CbCR vs Public CbCR
CbCR vs Public CbCR: What’s Actually Changing for UK Groups in 2026
TL; DR
- CbCR (BEPS Action 13) is confidential and filed with the relevant tax authority – HMRC, for UK reporting entities – and may then be automatically exchanged with tax authorities in other jurisdictions. Public CbCR (EU Directive 2021/2101) is published for anyone to read.
- The two regimes don’t use an identical threshold test: OECD CbCR generally applies where prior-year consolidated group revenue is at least €750 million (or the near-equivalent in local currency), while EU Public CbCR requires revenue to exceed €750 million in each of the last two consecutive financial years.
- The UK never transposed the EU Directive – but in-scope UK (or other non-EU) groups clearing that two-year threshold may still be brought in through a medium/large EU subsidiary or qualifying EU branch.
- Public CbCR only itemises EU member states plus blacklisted/grey-listed tax jurisdictions; everything else is aggregated into “rest of world.”
- Reports must be built as an XHTML file with iXBRL markup, using the EU’s official template and taxonomy.
- First reports for calendar year-end groups are due by 31 December 2026.
- Penalties vary by EU member state – but the bigger exposure for most groups is reputational, since the data is public.
Quick Answer
CbCR (Country-by-Country Reporting) under OECD BEPS Action 13 is a confidential tax reporting regime for large multinational groups, generally those with consolidated group revenue of at least €750 million, disclosing tax and profit data to tax authorities for every jurisdiction they operate in. It is never made public. Public CbCR, introduced by EU Directive 2021/2101, is a separate, publicly disclosed report that only covers EU member states and blacklisted tax havens individually – everything else can be lumped into “rest of world.” UK-headquartered groups don’t fall under the EU Directive directly, but any UK group with a qualifying EU subsidiary or branch is pulled in. First reports for calendar year-end groups are due by 31 December 2026, published as an XHTML file with iXBRL tagging.
Introduction
If your finance team has been filing a Country-by-Country Report (CbCR) with tax authorities for years, it’s easy to assume the new “Public CbCR” headlines don’t add anything new. That assumption is costing groups time they don’t have. CbCR and Public CbCR share a name and a similar revenue threshold, but different origins: traditional CbCR comes directly from OECD BEPS Action 13, whereas EU Public CbCR is a separate EU disclosure requirement – the two are different filings, built for different audiences, with different deadlines.
For UK groups with European operations, the clock on the second one is already running.
What Is CbCR (BEPS Action 13)?
Country-by-Country Reporting was introduced under Action 13 of the OECD/G20 Base Erosion and Profit Shifting (BEPS) project. In the UK, the original enabling provision was section 122 of the Finance Act 2015 – but this was repealed in July 2023, when the UK consolidated its Automatic Exchange of Information powers into section 349 of the Finance (No. 2) Act 2023. The 2016 CbCR Regulations (SI 2016/237) remain the core UK CbCR regulations, now made under that consolidated power.
Who must file it: UK-resident ultimate parent entities of multinational groups with consolidated group turnover of €750 million or more, for accounting periods starting on or after 1 January 2016.
What it contains: revenue, profit before tax, tax paid, tax accrued, stated capital, accumulated earnings, number of employees, and tangible assets – broken down for every single tax jurisdiction the group operates in, no exceptions.
Where it goes: filed directly with HMRC within 12 months of the accounting period’s end. HMRC then automatically exchanges it with other tax authorities under exchange-of-information agreements. It is never published or made available to the public.
Why it exists: to give tax authorities – not the public – visibility into whether profits are being booked where the real economic activity happens, or shifted into low-tax jurisdictions on paper.
What Is Public CbCR?
Public Country-by-Country Reporting comes from a different piece of law entirely: EU Directive 2021/2101, which amended the EU Accounting Directive (2013/34/EU). It was formally adopted in November 2021, and EU member states had until 22 June 2023 to transpose it into national law.
Who has to file it: multinational groups or standalone undertakings with consolidated net turnover exceeding €750 million in each of the last two consecutive financial years – the same headline threshold as BEPS CbCR – but with a different trigger for who’s actually caught. Public CbCR applies to:
- EU-headquartered groups above the threshold, and
- Non-EU-headquartered groups (this includes UK groups) that have a medium-sized or large subsidiary, or a qualifying branch, in the EU
A subsidiary is “medium-sized or large” (i.e., not small) if it exceeds at least two of these three criteria, under the Accounting Directive thresholds updated in 2024: balance sheet total of roughly €5 million, net turnover of roughly €10 million, and an average of 50 employees. (A handful of member states apply the higher end of the permitted range – up to €7.5m/€15m – so check the specific figure for the country where your subsidiary sits.) A branch only needs to clear the turnover threshold on its own.
What it contains: this is the critical difference from confidential CbCR. Public CbCR only requires country-by-country breakdowns for:
- Each individual EU member state where the group operates, and
- Each jurisdiction on the EU list of non-cooperative tax jurisdictions (“blacklist”), plus jurisdictions that have stayed on the “grey list” for two consecutive years
Everything else – the US, UK, Asia, wherever else the group operates – can be aggregated into a single “rest of the world” figure. Groups may defer specific commercially sensitive information for up to five years under the safeguard clause, but information relating to jurisdictions covered by the relevant Annex I or Annex II lists cannot be omitted.
Where it goes: the report must be published in accordance with the relevant EU Member State’s company-law/register requirements and made publicly accessible free of charge. Member States may exempt companies from hosting the report on their own website where it’s freely available in machine-readable form through the relevant national register, subject to the Directive’s conditions.
Format: the European Commission requires the report to be prepared using the official EU Template, structured with the EU’s XBRL taxonomy, and submitted as an XHTML dataset with iXBRL markup embedded – the same tagging standard behind ESEF and UK statutory filings, just applied to a brand-new disclosure.
CbCR vs Public CbCR: Side-by-Side Comparison
CbCR (BEPS Action 13) | Public CbCR (EU Directive 2021/2101) | |
Legal basis | Finance (No. 2) Act 2023, s.349 + SI 2016/237 (as amended) | EU Directive 2021/2101 |
Revenue threshold | €750m consolidated group turnover | €750m consolidated group turnover |
Who’s caught (UK groups) | UK-resident ultimate parent of an in-scope MNE | UK/non-EU group exceeding the €750m threshold with a qualifying medium/large EU subsidiary or qualifying EU branch |
Audience | Tax authorities only | The general public |
Confidentiality | Confidential, exchanged between tax authorities | Publicly published |
Jurisdictions itemised | Every jurisdiction, no exceptions | EU states + blacklisted/grey listed jurisdictions; rest aggregated |
Filed with | HMRC | Published via the relevant national register, and generally also required to be freely accessible on the company’s own website |
Format | XML per OECD schema | XHTML with iXBRL markup (EU Template) |
Deadline | 12 months after accounting period end | 12 months after balance sheet date |
First reports due | Ongoing since 2016 | 31 December 2026 (calendar year-end groups) |
Get the Public CbCR Readiness Checklist
A one-page checklist covering how to confirm whether your group is in scope, decide who reports, and prepare before the 31 December 2026 deadline.
Why UK Groups Are Affected, Despite Brexit
This is the point most UK finance teams get wrong. The UK isn’t an EU member state, so there was never a UK domestic law that transposed Directive 2021/2101 – there’s no British “Public CbCR Regulations 2024” to search for. UK company law does, separately, contain a dormant Treasury power (Finance Act 2016, Schedule 19) that could one day require published tax strategies to include a CbC report, but it hasn’t been switched on.
That doesn’t mean UK groups are outside the regime. The EU Directive attaches the obligation to the subsidiary or branch, not just to the parent. If a UK-headquartered group has an EU subsidiary or branch that clears the medium/large threshold on its own, that EU entity – or the UK parent voluntarily reporting on its behalf, which exempts the subsidiary – has to publish. Given how many UK groups run operations in Ireland, Germany, France or the Netherlands, this catches a meaningful number of businesses that have never thought of themselves as “in scope for an EU directive.”
The 2026 Deadline
For groups with a calendar year-end, financial year 2025 is the first reportable year, and the report must be published within 12 months of the balance sheet date – meaning 31 December 2026 for most in-scope groups. Groups with non-calendar year-ends may already have earlier obligations that have passed: a 30 June year-end group, for example, would generally have its first relevant period running from 1 July 2024 to 30 June 2025, with its report due by 30 June 2026.
The European Commission published the final EU Template on 2 December 2024, and the technical Reporting Package needed to generate a machine-readable, XBRL-taxonomy-compliant file followed on 22 December 2025. The specification has continued to evolve since – the Commission released a further update to the taxonomy, documentation, and report generator on 24 July 2026, including Report Generator v2.0 – so groups building against this shouldn’t treat any single release as final; it’s worth checking for the current version before generating a report rather than assuming last year’s package still applies.
The Reporting Spec Keeps Changing - Don't Build Against a Stale Version
Get a summary of the latest taxonomy and report generator updates, and a heads-up the next time the technical package changes.
How UK Groups Should Prepare
- Map your EU footprint against the medium/large subsidiary and branch thresholds, jurisdiction by jurisdiction – this determines whether you’re in scope at all and where.
- Decide who reports – the EU subsidiary itself, or the UK parent taking on the obligation centrally (which exempts each subsidiary from filing separately). Either way, the report is a group report, not merely a report of EU exposure: it includes the group’s required global information, with separate disclosure for EU Member States and relevant listed jurisdictions and permitted aggregation elsewhere.
- Separate your existing confidential CbCR data from your new public dataset – don’t assume the file you send to tax authorities can simply be relabelled and published; the jurisdictional breakdown rules are different.
- Build the report in the correct format from day one. An XHTML file with iXBRL markup, mapped to the EU taxonomy, isn’t something to bolt on after the numbers are finalised – tagging errors here are exactly the kind that cause rejected or non-compliant public filings.
- Decide on your five-year deferral position early for any commercially sensitive figures, since this needs to be justified and documented, not applied retroactively.
Not Sure If You're In Scope?
Get a free 15-minute scope review with our CbCR team – we’ll tell you plainly whether your group’s footprint triggers a Public CbCR obligation.
Frequently Asked Questions
Is Public CbCR mandatory for UK companies?
Not directly under UK law. However, an in-scope UK-headed group that meets the €750 million group revenue test and has a qualifying medium/large subsidiary or qualifying branch in an EU Member State can become subject to the EU Public CbCR regime through that EU presence.
Is the €750 million threshold based on the UK parent's revenue or the EU subsidiary's revenue?
It’s based on the consolidated group’s revenue – the UK parent and all its subsidiaries combined – not the EU subsidiary in isolation. The EU subsidiary’s own size only determines whether it is medium/large enough to trigger the local filing obligation.
Is Public CbCR the same report we already file with tax authorities?
No. OECD CbCR is itself the BEPS Action 13 minimum standard; EU Public CbCR is a separate transparency regime under the EU Accounting Directive, developed against the background of OECD/BEPS country-by-country reporting rather than sharing a direct legal origin with it. The content, format, confidentiality, and filing destination are all different, and existing CbCR filings can’t simply be republished.
Can we defer publishing sensitive figures?
Yes, for up to five years under the Directive’s safeguard clause, for genuinely commercially sensitive information – except for data relating to EU blacklisted or grey-listed jurisdictions, which can’t be deferred.
What happens if we don't comply?
Penalties are set at member state level rather than centrally by the EU, so they vary by country – some jurisdictions apply modest, fixed fines, others escalate for repeated non-compliance. The bigger practical risk for most groups is reputational: this data is public and will be read by journalists, NGOs, and competitors, not just regulators.
Is Public CbCR the same as Pillar Two reporting?
No – they’re often confused because both involve large multinationals and country-level tax data, but Pillar Two (the OECD’s global minimum tax) has its own GloBE Information Return with entirely separate rules, deadlines, and purpose.
CTA
Preparing a Public CbCR report in the required XHTML/iXBRL format isn’t a spreadsheet exercise – it’s a tagging and validation problem, the same category of work DataTracks has handled for HMRC and Companies House filings for years. Talk to our CbCR reporting team to find out whether your group is in scope and get your first public report built correctly the first time.
