EU Directive 2021/2101, published in the Official Journal of the European Union on 1 December 2021, has been in force since 22 June 2024 for financial years opened on or after that date. For groups whose financial year follows the calendar year, the first publication is due before 31 December 2026 (wiki.private.law).
In practical terms, thousands of multinational groups with a presence in the European Union will be required to publish, on their website, a report detailing their revenues, profits and taxes paid in each EU Member State, as well as in certain non-cooperative jurisdictions. This report will be publicly accessible — to investors, journalists, trade unions and NGOs alike.
Your tax team may have already ticked the “OECD CbCR” box on its compliance checklist. The problem is that the EU public CbCR is not the same document. And crucially, the data must come from your information systems. This guide is aimed at CIOs and CFOs who need to understand what the directive changes for their IT landscape and how to structure the necessary workstreams before the first deadline.
What Is EU Public CbCR Directive 2021/2101?
Scope: Who Is Covered?
The directive applies to groups whose consolidated revenue exceeds €750 million in each of the two most recent consecutive financial years, provided they have a presence in at least one EU Member State. This threshold is identical to the OECD confidential CbCR threshold (BEPS Action 13), which facilitates consistency between the two regimes.
The scope extends beyond purely European multinationals. A US, Japanese or Canadian multinational whose French or German subsidiary meets the consolidated revenue threshold is also in scope. The obligation can be satisfied by publishing a single group-level report, provided the EU subsidiary is clearly identified as the entity responsible for local publication.
What Must Be Reported
The report must cover, for each EU Member State and for jurisdictions listed in the EU annexes as non-cooperative or high-risk, the following seven data points:
- Revenue (intragroup and third-party, separately disclosed)
- Profit or loss before corporate income tax
- Corporate income tax accrued (current charge)
- Corporate income tax paid (actual cash flow)
- Accumulated earnings
- Undistributed profits
- Number of employees on a full-time equivalent basis
Data relating to all other jurisdictions (non-EU, non-listed countries) may be aggregated into a single “Other jurisdictions” line. Groups may choose to publish a more detailed worldwide report, but the directive only mandates EU Member States and listed jurisdictions.
The format has been mandatory since the publication of Implementing Regulation (EU) 2024/2952: XHTML with Inline XBRL tagging (wiki.private.law).
First-Wave Timeline
| Milestone | Date |
|---|---|
| Published in the Official Journal | 1 December 2021 |
| Entry into force | 21 December 2021 |
| Transposition deadline for Member States | 22 June 2023 |
| Application: financial years opening from | 22 June 2024 |
| First publication (calendar-year groups) | 31 December 2026 |
For groups whose financial year opens on 1 January 2025, the report covers the 2025 financial year and must be published no later than twelve months after the closing date — i.e. before 31 December 2026 (tpcases.com).
Why This Is an IT Challenge, Not Just a Tax Challenge
The Source Data Lives in Your ERP and Consolidation Tools
The public CbCR report is not a tax document in the strict sense. It is a financial report aggregated by legal jurisdiction of operation, derived from the group’s accounting and payroll data. The data does not sit with the tax team — it lives in SAP’s FI/CO module, Oracle Hyperion Financial Management, CCH Tagetik, or your group consolidation tool.
The typical risk is that the tax team has been producing the OECD confidential CbCR from an Excel spreadsheet manually fed from the consolidation system. This approach worked as long as the report stayed between tax authorities. It no longer holds when the report must be produced annually, in iXBRL format, with sufficient quality to withstand public scrutiny and statutory audit.
The Five Key Data Points Your ERP Must Extract by Country
Your information systems must be capable of producing the following data, broken down by legal entity and country of operation:
- Revenue by country: with a split between intragroup revenue and third-party revenue, per the directive’s definition
- Profit before tax by country: accounting profit before any tax adjustment
- Tax accrued by country: current income tax charge under local rules
- Tax paid by country: actual cash flows, including advance payments and true-ups
- Headcount by country: average full-time equivalent for the financial year, by legal entity
The Cash-Pooling Trap
Groups that have centralised their treasury through a cash-pooling arrangement frequently encounter a specific obstacle. Intragroup interest charges flow across legal entities without real economic substance, which distorts the calculation of taxes paid by country. The central treasury entity pays or receives cash flows, while the local accounting entries no longer reflect the country-by-country reality. This requires specific configuration in the ERP to reconstruct the allocation by legal entity before intercompany eliminations in the consolidation.
Diagnostic: Can Your ERP Produce These Data Points?
Before launching any workstream, three tests allow you to assess your starting position.
Test 1: Does Your Group Chart of Accounts Allow Segmentation by Legal Jurisdiction?
Groups that manage multiple subsidiaries in a single country through a single entity code in their ERP are exposed. The directive requires granularity by legal entity, not by market segment or operating unit. If your ERP structure conflates “France” (a business unit) with distinct French legal entities (subsidiary A SAS, subsidiary B SAS), a remapping exercise is needed before the first publication.
Test 2: Does Your Consolidation Tool Have a “Tax Jurisdiction” Dimension?
Modern consolidation tools — SAP BPC, Oracle Hyperion Financial Management, CCH Tagetik, Anaplan or LucaNet — allow additional analytical dimensions to be configured. The question is whether the “tax jurisdiction” dimension has been set up separately from the “accounting country” or “local currency” dimension. Without this dimension, producing the CbCR report requires an Excel export with manual data entry, multiplying the risk of errors in a publicly accessible document.
Test 3: Do Your Intercompany Eliminations Preserve Entity-Level Data?
In the consolidation process, intercompany transactions are eliminated. The risk is that entity-level data needed for CbCR is lost during the elimination process. Early compliance data from Romania — one of the first Member States to collect filings — shows that only 20% of in-scope groups had produced a complete and compliant report in the first wave (wiki.private.law). This rate suggests the data-consistency problem is widespread among groups that built their consolidation without anticipating this type of reporting.
The 4 IT Workstreams to Become CbCR-Ready
Workstream 1: Legal Entity and Tax Jurisdiction Mapping in the Group ERP
This is the foundational workstream. It involves creating, in the ERP and consolidation tool, a mapping table between each group legal entity and its tax jurisdiction as defined by the directive. The table must handle edge cases: partnership entities, branches (which have their own filing obligations under the directive), pure holding companies with no operational activity, and entities in liquidation or undergoing merger.
Once built, this mapping serves both the EU public CbCR and the OECD confidential CbCR, as well as Pillar Two GloBE obligations. Investing in this entity master data is therefore a cross-cutting workstream that amortises several regulatory requirements simultaneously.
Workstream 2: Automated Data Extraction by Country
The objective is to produce a CbCR data file from the consolidation tool without any manual intermediate step. This means configuring a standard report in the Finance module that outputs all seven regulatory data points by legal entity, with the correct definition for each aggregate — notably tax paid as a cash flow (not as an accounting charge) and revenues with the intragroup/third-party split.
Workstream 3: Reconciliation Between OECD CbCR and EU Public CbCR
Most groups above €750M already produce the OECD confidential CbCR. The two reports share the same threshold, but their scope differs slightly: the OECD CbCR may cover all worldwide jurisdictions, while the EU public CbCR focuses on Member States and listed jurisdictions. The definition of certain aggregates also varies depending on national transpositions. This workstream involves creating a reconciliation workflow to guarantee consistency between the two reports and avoid double data entry.
Workstream 4: Validation Workflow and Publication in iXBRL Format
The directive mandates XHTML with Inline XBRL tagging since Implementing Regulation (EU) 2024/2952. This format is not produced natively by most consolidation tools. Specialist solutions exist: Workiva (iXBRL report production with certification workflow), Longview Tax (integrated into CCH Tagetik), or Sovos CbCR (connectors for SAP, Oracle and other ERPs). These solutions act as a publication layer on top of the ERP, without requiring a redesign of the underlying IT landscape. The published report must then remain accessible online for five years.
What Major ERPs Offer
SAP S/4HANA: SAP Localization Hub and Tax Compliance
SAP has integrated dedicated public CbCR capabilities into its SAP Localization Hub Tax Compliance module. Data extraction is performed from the FI (Finance) and CO (Controlling) modules, with analytical dimensions configurable by legal entity and country. Report generation in iXBRL format is managed via an integration with SAP Document and Reporting Compliance.
Oracle Fusion Cloud: Tax Reporting Cloud Service
Oracle Fusion Cloud Finance offers a Tax Reporting Cloud Service that includes CbCR templates. Granularity by Business Unit and by legal entity (Legal Entity) is native in Oracle’s data structure. The service generates reports in the required formats, including iXBRL, with a group-configurable validation workflow.
Microsoft Dynamics 365 Finance: Reporting with Analytical Dimensions
Dynamics 365 Finance allows “Tax Country” analytical dimensions to be configured in the group chart of accounts. CbCR data extraction is done via financial statements filtered by legal entity. iXBRL generation typically requires a third-party add-on or an export to a specialist publishing tool.
Specialist Complementary Solutions
Groups running an older ERP or a non-standard configuration frequently turn to specialist solutions: Workiva (iXBRL report production with certification workflow), Longview Tax (part of CCH Tagetik, native integration), or Sovos CbCR (connectors for SAP, Oracle and Sage). These solutions act as a publication layer on top of the ERP, without requiring a redesign of the underlying IT landscape.
Risks and Timeline: What Can Go Wrong
Risk 1: Data Not Available by Country in a Highly Integrated Group
Groups that have opted for a heavily centralised structure — with a P&L managed at group level and local entities treated as cost centres — face a difficult situation. The directive requires data by legal entity, not by market segment. Retroactively reconstructing data for the 2025 financial year from an unsegmented structure is a project in its own right that cannot be improvised at year-end.
Risk 2: Divergences Between OECD Confidential CbCR and EU Public CbCR
Groups that assumed they could simply reuse their OECD CbCR to produce the public report are discovering definition mismatches. “Tax paid” under OECD BEPS rules may differ from “income taxes paid” under the EU directive. These gaps, even minor ones, expose the group to consistency questions from tax authorities or stakeholders comparing the two documents.
Risk 3: Visible Non-Compliance at the First 2026 Filing Round
Sanctions are set by each Member State. In Germany, failure to comply with the publication obligation can result in an administrative fine of up to €250,000 (EY Germany). But beyond direct fines, Article 48f of the directive requires the statutory auditor to explicitly state in their report whether the company was required to publish a CbCR and whether it actually did so. Non-compliance will therefore be visible in the audited accounts, with the governance and reputational consequences that implies for investors and partners.
The temporary safeguard clause in the directive — which allows deferral of publication of certain data if its disclosure causes “serious commercial prejudice” — is strictly framed: it does not apply to data from countries listed in EU Annexes I and II, omissions must be disclosed and justified, and their duration is limited to five years (wiki.private.law).
To go deeper on IT compliance challenges for multinational groups, read our guide on OECD Pillar Two and adapting your tax ERP, our analysis of BEPS transfer pricing documentation: master file and local file and our article on SOX internal controls for European subsidiaries.
