EU multinationals must prepare to meet new public disclosure obligations

Also known as Directive 2021/2101/EU, the CbC Directive came into effect in December 2021, requiring EU member states to alter their domestic laws in accordance with the Directive by June 2023. At the latest, the rules will apply to in-scope entities from the start of the first financial year commencing on or after 22 June 2024. For in-scope entities whose financial periods align with the calendar year, 2025 will be the first reportable period, although member states were entitled to set a shorter reporting deadline and some – such as Romania, Croatia and Sweden – have done so. In the case of Estonia, reporting will apply for financial years commencing on or after 22 July 2024.

The Directive has several aims, including to increase corporate transparency and enhance public scrutiny of MNEs, and to ensure trust in the fairness and transparency of member states’ tax systems while safeguarding a level playing field between EU and non-EU multinationals.

The genesis of CbC reporting can be found in the OECD’s Base Erosion and Profit Shifting project which saw non-public CbC reporting requirements come into effect for financial years commencing on or after 1 January 2016.

While the Directive is similar to non-public CbC reporting, public CbC reporting differs in some important respects and marks a significant change for non-EU MNEs with significant turnover doing business in the EU.

In-scope entities

A reporting obligation will be triggered for MNEs with consolidated turnover exceeding €750 million in each of the last two consecutive financial years where the ultimate parent undertaking is either based in the EU or in a third country and operates in the EU through a medium or large subsidiary or branch.

In addition, standalone undertakings operating in multiple member states which are not part of a group within the EU that meet the relevant size threshold will also be required to disclose.

Disclosure requirements

In the case of EU parented groups, the parent company must file a report in a publicly accessible commercial register in the relevant member state as well as on the applicable group websites. Member states can, however, opt to exempt companies from publishing the report on their websites in certain circumstances.

For non-EU parented groups, each of the qualifying EU subsidiaries or branches are required to disclose information for the in-scope group. However, these will be exempt from this obligation where the non-EU parent has published the report and assigned one of the EU subsidiaries or branches to file the report with their national commercial registry.

Where the subsidiary or branch is making the disclosure, a request may need be made by it to the non-EU parent for data to comply with the subsidiary or branch’s obligations under public CbC reporting. Where the non-EU parent does not provide all of the required information to the subsidiary or branch, the latter must publish the report based on all the information it possesses, along with a statement indicating that its parent did not make the necessary information available.

The information which must be disclosed in the report includes the name of the ultimate parent undertaking or standalone undertaking, a brief description of the nature of the activities, the number of full-time equivalent employees, the total revenues - including related party revenue - profit or loss before income tax, current income tax accrued, current income tax paid, and accumulated earnings at year end.

Information must be disclosed separately by jurisdiction for each country in the EU as well as each country on the EU list of non-cooperative jurisdictions – known as the ‘blacklist’ - or on the EU ‘grey list’ for two consecutive years. For all other jurisdictions, the information can be aggregated.

The report must be published no later than 12 months after the end of the financial year in question, although member states may opt for a shorter reporting timeframe.

Exemptions

There are a number of exemptions from the disclosure requirement, including groups operating solely within a single member state. This also includes instances where certain double reporting could arise. For example, for the banking sector, ultimate parent companies and standalone entities which are subject to Capital Requirements Directive IV are exempt from public CbC reporting where their existing disclosure covers all the entities included in their consolidated financial statement.

The Directive also contains a safeguard clause whereby member states can choose to allow in-scope groups to defer the disclosure of commercially sensitive information for a maximum of five years, although this does not extend to data relating to jurisdictions on the EU blacklist.

Implementation of public CbC reporting in selected member states

Ireland

The Directive came into effect in Ireland on 22 June 2023 by virtue of the EU Disclosure of Income Tax Information by Certain Undertakings and Branches Regulations 2023 (S.I. No. 322/2023). In line with the Directive, the public CbC rules apply to financial years commencing on or after 22 June 2024.

Ireland has opted to avail of the safeguard clause in the Directive thereby allowing companies to defer the disclosure of certain commercially sensitive information for a period of up to five years. For this provision to apply, the company must state that the inclusion of specific items of information would “seriously prejudice the undertaking’s competitive position”. As per the Directive, this does not extend to data related to jurisdictions on the EU blacklist.

In addition to undertakings operating exclusively in a single member state, non-EU parent groups with an Irish branch that has a net turnover of below €12 million in the last two consecutive financial years are exempt from the public CbC reporting requirements under the Irish rules.

The directors, management or other authorised persons have a collective responsibility to ensure that the public CbC reporting requirements have been met by the in-scope entity. Failure to comply with the 2023 Regulations would constitute a ‘category 3’ offence which, on conviction, could result in a fine of up to €5,000 and/or up to six months’ imprisonment.

Germany

Germany published its implementation legislation in the Federal Gazette on 19 June 2023 following approval from both the Lower and Upper Houses of Parliament and the signing of the law by the president. The implemented legislation has also been included in the German Commercial Code under Sections 342-342p. In line with the Directive, all in-scope MNEs must disclose the required information for all fiscal years commencing on or after 22 June 2024. 

Germany has opted to reduce the period during which commercially sensitive information can be excluded from disclosure from five years – as per the Directive – to four years. In addition, the maximum fine for non-compliance with public CbC reporting requirements under German rules has been increased to €250,000.

Luxembourg

The Directive came into effect in Luxembourg on 22 August 2023. Like Ireland and Germany, the new reporting obligations will apply to financial years commencing on or after 22 June 2024.

The Directive will apply to Luxembourg branches whose turnover is over €8.8 million in the last two consecutive financial years and whose head office has met the required conditions.

Luxembourg has also opted to allow companies to defer the disclosure of certain commercially sensitive information for a period of up to five years. Such omission of information for a given year should be clearly stated and the reasons for such omissions should be described. As per the Directive, this does not cover information related to jurisdictions on the EU blacklist.

Luxembourg has also exempted companies from publishing the report on their website if the information is available on the Luxembourg Business Register - registre de commerce et des sociétés - and the company website refers to it.

The potential fine in Luxembourg for not complying with the public CbC reporting obligations can range between €500 to €25,000. The board members - or ‘permanent representatives’ if a branch - are responsible for complying with such obligations.

Spain

The Spanish government published legislation to implement public CbC reporting on 22 December 2022 and, similar to the above member states, the first financial year of reporting for in-scope entities will be that commencing on or after 22 June 2024.

While the Spanish law generally follows the rules outlined in the Directive, it is stricter regarding the publication deadline than the Directive. Rather than the 12-month deadline outlined in the Directive, the required report must be made within six months following the end of the financial year.

Spain has also elected to allow in-scope groups to defer the disclosure of commercially sensitive information for up to five years in line with the safeguard clause in the Directive.

Netherlands

On 1 March 2024, the Dutch Decree on implementation of public CbC reporting was published. The Decree implements the Directive into Dutch domestic legislation and aligns with the content of the Directive.

The Decree includes the optional provision in the Directive which allows for a company to defer the disclosure of commercially sensitive information that would harm its competitive position for up to five years. This is allowed if the deferral is clearly justified in the report. The Decree does not, however, include the website publication exemption permitting companies to forego publishing the report on their own website.

Failure to comply with the public CbC reporting obligation is considered an economic offence, and civil law penalties can apply, as outlined in the Economic Offences Act (Wet op de economische delicten). Non-compliance could also lead to directors' liabilities.

In addition, any interested party can request the Dutch Court of Appeal Amsterdam to compel the relevant company to meet its obligations.

In line with the foregoing countries, reporting commences in the Netherlands for financial years beginning on or after 22 June 2024. For companies whose financial year aligns with the calendar year, this means their initial report will apply to the year 2025. This report must be publicly disclosed by 31 December 2026, both on the company's website and through the trade register of the Dutch Chamber of Commerce. The report must remain accessible on the website for at least five years.

Co-written by Werner Geißelmeier, David Maria, Gonzalo Gil Suarez and Steven Vijverberg of Pinsent Masons.