UAE Country-by-Country Reporting in 2026: What MNE Groups Actually Have to File

Country by country reporting UAE carries the steepest fixed-amount penalty in the country’s international tax framework. A missed report or notification triggers AED 1,000,000, plus AED 10,000 per day of continued failure.

The legal foundation is Cabinet Resolution No. 44 of 2020, which replaced Cabinet Resolution No. 32 of 2019. It is the current governing instrument implementing OECD BEPS Action 13 in the UAE — see BEPS explained for UAE businesses for where Action 13 sits in the wider framework.

The framework applies to MNE groups with consolidated group revenue of AED 3.15 billion or more. Here’s the part that catches most UAE entities off guard, though: it isn’t the report itself. It’s the annual notification that every UAE constituent entity of a qualifying group must file, even when the CbC Report is prepared and filed overseas by the ultimate parent.

Enforcement has sharpened since 2025. The FTA and Ministry of Finance have moved from registration drives into substantive review of late and incomplete filings.

This guide walks through the threshold mechanics, the CbC notification and report deadlines, the OECD three-table format, the surrogate parent entity mechanism, and how CbCR feeds DMTT and transfer pricing. A worked example, the common mistakes, and a compliance checklist follow. If you are unsure which of the two filings you owe, start with CbC notification vs report in the UAE. If your group is in scope and you want the notification and XML filing handled end to end, our CbC reporting support in the UAE covers scope confirmation, MoF portal submission and cross-document reconciliation.

What CbCR actually is in the UAE

CbCR is a transparency reporting framework — not a tax. Each in-scope MNE group files one CbC Report annually, typically prepared by the Ultimate Parent Entity (UPE) in its home jurisdiction.

That report is then automatically exchanged with tax authorities in treaty partner countries via bilateral Competent Authority agreements.

The report gives every relevant tax authority a consolidated picture of where the MNE group earns revenue, pays tax, employs people, and holds tangible assets, jurisdiction by jurisdiction.

On top of that sits the UAE-specific layer. Every UAE constituent entity of a qualifying group has to separately file an annual notification with the UAE Ministry of Finance, confirming who the Reporting Entity is and where the CbC Report is filed. That obligation holds regardless of where the report itself lands.

Why the data matters past the checklist

The data filed in a CbC Report flows into several downstream tax workflows. The Transitional CBCR Safe Harbour uses qualified CbC Report data to work out whether UAE Domestic Minimum Top-up Tax can be deemed zero for a jurisdiction, so errors in the report can knock the whole group out of the safe harbour. Tax authorities worldwide, the FTA among them, run the same data as their first risk-assessment filter when picking MNE groups for transfer pricing audit. And the aggregate UAE figures in the report should reconcile to the group’s UAE corporate tax return filings, because a material discrepancy between the two is exactly what flags immediate audit risk.

CbCR vs Master File vs Local File

CbCR sits within the broader OECD BEPS Action 13 three-tier documentation framework. The three documents have different scope but work together:

Our UAE transfer pricing guide covers Master File and Local File mechanics in detail.

Who actually has to file?

Who’s in scope

An MNE group is in scope for country by country reporting UAE if its consolidated group revenue equals or exceeds AED 3.15 billion in the fiscal year immediately preceding the reporting year. The threshold aligns with the OECD’s EUR 750 million equivalent and mirrors the UAE Pillar Two DMTT scope threshold.

Every UAE-resident or UAE-incorporated constituent entity of such a group must file the annual CbCR notification. This includes:

• A UAE-resident Ultimate Parent Entity
• A UAE-designated Surrogate Parent Entity
• Any UAE operating subsidiary, holding company, or branch of a foreign MNE group that meets the threshold

Who’s out

The following are fully outside CbCR scope:

• MNE groups with consolidated group revenue below AED 3.15 billion
• UAE-only groups with no foreign constituent entities
• Natural persons, non-juridical entities, and similar structures
• UAE entities of MNE groups where the UPE jurisdiction provides a valid secondary-filing exemption under a qualifying exchange agreement

There is no minimum number of foreign jurisdictions required. An MNE group with operations in just two countries — the UAE and one other — qualifies as a multinational group and is in scope if it meets the revenue threshold.

The compliance cycle, end to end

Step 1: Confirm scope — apply the threshold test

Use the MNE group’s consolidated annual revenue from the fiscal year immediately preceding the reporting year. A group with AED 3.3 billion in 2024 revenue is in scope for the 2025 reporting year.

Reassess annually — groups near the borderline can drift in and out of scope as revenue fluctuates.

Step 2: Identify all UAE constituent entities

Map every UAE legal entity that is part of the qualifying MNE group — subsidiaries, holding companies, branches, representative offices. Each must file the annual notification independently. Overlooking even one entity creates a separate AED 1,000,000 exposure.

Step 3: Determine the Reporting Entity

Establish whether the UPE is filing the CbC Report in its own jurisdiction, or whether a Surrogate Parent Entity (SPE) will be designated. The Reporting Entity decision directly shapes the notification content each UAE entity must submit.

Step 4: Set up UAE MoF portal access

File the notification electronically through the UAE Ministry of Finance portal. An authorized signatory for each UAE entity is required. First-time filers should allow two weeks for access setup — do not leave this to the final days before the deadline.

Step 5: Submit the CbCR notification

File by the last day of the MNE group’s financial reporting year. For calendar-year groups this is 31 December. The notification confirms the Reporting Entity identity, the filing jurisdiction, and the UAE entity’s role within the group structure.

Step 6: Prepare the CbC Report (if required)

UAE-resident UPEs and designated UAE SPEs must file the full CbC Report within 12 months of fiscal year-end. The report requires detailed financial and operational data for every jurisdiction in the MNE group.

Begin data collection immediately after fiscal year-end. Six months minimum lead time is realistic given the data volume.

Step 7: Generate and validate the OECD XML schema file

The CbC Report must be submitted in the OECD-specified XML schema format. Use specialised CbCR software or a group tax department system to generate the file. Validate against the schema before submission to prevent portal rejection.

Step 8: File through the MoF portal and retain confirmation

Submit the XML file through the Ministry of Finance portal. Capture and store the submission confirmation receipt.

Keep all supporting documentation — CbC Report, notification records, preparation workpapers — for a minimum of five years from submission date, as required by Cabinet Resolution No. 44 of 2020.

Keeping records for seven years is a common advisory practice recommendation, not a legal requirement under CbCR law. It can simplify multi-obligation audits where different UAE tax retention clocks apply.

Thresholds and deadlines at a glance

For calendar-year 2026 reporting:

What missing a deadline actually costs

Cabinet Resolution No. 44 of 2020 prescribes the following penalty schedule. These are the steepest fixed-amount penalties in the UAE tax framework.

[[chart:cbcr-penalties]]

The notification penalty and the report penalty each carry an AED 1,000,000 fixed component. However, Cabinet Resolution No. 44 of 2020 imposes a per-fiscal-year aggregate cap of AED 1,000,000 on the fixed components per entity.

This means a UAE subsidiary of a foreign MNE that misses its notification in the same fiscal year that its UPE also fails to file the CbC Report would face combined fixed penalties capped at AED 1,000,000 in total for that year. The daily accrual component (AED 10,000/day, capped at AED 250,000 per violation) runs separately on top of that aggregate cap and is not subject to it.

The three-table format

The CbC Report follows the OECD’s standardised three-table structure:

The full report must be submitted in the OECD XML schema format. Manual XML generation at scale is impractical — groups of any size use specialised CbCR software.

Example: a UAE-headquartered tech group

Scenario: A UAE-headquartered technology services group with the following profile:

• Consolidated group revenue in 2025: AED 4.2 billion (above the AED 3.15 billion threshold)
• Fiscal year: calendar year (1 January to 31 December)
• Constituent entities: UAE parent + subsidiaries in Saudi Arabia, India, United Kingdom, and Singapore
• UAE entity is the Ultimate Parent Entity

CbCR timeline for the 2026 reporting year:

[[chart:cbcr-timeline-2026]]

Table 1 data extract (illustrative figures, AED millions):

The UAE figures reconcile to the UAE corporate tax return: AED 280M profit before tax → first AED 375,000 at 0% = nil; remaining AED 279.625M at 9% = AED 25.17M corporate tax — consistent with the AED 25.2M tax paid shown in Table 1. This reconciliation step is mandatory before submission.

If the group also qualifies for the Pillar Two Transitional CBCR Safe Harbour for the UAE jurisdiction — low profit margin test, substance-based income exclusion — the CbC Report data supports the safe harbour claim directly.

Any material error in Table 1 UAE figures risks disqualifying the safe harbour and triggering full UAE corporate tax GloBE calculations.

When a Surrogate Parent Entity makes sense

A Surrogate Parent Entity (SPE) is a constituent entity designated to file the CbC Report in place of the UPE. SPE designation is most commonly used when:

• The UPE’s home jurisdiction does not have a CbCR exchange agreement with the UAE, or has not implemented CbCR domestically
• The MNE group is operationally centred in the UAE and wishes to centralise CbCR compliance here

How SPE designation works:

1. The MNE group formally designates the UAE constituent entity as SPE
2. The SPE notifies the UAE Competent Authority of its SPE role
3. All other UAE constituent entities notify that the SPE is the Reporting Entity
4. The SPE prepares and files the full CbC Report in the UAE within 12 months of fiscal year-end

For UAE-anchored MNE groups with foreign ultimate parents for historical structural reasons, UAE SPE designation can produce cleaner overall compliance. It also offers better alignment with the UAE’s corporate tax filing calendar than managing the filing in the UPE’s home jurisdiction.

Where CbCR data lands next: DMTT and TP audits

CbCR data feeds the UAE’s international tax compliance web. Inaccuracy in the CbC Report cascades into two high-value downstream areas:

Pillar Two DMTT — Transitional CBCR Safe Harbour

The UAE DMTT Pillar Two regime allows qualifying MNE groups to use the Transitional CBCR Safe Harbour to deem top-up tax zero for a jurisdiction during the transitional period. But this only applies if the CbC Report data is accurate and “qualified” within the OECD definition.

Groups that prepare inaccurate or late CbC Reports lose access to this safe harbour entirely. This forces full GloBE effective tax rate calculations that are much more complex and may result in substantial top-up tax charges.

Transfer pricing audit risk selection

The FTA uses CbCR data alongside Local File submissions and TP Disclosure Forms to risk-rank UAE constituent entities for transfer pricing audit. The specific red flags include:

• Low effective tax rates relative to group average (flags profit shifting concerns)
• High intra-group revenue with low pre-tax profit in the UAE jurisdiction
• Material headcount-to-profit imbalances across jurisdictions
• Inconsistencies between CbCR figures and Local File transaction amounts

Cross-document reconciliation — CbCR against Master File, Local File, TP Disclosure Form, and UAE corporate tax returns — before submission prevents the inconsistencies that trigger audit selection.

Where we see UAE groups slip up

The first slip is a UAE subsidiary assuming the whole thing rests with the overseas head office. The CbC Report may well be filed by the overseas UPE, but the annual notification obligation sits squarely with every UAE constituent entity, and this is far and away the most common source of UAE CbCR penalties.

The second is losing track of borderline threshold drift. A group operating near the AED 3.15 billion revenue line moves in and out of scope as year-on-year revenue shifts; one that was out in 2024 can be back in for 2025. So the threshold needs reassessing every year rather than settling it once and forgetting it.

The third is inconsistent data across the documentation tiers. CbCR data flows automatically into the FTA’s risk-assessment systems alongside Local File and TP Disclosure Form submissions, discrepancies get picked up algorithmically, and reconciling the documents against each other before filing is really the main thing standing between the group and audit selection.

The fourth is a missed SPE designation. UAE-anchored groups whose foreign UPEs lack adequate exchange agreements with the UAE often end up with CbCR compliance scattered across several jurisdictions. Designating a UAE SPE can pull the filing back into one place, but only if the group makes the designation through formal notification, because it never arises automatically.

The fifth is starting the report data collection too late. The 12-month window sounds generous until you begin: assembling Table 1 and Table 2 data across dozens of legal entities, multiple ERP systems, and varied local GAAP frameworks takes three to six months at a minimum, and that’s assuming nothing goes sideways. Beginning straight after fiscal year-end is the habit that keeps last-minute errors out.

One genuine edge case is the December 2020 effective date. Cabinet Resolution No. 44 of 2020 applies to fiscal years commencing on or after 1 January 2019, so groups that came into scope for the first time after the December 2020 resolution date should check they’ve filed notifications for all open periods. The obligation runs back to the 2019 commencement date, not the 2020 publication date.

Groups that run CbCR properly, with accurate data, on-time notifications and clean reconciliation, avoid the AED 1,000,000 penalty and keep their Pillar Two Transitional Safe Harbour eligibility intact, and they tend to sit lower down the FTA’s transfer pricing audit list as well. Set against the penalty and the safe harbour value at stake, the compliance spend is modest.

Reporting errors the FTA spots first

The CbCR process throws up a small number of recurring errors that the FTA and exchange-treaty partners spot quickly. Each is preventable with disciplined data governance.

Revenue classification is the first. Table 1 splits revenue between “related parties” and “unrelated parties,” and many groups misclassify treasury income, royalties from related entities, or intra-group service charges. What that produces is double counting, where the same revenue shows up once in the related column of the receiving jurisdiction and again in the unrelated column of the same one. Reconciling against the consolidated trial balance and eliminating intercompany transactions cleanly heads it off.

Tax paid and tax accrued get confused just as often. Tax paid is the cash figure; tax accrued is the current-year liability per the books, and the two diverge in any given year because of timing differences in payment cycles. Report one where the other belongs and you distort the jurisdictional effective tax rate that the safe harbour test leans on, so both columns need populating, each from its correct underlying ledger source.

Employee headcount drifts methodologically. The report wants headcount on a consistent basis across all jurisdictions, but some groups count full-time equivalents in the UAE and then switch to a person-by-person basis elsewhere. The OECD’s standard is full-time equivalents at year-end, or the average over the year; document whichever you use in Table 3 and apply it uniformly across every jurisdiction.

Tangible assets are another trap, because Table 1 requires them to exclude cash and cash equivalents, intangibles, and receivables. Leave the cash in and you inflate the asset base for cash-rich jurisdictions, which tend to be the holding companies, and that distorts the substance-based comparison that drives Pillar Two safe harbour eligibility.

The last one is completeness of the entity list. Table 2 has to include every consolidated entity, dormant ones, holding shells, and entities that earned nothing in the period alike. Drop a single legal entity and you’ve created a common audit finding and a frequent trigger for further review.

Lining up CbCR data with the DMTT Safe Harbour

The Transitional CBCR Safe Harbour under the UAE Pillar Two regime allows a jurisdiction’s top-up tax to be deemed zero where three tests are met using qualified CbC Report data:

• A de minimis test (revenue and profit below thresholds)
• A simplified ETR test (above 15% for 2024 returns, rising for later periods)
• A routine profits test (profit below a substance-based exclusion)

For the UAE jurisdiction in particular, the safe harbour tests are typically straightforward to satisfy provided the underlying CbC Report data is accurate. The relevant inputs come directly from Table 1: profit before income tax, income tax accrued, revenue, employees, and tangible assets.

The reconciliation discipline is to ensure these figures match the GloBE Information Return when the group eventually moves to full GloBE calculations after the transitional period.

Groups that prepare CbC Report and GloBE Information Return data in isolated workflows discover material differences during the transition. Build a single integrated data set sourced from the same ERP and consolidation system, with shared reconciliation logic feeding both reports.

The UAE Domestic Minimum Top-up Tax guide covers the substantive Pillar Two calculation. The CbCR workflow should feed it cleanly.

Who actually reads your CbC report — and what they do with it

A CbC report is not a filing that disappears into an archive. Under the exchange framework, every jurisdiction where the group operates can receive it automatically, and tax authorities run it through risk-assessment engines. Three downstream uses matter for UAE groups.

Treaty and withholding positions get cross-checked. When a group claims reduced withholding rates on royalties or interest flowing into the UAE, the source country’s authority can read the CbC report to see whether the UAE entity that “owns” the income actually shows employees, assets and profit there. A table 1 line showing thin substance next to fat related-party revenue is a classic challenge trigger — the mechanics of those claims are covered in our withholding tax UAE guide.

Financing structures light up. Jurisdictional splits of related-party interest income and expense make debt-loading visible at a glance. A UAE entity carrying heavy intercompany interest against modest EBITDA should expect the deduction to be tested under the UAE interest limitation rules — and to see the same ratio questioned by counterparty jurisdictions reading the same report.

Domestic audit selection feeds on it. The FTA’s risk engine consumes what the group files. Inconsistencies between the CbC report, the corporate tax return and the transfer pricing disclosure form are precisely the machine-detectable mismatches that drive selection — how that process runs from notice to assessment is set out in our FTA tax audit UAE guide.

The practical discipline this implies: before submission, read your own report the way a foreign auditor would. Any line where profit sits without people, or revenue sits without activity, needs a documented explanation ready before anyone asks.

If you’re in scope, here’s what to do this quarter

Most UAE SMEs are entirely outside CbCR scope. The AED 3.15 billion threshold ensures the obligation applies only to large multinational groups.

If your UAE business is part of a global group and you are unsure whether consolidated group revenue crosses the threshold, that determination should be made now, not at year-end.

If you are in scope, the practical actions are:

1. Confirm threshold status using the preceding year’s consolidated revenue figures
2. Identify every UAE constituent entity that must file the annual notification
3. Calendar both deadlines — notification by fiscal year-end, CbC Report within 12 months — with 60-day and 30-day advance reminders
4. Establish MoF portal access for each UAE entity’s authorised signatory well before the notification deadline
5. Coordinate with group head office on Reporting Entity designation and SPE decisions before the notification is due
6. Align CbCR data with UAE corporate tax returns and transfer pricing documentation before submission

For in-scope groups, the notification is the first and most commonly missed obligation. The report is typically a group tax function deliverable. Ensuring UAE entities fulfil the notification requirement is the immediate practical priority.

For questions about scope, notification preparation, or how CbCR aligns with your UAE corporate tax services and transfer pricing documentation, the FTA website and Ministry of Finance portal publish the current technical guidance.

For UAE accounting, VAT and corporate tax support, see Velmont Crest.

References:

1. UAE Ministry of Finance — Cabinet Resolution No. 44 of 2020 — governing instrument for UAE CbCR, MoF portal and submission procedures
2. UAE Federal Tax Authority — CbCR coordination with corporate tax filings and broader UAE tax compliance
3. UAE Government Business Portal — official guidance on UAE business obligations