CbCR in the UAE — Who Must File a CbC Report, the Thresholds and the Notifications

CbCR — Country-by-Country reporting — applies in the UAE only to Multinational Enterprise Groups with consolidated group revenue of AED 3.15 billion or more in the preceding year, and only the UAE-resident Ultimate Parent Entity files. A UAE subsidiary of a foreign parent files nothing here. Everything below is how you confirm which side of that line you are on.

CbCR is one of those UAE compliance topics that generates far more anxiety than it should — and, in a small number of genuinely large groups, far less attention than it deserves. The phrase “who must file a CbC report in the UAE” gets typed into search boxes by finance managers at businesses that will never come close to the obligation, and occasionally missed entirely by the one subsidiary inside a billion-dirham structure that actually needs to act. The confusion is understandable.

The rules use words like “multinational,” “group” and “reporting” that sound like they could apply to almost any company with an overseas customer or a foreign shareholder. They don’t. CbCR is a deliberately narrow, large-group regime with a hard financial threshold, and once you understand the two tests that gate it, the whole thing becomes a short, answerable question. This guide walks through exactly which groups must file, who inside the group actually carries the obligation, and why a UAE subsidiary of a foreign parent usually owes nothing at all.

What CbCR (Country-by-Country reporting) is actually for

Country-by-Country reporting came out of the OECD’s work on base erosion and profit shifting — the concern that large multinationals could book profit in low-tax jurisdictions while carrying out the real economic activity somewhere else. The CbC report is the tool tax authorities use to see, at a glance, where a group earns its money and where it pays its tax. It is not an assessment, and it does not calculate anything owed. It is a risk-assessment map: revenue, profit, tax paid and accrued, employee headcount, capital and tangible assets, broken down jurisdiction by jurisdiction, for the whole group in a single return.

The UAE adopted this framework in line with the OECD standard, which is why the numbers and definitions will look familiar to anyone who has dealt with CbCR in another jurisdiction. The core design principle is that the report is filed once, for the entire group, by the entity best placed to see the whole picture — the Ultimate Parent Entity — and then shared between tax authorities through automatic exchange agreements. That “filed once, exchanged widely” design is the key to understanding why most UAE entities inside a multinational group do not file a full report themselves.

Get the scoping question right and CbCR is a manageable, once-a-year exercise for the handful of groups it touches. Get it wrong in either direction — over-scoping a mid-sized business into needless work, or under-scoping a large group past a deadline — and it becomes a problem out of proportion to the effort the correct answer would have taken.

The two tests that decide everything

Whether a group falls inside the UAE’s CbCR reporting regime comes down to two questions, applied in order. Both have to be answered “yes” before the obligation exists. Miss either and the group is out.

Test one — is it a Multinational Enterprise Group?

The first test is the multinational test. An MNE Group is a collection of enterprises, connected through ownership or control, that is required to prepare consolidated financial statements, and which has constituent entities resident or operating in two or more jurisdictions. The operative words are “two or more jurisdictions.” A group that operates entirely within the UAE — every entity resident here, every activity carried out here — is simply not multinational, and CbCR does not apply to it no matter how large it grows domestically.

This is the point where a great many UAE businesses can stop reading. A single-country group, even a substantial one, has no CbC obligation. Cross-border customers, foreign suppliers or an overseas individual shareholder do not by themselves make a group multinational — what matters is whether the group has constituent entities that are resident or operating in another jurisdiction and are consolidated into the group accounts.

Test two — is consolidated revenue AED 3.15 billion or more?

The second test is the size test. Even a genuine MNE Group only enters CbCR scope if its total consolidated group revenue for the immediately preceding financial year was AED 3.15 billion or more — the mechanics of measuring against the AED 3.15 billion Country-by-Country Reporting threshold are covered in their own guide. This dirham figure corresponds to the OECD’s EUR 750 million reference threshold. Below it, the group is out of scope.

The word that carries the weight here is “consolidated.” The threshold is measured against the group’s worldwide consolidated revenue — the top-line figure in the consolidated financial statements — not the revenue of the UAE entity in isolation. This is the single most misunderstood element of the whole regime, and it cuts both ways. A UAE company booking modest local revenue can sit inside a global group that clears AED 3.15 billion several times over, in which case the group is in scope. Equally, a UAE holding company that looks impressively large on a domestic view can fall comfortably below the line once its true consolidated global position is calculated.

Who inside a qualifying group actually files

Passing both tests puts the group in scope. It does not automatically make your particular UAE entity the filer. The obligation to lodge the full CbC report belongs to a specific entity, and identifying it correctly is what separates a full reporting duty from a lighter notification duty.

The default filer is the Ultimate Parent Entity (UPE) — the top entity in the group that consolidates the others and is not itself consolidated by any parent above it. The UPE files the CbC report in its jurisdiction of tax residence. So the clean, common cases are these:

• If the group is in scope and the Ultimate Parent Entity is UAE-resident, both duties fall here: that UAE parent files the notification at the group’s year-end and the full CbC report within 12 months. This is the classic “UAE headquartered multinational” case — and it is the only case in which a UAE entity carries a CbCR obligation at all.
• If the group is in scope but the Ultimate Parent sits in another country, the UAE constituent entities generally have no UAE CbCR duty at all — no local report and no notification. The report is filed by the parent in its home jurisdiction, and the UAE members of the group file nothing here.

This is where the UAE deliberately diverges from most CbCR regimes. When Cabinet Resolution No. 44 of 2020 replaced the original 2019 rules, it removed both the secondary local-filing route and the constituent-entity notification that the OECD model uses. The UAE law also contains no surrogate parent entity mechanism — the concept does not appear in it. Crucially, it removed the backstop most people expect to survive: the local-filing trigger for the case where the parent’s jurisdiction has no CbC exchange agreement with the UAE.

In the OECD model, and under the UAE’s own 2019 rules, that missing exchange relationship forced the UAE subsidiary to file the report locally. The 2020 amendment scrapped even that trigger. So the common assumption that a UAE entity of a foreign group must lodge something is usually wrong: if the ultimate parent is resident abroad and files at home, the group’s UAE members have nothing to file in the UAE — whether or not that home jurisdiction exchanges reports with the UAE.

The notification myth — and who actually owes one

Here is the distinction that resolves most of the confusion we hear. A CbC report and a CbC notification are two different things, with two very different levels of effort — we unpack the pair fully in CbC notification vs report in the UAE, and the dates that attach to each in our CbC filing deadline UAE guide.

The report is the full jurisdictional data return — revenue, profit, tax, people and assets, country by country, plus an entity-by-entity listing of the group. It is a real compliance project, drawing data from across the whole group. The notification, by contrast, is a short administrative filing that confirms the UAE-resident Ultimate Parent is the reporting entity, and in which jurisdiction the report will be lodged. That is essentially its whole job.

Here is the point most commentary gets wrong. In many countries — and under the UAE’s own original 2019 rules — every constituent entity of an in-scope group had to file a notification. The UAE removed that in 2020. Today both the notification and the report sit with the UAE-resident Ultimate Parent only. A UAE subsidiary of a foreign-parented group owes neither. The finance team’s instinct — “the parent files abroad, so we have nothing to do here” — is, in the UAE, usually correct. The trap runs the other way: reading an out-of-date guide (many UAE firm write-ups still describe the superseded 2019 position) and lodging a notification the law no longer asks for.

This is exactly the kind of scoping call we help clients get right through our CbC reporting support — establishing, for each UAE entity in a multinational structure, whether it is the UAE-resident ultimate parent that carries the full duty, or a member that owes nothing here, before any deadline is in play.

“

In the UAE, only a UAE-resident ultimate parent owes anything — both the notification and the report. A UAE subsidiary of a foreign-parented group owes neither. The expensive mistakes cluster where teams follow the OECD model, or the UAE’s superseded 2019 rules, and file something the current law never asks for. Settle where your ultimate parent is tax-resident first, and the workload sorts itself out.

Worked through: three groups, three answers

The regime is easier to hold onto through examples. Take three UAE businesses.

A domestic-only trading group. Several UAE entities, consolidated accounts, AED 900 million consolidated revenue, no entity resident or operating outside the UAE. It fails the multinational test at the first hurdle — one jurisdiction only. No CbC report, no notification. Out of scope entirely. Its size is irrelevant because it never becomes an MNE Group.

A UAE subsidiary of a foreign multinational. The UAE company books AED 40 million locally, but it belongs to a global group whose consolidated revenue is well above AED 3.15 billion, with the Ultimate Parent resident overseas and filing the CbC report there. The group is in scope — but the UAE subsidiary files nothing in the UAE. No report, and (unlike the OECD model) no notification either, because the amended UAE regime places both duties only on a UAE-resident ultimate parent — even where the parent’s jurisdiction has no exchange agreement with the UAE. Small locally, in scope globally, no UAE CbCR duty.

A UAE-headquartered multinational. The Ultimate Parent is UAE-resident, the group operates across several countries, and consolidated revenue exceeds AED 3.15 billion. This is the full-obligation case: the UAE parent files the complete CbC report here. Both tests passed, UPE in the UAE, full report due.

Three businesses, three clean outcomes — out of scope entirely, in scope but nothing to file in the UAE, and the full notification-plus-report — and in every case the answer fell straight out of the same two questions: is it multinational, and is consolidated revenue at or above AED 3.15 billion, followed by where the Ultimate Parent sits.

How CbCR sits alongside transfer pricing

CbCR does not live on its own. It sits inside the broader UAE corporate tax and transfer pricing landscape, and it is worth being precise about how the pieces relate, because they are frequently muddled.

Country-by-Country reporting and transfer pricing documentation tell overlapping stories at different resolutions. The CbC report is the wide-angle view — a group-level map of where profit and tax land across jurisdictions, used by authorities for risk assessment. Transfer pricing documentation, the master file and local file, is the close-up: it explains and justifies the pricing of transactions between related entities in detail. A large in-scope group can owe both, and the two should be internally consistent — the profit story a group tells in its CbC report should not contradict the one it tells in its transfer pricing files.

The crucial difference is reach. CbCR is threshold-gated at AED 3.15 billion of consolidated revenue, so it only ever touches large groups. Transfer pricing rules under the UAE corporate tax regime apply far more broadly, catching many businesses with related-party and connected-person dealings at much lower thresholds. That means a mid-sized UAE business can have real transfer pricing obligations while being nowhere near CbC reporting scope. The two are connected, but they are not the same test, and being out of scope for one says nothing about the other.

The practical scoping routine

For any UAE business that suspects it might have a CbCR obligation, the assessment is short and repeatable. Run it once a year, early, before any deadline is close.

Start with the multinational test. Does the group consolidate entities that are resident or operating in two or more jurisdictions? If the answer is no — a single-country group — stop. There is no CbC obligation, and there won’t be until the group crosses a border.

If the group is multinational, move to the size test. What was the group’s total consolidated revenue in the immediately preceding financial year? Pull the figure from the consolidated financial statements, not the UAE entity’s standalone accounts. If it is below AED 3.15 billion, the group is under the threshold and out of scope. If it is at or above, the group is in scope and you continue.

For an in-scope group, locate the Ultimate Parent Entity and its jurisdiction of tax residence. If the UPE is UAE-resident, both duties fall here — the notification at the group’s year-end and the full CbC report within 12 months. If the UPE is resident abroad, the UAE constituent entities have nothing to file here: the 2020 amendment removed both the secondary local-filing route and the notification that foreign-parented UAE members once owed, and the UAE regime has no surrogate parent entity mechanism to fall back on. The report is filed by the parent in its home jurisdiction — even where that jurisdiction has no CbC exchange agreement with the UAE.

Two lines of enquiry, one lookup of where the parent sits, and the obligation resolves into exactly one of three outcomes. The groups that get caught out are never the ones that ran this routine; they are the ones that assumed the answer without checking the consolidated number or the parent’s residence.

The deadlines and penalties, straight from Cabinet Resolution 44 of 2020

Everything above is scoping. This section is what happens once a UAE-resident Ultimate Parent is in scope and the clock starts. Every figure below is read from the published text of the Resolution rather than from a summary of it, with the article shown so you can check us.

The Competent Authority for UAE CbCR is the Ministry of Finance, not the Federal Tax Authority — a distinction that matters when a group goes looking for the right portal or the right correspondence address.

Read against the published text of Cabinet Resolution No. 44 of 2020 on 5 August 2026.

Three features of that schedule are worth pulling out, because they change how a group should sequence its year.

The daily penalties sit outside the cap. Article 8(3) caps total penalties for a reporting fiscal year at AED 1,000,000, but it explicitly excludes the daily accruals in Articles 8(1)(a) and 8(2). So the worst case is not AED 1,000,000 — it is AED 1,000,000 plus up to AED 250,000 of daily accrual on a late report, and potentially the same again on a late notification.

The notification carries the same headline penalty as the report. A short administrative filing that confirms who is reporting and where attracts the same AED 1,000,000 base figure as the full data return. Groups that treat the notification as the trivial half of the obligation are mispricing it badly.

And there is a grace period, but you have to be reachable to use it. Article 9(2) requires the Ministry to notify the entity in writing and grant 14 business days to remedy the violation before penalties are applied. That only helps a group whose registered correspondence details are current.

What the Ministry of Finance can ask for, and what will not excuse you

Cabinet Resolution 44 of 2020 gives the Ministry of Finance real inspection powers over a Reporting Entity, and they are broader than most finance teams expect from what looks like a once-a-year data return.

Under Article 6(1) the Ministry may request information from the Reporting Entity, or access its premises or place of work, to check that the information in the report is correct and complete, to confirm that anything omitted was left out for a valid reason, and to inspect the procedures the entity uses to comply. Article 6(2) lets it demand information, records, books or other documents in writing, with a response window of not more than 14 business days. Article 7(2) adds that where records are kept in a language other than English, an English translation must be provided on request.

Article 7(4) is the anti-avoidance provision. If the Reporting Entity enters into an arrangement or practice whose main purpose can reasonably be considered to be avoiding its obligations under the Resolution, it remains responsible as if it had never done so.

Article 9(3) allows a penalty to fall away where the entity satisfies the Ministry that it had a reasonable excuse, evaluated at the Ministry’s absolute discretion. Article 9(4) then closes two doors explicitly: insufficient funds to comply is not a reasonable excuse, and neither is the information being in the possession of a third party. That second one lands directly on the situation UAE finance teams most often find themselves in, waiting on group data from an overseas shared-service centre. It is not an excuse the Resolution recognises.

There is one provision that runs the other way. Under Article 10(4), if the Ministry fails to give written notice of its decision on an appeal within 60 business days of submission, the appeal is deemed successful and the penalty is cancelled.

Where this leaves your group

The honest headline on “who must file a CbC report in the UAE” is that most businesses reading the question don’t — and a small number who should be reading it more carefully do. CbCR is a large-group regime, gated behind a multinational test and an AED 3.15 billion consolidated-revenue threshold, with both the notification and the full report falling on a UAE-resident Ultimate Parent. Purely domestic UAE groups are out on the first test. Cross-border groups below the threshold are out on the second. And UAE entities inside qualifying foreign groups owe nothing here at all — no report and no notification — because the 2020 amendment placed both duties solely on a UAE-resident ultimate parent. That distinction is worth getting right, because the real risk is filing something the current law no longer asks for.

The right move is not to guess. Establish, each year, whether the group is multinational and whether consolidated revenue clears AED 3.15 billion, then confirm where the Ultimate Parent sits. Those three facts answer the whole question. Pair a clean CbCR assessment with disciplined transfer pricing documentation so the group’s profit story is consistent across both, and the compliance picture holds together rather than surfacing surprises at deadline.

Velmont Crest is a DED-licensed UAE accounting firm providing advisory and preparation support on corporate tax, transfer pricing and Country-by-Country reporting scope for mainland and free zone businesses. If you are unsure which side of the CbCR line your group sits on, we can help you run the assessment and prepare what is genuinely required — read more on our insights hub or get in touch via our contact page.

Disclaimer: Velmont Crest is a DED-licensed accounting firm providing advisory, preparation and compliance support services. We are not a law firm, the Federal Tax Authority, an FTA-registered tax agent, or a licensed financial-services provider, and this article is general information rather than advice for your specific circumstances. UAE Country-by-Country reporting rules, thresholds and deadlines are set and updated by the UAE Ministry of Finance and Federal Tax Authority — verify the current requirements against the official framework and consult a qualified professional before acting.

References

• UAE Ministry of Finance — Country-by-Country Reporting
• UAE Federal Tax Authority
• OECD — Country-by-Country Reporting (BEPS Action 13)
• UAE Government portal — Corporate Tax