CbCR Reporting in the UAE: CbC Notification vs Report, Two Filings, Two Deadlines

CbCR reporting in the UAE is two filings, not one. The CbC notification names the entity that will file and the jurisdiction it will file in, and is generally due by the last day of the group’s financial year. The CbC report carries the jurisdiction-by-jurisdiction data and is generally due within 12 months of that same year-end.

The failure the regime is most obviously built to produce is not a data error or a late report. It is far simpler than that: a group files the CbC notification, ticks the box, and treats the obligation as discharged — only to find, sometimes a year later, that the substantive report was never filed at all. The two are not the same thing. They are two separate obligations, with two separate purposes, two separate deadlines, and two independent lines of penalty exposure. This guide draws the line between them cleanly, so a group that is in scope knows exactly what it owes, when it owes it, and who has to sign the filing.

CbCR reporting: two obligations, not one

Country-by-Country reporting — often shortened to CbC or CbCR — is a global transparency measure that came out of the OECD’s Base Erosion and Profit Shifting project — specifically BEPS Action 13. The idea is straightforward: the largest multinational groups should give tax authorities a single, standardised picture of how their revenue, profit, tax and economic substance are spread across every jurisdiction they operate in. The UAE adopted the framework, and it is administered by the Ministry of Finance.

For an in-scope group, the framework creates two distinct filing duties. The first is the CbC notification — an administrative filing that tells the authority who is going to file the report and where. The second is the CbC report itself — the full data return, jurisdiction by jurisdiction. A group has to think of these as two separate items on the calendar, because that is exactly how the rules treat them.

The confusion is understandable. Both are called “CbC something”, both belong to the same regime, and both are filed with the same authority. But the notification is a signpost, and the report is the destination. Filing the signpost does not mean you have arrived.

Who is actually in scope

Before either filing matters, a group has to establish whether it is caught by the rules at all. The Country-by-Country regime is aimed squarely at the largest multinational groups. The test is consolidated group revenue: a multinational enterprise (MNE) group is in scope where its consolidated revenue reaches AED 3.15 billion or more in the financial year preceding the reporting year.

That threshold matters in two directions. If a group sits below it, neither the notification nor the report applies — there is nothing to file, and no penalty exposure arises. If a group sits at or above it, both obligations switch on together. There is no partial position where a group owes the notification but escapes the report on the basis of size; the threshold is a single gate that opens onto both duties at once.

The figure of AED 3.15 billion is not arbitrary. It aligns the UAE with the international standard the OECD set for CbC reporting, which is why groups that already report in other jurisdictions will recognise the concept immediately. What trips groups up is not the threshold itself but the reference point — it is the consolidated position of the whole group that counts, driven by the ultimate parent’s accounts, not the revenue of any one UAE entity taken on its own. For a fuller breakdown of the scoping test, see our guide on which groups must file a CbC Report in the UAE.

The CbC notification — the signpost

The notification is the lighter of the two filings, and it is the one groups most often mistake for the whole obligation. Its job is narrow: it tells the Ministry of Finance which entity in the group will file the Country-by-Country report, and in which jurisdiction that report will be filed.

That is essentially all it does. It carries almost no financial data. It is a coordination mechanism, letting the authority know where to expect the substantive report and which entity stands behind it. In a group with entities spread across several countries, the notification is how each jurisdiction’s tax authority knows whether the report is coming to them directly or arriving through the automatic exchange network from another jurisdiction.

The timing is the part to lock in. The notification is generally due by the last day of the group’s financial year — the reporting year to which it relates. For a group with a 31 December year-end, that means the notification falls due on 31 December of the reporting year itself. Note how early that is relative to the report: the notification is due at the end of the year, while the report is due a full twelve months later. A group that treats them as a single event will file the notification and then, in effect, forget that the harder filing is still a year away.

Because the notification identifies the reporting entity, it also has to be right about that entity. The UAE regime keeps this simple: it is the UAE-resident Ultimate Parent Entity that files, and the notification names that entity — so the detail that has to be accurate is the confirmation of the parent as the reporting entity, because the whole point of the notification is to tell the authority where to look.

The CbC report — the substantive filing

The report is where the real content lives. Where the notification is a single line of “here is who will file and where”, the report is a full jurisdiction-by-jurisdiction data return covering the group’s global footprint. It sets out, for each tax jurisdiction the group operates in, the core economic indicators the OECD framework requires — the group’s revenue, profit before tax, tax paid and accrued, stated capital, accumulated earnings, number of employees and tangible assets, broken down country by country.

The purpose is to give tax authorities a high-level map of where a group earns its money and where it books its profit and pays its tax, so that misalignments — profit sitting in a jurisdiction with little real activity, for example — become visible. It is a transparency and risk-assessment tool, and it feeds directly into the transfer pricing picture that large groups have to manage under the UAE’s corporate tax regime.

The deadline is the mirror image of the notification’s. The report is generally due within 12 months of the end of the group’s financial year. For a 31 December year-end, that puts the report deadline at 31 December of the following year. So the two filings bracket a full twelve-month span: the notification at the close of the reporting year, the report a year after that.

The two filings side by side

Everything in the regime traces back to Cabinet Resolution No. 44 of 2020 organising reports submitted by multinational companies, issued on 4 June 2020 and published by the UAE Ministry of Finance. It repealed the earlier Cabinet Resolution No. 32 of 2019 and is the text that fixes the threshold, the two deadlines and the penalties. The comparison below is taken from that Resolution and checked against the MoF copy on 4 August 2026.

Two features of that table are easy to miss. The first is that both filings are electronic and prescribed: Article 7(3) requires the report or notification to be submitted using the technology and systems approved or provided by the MoF, in the form the Ministry determines, so a spreadsheet emailed to a case officer is not a filing. The second is that the report format is not the group’s choice — Article 3(2) points directly at the OECD standard template, which is why a group already filing CbC data abroad can usually reuse the same XML package.

Article 6 then gives the MoF a live information power that sits behind both filings. It may request information or access the Reporting Entity’s premises to test whether what was reported is correct and complete, and under Article 6(2) it may demand records, books or other documents within fourteen business days of a written request. Article 7(1) requires the Reporting Entity to keep actual records for five years after the report was submitted, in a form that remains electronically legible, with an English translation supplied on request under Article 7(2).

Who files the report — and who does not

This is the other point where groups go wrong, and it is worth being precise. The Country-by-Country report is filed by the group’s Ultimate Parent Entity where that parent is tax resident in the UAE. It is a single, group-level filing — one report covering the whole group, submitted by the entity at the top of the ownership chain.

There is an important scoping point here that is specific to the UAE. The CbC obligations apply only to groups headquartered in the UAE — that is, where the Ultimate Parent Entity is tax resident in the UAE. A UAE entity that is merely a constituent member of a group headquartered abroad does not carry a UAE CbC filing obligation: there is no secondary local filing, and no mechanism by which a UAE member is appointed to file the group’s report here. The report is filed once, at group level, by the UAE-resident parent.

What does not happen is every UAE entity in the group filing its own report — or its own notification. Ordinary constituent entities do not each submit a Country-by-Country report, and they do not each file a notification either. That would defeat the purpose of a single consolidated group view. In the UAE both filings sit with the same UAE-resident parent, which names itself as the reporting entity on the notification, so the group carries one notification and one report rather than a scatter of filings across its members.

“

In the UAE both filings sit with the same UAE-resident parent — the notification names the reporting entity, the report carries the data. Confuse the two and you either over-file, under-file, or miss a deadline that was hiding in plain sight twelve months out.

One financial year, two dates on the calendar

The cleanest way to hold all of this in mind is to anchor everything to the group’s financial year, because both deadlines flow from it and neither is tied to the calendar year.

Take a group with a 31 December financial year-end as the worked example. The CbC notification is generally due by the last day of the reporting financial year — 31 December of that reporting year. The CbC report is generally due within 12 months of the year-end — 31 December of the following year. A group with a different year-end simply shifts both dates accordingly: a 31 March year-end puts the notification at 31 March of the reporting year and the report at 31 March a year later.

The practical hazard is the twelve-month gap. The two obligations are genetically linked — same regime, same group, same financial year — but they land a full year apart. Human memory does not naturally bridge a twelve-month gap between two tasks that feel like one task. That is why a group that files the notification in December often does not think about the report until a reminder surfaces the following December, and by then the assembly work for a full jurisdiction-by-jurisdiction data return is a scramble rather than a project.

The fix is not complicated, but it has to be deliberate. When the financial year opens, both dates go on the compliance calendar at once, with the report treated as a project that starts months before its deadline, not a form to be completed in the final week.

What goes wrong, and what it costs

Penalties apply under the UAE’s Country-by-Country reporting rules for failing to file, filing late, or filing incorrect or incomplete information. Because the notification and the report are separate obligations, the penalty exposure runs on two independent tracks. A group can be perfectly compliant on its notification and still exposed on a missed or late report — and, less commonly, the reverse.

The failure patterns cluster into a handful of recurring shapes. The first is the one this whole guide is built around: filing the notification and believing the obligation is complete, so the report is simply never filed. The second is losing the report deadline in the twelve-month gap — the group knows the report is due, but the reminder never fires, and the deadline passes. The third is a data-quality failure on the report itself: the jurisdiction-by-jurisdiction figures are incomplete, inconsistent with the consolidated accounts, or wrong in a way that surfaces later. The fourth is getting the reporting entity wrong on the notification — naming an entity that will not, in fact, file, so the authorities cannot locate the report.

Each of these has its own remedy, but they share a root cause: treating a two-part obligation as a single event. The amounts are not vague. Article 8 of Cabinet Resolution 44/2020 sets them out in full, and they are among the heaviest administrative penalties in the UAE compliance landscape.

Article 9 wraps real procedural protection around those figures, and it rewards a group that moves fast. The MoF must notify the violation in writing and grant a grace period of fourteen business days to remedy it before applying any penalty. Under Article 9(3), liability does not arise at all where the entity convinces the Ministry there was a reasonable excuse — but Article 9(4) rules out two excuses by name: insufficient funds, and the information being held by a third party. Article 9(7) then gives the MoF six months from the date liability arose, or from the date it became aware of the offence, to determine the amount.

Article 10 sets the appeal route. The complaint may be made on two grounds only — that no violation warranting the penalty was committed, or against the amount imposed — and must be filed in writing with the MoF within thirty business days of notification. The Ministry has sixty business days to decide and notify, and Article 10(4) contains a provision groups rarely expect: if the MoF fails to give written notice of its decision within that window, the appeal is deemed successful and the penalty is cancelled. Payment otherwise falls due within thirty business days of notification, or of a decision rejecting the appeal, under Article 9(8).

None of that makes the exposure small. Because the UAE regime puts both filings on the same UAE-resident parent, the Article 8(3) cap of AED 1,000,000 per Reporting Fiscal Year is the ceiling on the fixed penalties for that entity — but the daily accruals in Articles 8(1)(a)(ii) and 8(2)(ii) are expressly carved out of that cap, so they run on top. A group that thinks it may have a breach should confirm its exposure against the current text of the Resolution and move inside the fourteen-day remedy window, because that window is by some distance the cheapest place to fix the problem.

How CbC reporting sits inside the wider corporate tax picture

Country-by-Country reporting does not live in isolation. It is one part of a large group’s overall UAE compliance load, and it connects most directly to transfer pricing in the UAE and the group’s corporate tax obligations. The CbC report gives tax authorities a high-level view of where profit and substance sit across jurisdictions, and that view is precisely the lens through which transfer pricing risk is assessed. A group whose CbC data shows profit concentrated where economic activity is thin is inviting exactly the kind of enquiry the framework was designed to enable.

That is why the report should never be prepared as a standalone data exercise divorced from the group’s corporate tax position. The figures in the CbC report have to reconcile to the consolidated accounts and sit consistently alongside the transfer pricing documentation requirements the group already carries under UAE corporate tax. Inconsistency between what a group says in its CbC report and what it says in its transfer pricing master file or local file is the sort of gap that draws scrutiny. The three documents are meant to tell one coherent story about how the group is structured and where value is created.

It helps to be clear on what transfer pricing actually is before mapping it onto CbC. Transfer pricing is the set of rules governing how entities within the same multinational group price the goods, services, financing and intangibles they supply to each other, and the governing principle is that those internal prices should reflect what unconnected parties would have agreed.

The UAE transfer pricing regulations under the corporate tax law follow the OECD Transfer Pricing Guidelines closely — the documentation obligations, and the thresholds that switch them on, are set out separately in our guide to the transfer pricing master file and local file in the UAE. That closeness is why the recognised transfer pricing methods — comparable uncontrolled price, resale price, cost plus, transactional net margin and profit split — are the same ones a group will already be applying elsewhere. Where an intra-group price falls outside the arm’s-length range, a transfer pricing adjustment brings the taxable result back into line, and the reasoning behind it belongs in the group’s transfer pricing documentation rather than in a note nobody can find a year later.

The link to Country-by-Country reporting is direct. A CbC report is not itself a transfer pricing report, but it is often the first document a tax authority reads before deciding whether to look at one. Multinational companies with UAE parents should therefore expect the two to be read side by side, and should sanity-check the CbC data against the transfer pricing position before either is filed.

For a UAE-parented group, this means the CbC obligations should be scoped into the corporate tax compliance calendar as a whole, not bolted on as an afterthought. The threshold assessment, the notification, the report, and the underlying transfer pricing analysis are all part of the same picture — and the group that manages them together, on one timeline, is the group that avoids both the penalties and the awkward reconciliation questions that come from managing them apart.

Where this leaves an in-scope group

The distinction at the heart of this regime is simple once it is stated plainly, and expensive when it is missed. The CbC notification is the signpost — it tells the Ministry of Finance who will file and where, and it is generally due by the last day of the group’s financial year. The CbC report is the substantive filing — the full jurisdiction-by-jurisdiction data return, filed once at group level by the UAE-resident Ultimate Parent Entity, and generally due within 12 months of the year-end. Both apply to MNE groups at or above the AED 3.15 billion consolidated revenue threshold, and both carry independent penalty exposure for late or incorrect filing.

A group that internalises that structure — two obligations, two deadlines, one financial year — has already avoided the most common and most costly failure in the entire regime. The rest is disciplined calendar management and clean, reconciled data. We help UAE groups map their Country-by-Country reporting obligations against their financial year, confirm the reporting entity and jurisdiction, and prepare the notification and report so they sit consistently with the group’s wider corporate tax and transfer pricing position.

Velmont Crest is a DED-licensed UAE accounting firm providing advisory, preparation and compliance support across corporate tax, transfer pricing and Country-by-Country reporting for mainland and free zone businesses. Read more on our insights hub or get in touch via our contact page.

Disclaimer: Velmont Crest is a DED-licensed accounting firm providing advisory, preparation and compliance support services. We are not a law firm, a tax agent representing clients before any authority, or a licensed financial-services provider. Country-by-Country reporting thresholds, deadlines and penalties are set out in UAE legislation and administered by the Ministry of Finance, and they can change — verify all obligations against the current rules and your group’s specific facts, and consult a licensed professional for advice tailored to your circumstances before acting.

References

• UAE Ministry of Finance — Country-by-Country Reporting
• UAE Ministry of Finance — Cabinet Decision No. 44 of 2020 organising reports submitted by multinational companies (PDF)
• UAE Ministry of Finance — CbCR guidance on compliance with CbCR regulations (PDF)
• OECD — BEPS Action 13: Country-by-Country Reporting
• UAE Official Portal — Corporate Tax