchange.

Step 1 — Confirm the filing obligation: The Swiss parent files with the Swiss Federal Tax Administration. Schäfer must notify the Bundeszentralamt für Steuern (BZSt) of the filing entity's identity by year end under §138a AO.

Documentation note: record the ultimate parent name, jurisdiction (Switzerland), BZSt notification deadline, and confirmation the notification was filed. Reference OECD TPG 5.28.

Step 2 — Extract the German jurisdiction data: The CbC report shows Schäfer with revenue of €310M (€45M related-party), profit before tax of €18.5M, income tax paid of €5.1M, 1,420 employees, and tangible assets of €62M.

Documentation note: obtain the CbC extract for Germany from group management. Cross-reference revenue to the IFRS consolidation package and headcount to HR records. Flag variances exceeding 5%.

Step 3 — Assess transfer pricing risk from jurisdictional ratios: Profit per employee for Germany is €13,028 (€18.5M / 1,420). The Dutch subsidiary reports €4.2M profit with 30 employees (€140,000 per employee). This disparity signals that the Dutch entity may hold intangible assets concentrating profit relative to substance. The auditor flags the Dutch royalty position for IFRIC 23 evaluation.

Documentation note: prepare a jurisdiction-level ratio analysis (profit per employee, effective tax rate) using CbCR data. Document the conclusion on whether any jurisdiction presents a transfer pricing exposure requiring provision or disclosure under IAS 12.

Step 4 — Consider public CbCR: The Swiss parent exceeds €750M with EU operations, so Directive 2021/2101 applies from FY2025. The Dutch subsidiary will file the public report with the KvK by 31 December 2026.

Documentation note: record the EU filing entity, the designated register, the deadline, and whether the group invokes the safeguard clause for commercially sensitive data under Article 48c(4).

Conclusion: the filing obligation sits with the Swiss parent, the German notification was timely, and the ratio analysis identifies the Dutch royalty structure as the primary transfer pricing risk requiring IFRIC 23 evaluation.

What reviewers and practitioners get wrong

• Audit teams frequently treat CbCR as a tax compliance document outside the statutory audit's scope. ISA 315.32 requires the auditor to understand the entity's tax environment during risk assessment. The CbC report concentrates jurisdiction-level profit and substance data in one document. Ignoring it means the risk assessment for deferred tax and uncertain tax positions lacks a data point that tax authorities themselves rely on.
• Practitioners sometimes confuse confidential CbCR (Directive 2016/881, exchanged between tax authorities only) with public CbCR (Directive 2021/2101, published on a national register). The two regimes have different content requirements and different timelines. Telling a client "CbCR is only for the tax authority" is no longer accurate for groups with EU operations exceeding €750M from FY2025 onward.

Related terms

Frequently asked questions