Public country-by-country reporting (public CbCR) in the EU is not the same obligation as the confidential CbCR multinationals already file with tax authorities under BEPS Action 13. Since financial years starting on or after 22 June 2024, EU member states require groups with consolidated turnover above €750 million to publish — not just file — a breakdown of profit, tax accrued and tax paid, on a public website or in a company registry anyone can search. The first reports, covering FY2025, are being published through 2026 as groups hit their 12-month deadline. If your compliance function has only mapped this against the confidential CbCR threshold, it is very likely missing part of the scope.

Public CbCR vs. Confidential CbCR: Same Number, Different Law

Both regimes use the €750 million consolidated revenue threshold. That is where the overlap ends. Confidential CbCR (OECD BEPS Action 13) is a tax-administration filing: the ultimate parent files one report with its home tax authority, which exchanges it with other tax authorities under the CbC Multilateral Competent Authority Agreement — see our breakdown of how that threshold is actually applied by jurisdiction. Public CbCR, under Directive (EU) 2021/2101 (which amends the EU Accounting Directive 2013/34/EU), is company-law disclosure: the obligation sits with an EU entity — the parent, or in many cases a subsidiary or branch that never files a confidential CbCR report anywhere — and the output goes on the public record, not to a tax inspector.

That difference in legal basis explains two things compliance teams routinely get wrong: who the obligor actually is, and what enforcement looks like.

Who Has to Disclose Under the EU’s Public Country-by-Country Reporting Rules

Under the directive, three categories of EU entity can be caught once the group clears €750 million in consolidated turnover in each of the last two consecutive financial years:

• EU-headquartered ultimate parent undertakings. The obligation sits with the parent itself.
• Standalone EU undertakings above the threshold with no parent — a single large EU company that is itself the top of a multinational structure.
• EU subsidiaries and branches of a non-EU parent group above the threshold. This is the category that catches groups headquartered outside the EU — US, UK, Swiss and Asian multinationals included — that assumed public CbCR was a European-parent problem.

For that third category, the directive sets a separate, lower entry test for branches specifically. Ireland’s transposition, for example, applies the branch obligation once net turnover exceeds €12 million in each of the last two consecutive financial years — far below the group-level €750 million test, because it is a size test on the branch, not the group. A non-EU multinational with a modest branch or a medium-sized subsidiary in an EU member state can be required to publish even though no single EU entity looks anything like a €750 million company. Every member state sets its own subsidiary and branch thresholds in its own transposing law; there is no single EU-wide figure below €750 million, so this has to be checked jurisdiction by jurisdiction rather than assumed from one country’s rule.

The Scope Trap for Non-EU Groups

The practical failure mode: a US or UK group confirms its ultimate parent already complies with confidential CbCR and concludes public CbCR is “covered.” It isn’t. Confidential CbCR asks whether the ultimate parent files; public CbCR asks whether an EU subsidiary or branch, on its own, clears that entity’s national threshold. Those are two separate tests, usually administered by two different parts of the business — group tax for confidential CbCR, local finance or company secretarial for public CbCR — which is exactly how the second one gets missed until an EU registry filing deadline is already close.

What Must Be Disclosed — and the Disaggregation Gap Most Summaries Skip

The report has to show, for the relevant financial year: a short description of activities, number of employees, net turnover, profit or loss before tax, tax accrued, tax paid on a cash basis, and accumulated earnings. The part that gets flattened in most explainer content on this topic: that breakdown is not required for every country the group operates in.

Under the directive, full country-by-country disaggregation is only mandatory for each EU member state the group operates in, plus each jurisdiction on the EU list of non-cooperative jurisdictions for tax purposes. Activity in every other third country — the US, UK, Switzerland, Singapore, most of Asia and Latin America — can be reported as a single aggregated figure. A group with operations in thirty countries outside the EU and the blacklist can legally publish one combined line for all of them. That is a materially narrower disclosure than “full public CbCR,” and it is the single most common misconception non-specialist coverage of this directive creates: public CbCR in the EU is not full worldwide transparency. It is EU-plus-blacklist transparency, with everything else aggregated.

For tax-transparency advocates this gap is the directive’s most criticised design choice. For the multinationals it affects, it is the main lever that limits how much competitively sensitive geographic detail actually becomes public — and it is worth confirming explicitly in the report build, rather than defaulting to full disaggregation nobody required.

When: Transposition Is Finished, the Clock Is Now on Publication

The transposition deadline for member states was 22 June 2023, and the directive applies from the first financial year starting on or after 22 June 2024 — making FY2025 the first reporting year for most groups, with reports due within 12 months of the balance sheet date, so 2026 is the year most of those first reports are actually going public. A handful of member states moved earlier on their own initiative and are already a cycle ahead.

Transposition itself is no longer a live risk to track. By March 2025 the European Commission had closed the infringement procedures it had opened against the member states that missed the 2023 deadline, including the last three — Cyprus, Estonia and Slovenia — according to a legal update from Deloitte’s French law firm tracking the Commission’s infringement decisions on this directive. Every EU-27 member state now has implementing legislation in force. The open question for a compliance team today isn’t “will my member state adopt this” — it’s “did we correctly scope every EU entity against that state’s specific thresholds and publication channel.”

Two Levers in the Directive That Rarely Make the Checklist

Two provisions in the directive give companies more control over the disclosure than the “name and shame” framing suggests:

• Temporary omission of commercially sensitive items. Member states may let a company temporarily leave out specific information relating to a specific tax jurisdiction, for a limited period each member state sets in its own transposing law, where publishing it would seriously prejudice the group’s commercial position. This is not a blanket opt-out: the omission has to be clearly flagged and reasoned in the report, and the information must be published once the justification no longer applies.
• Publication channel. The directive lets a company satisfy the obligation by filing with the relevant business registry instead of — or alongside — its own website, with a reference on the company website pointing to the registry filing. Which channel a given member state actually requires or permits is set nationally, so it is worth confirming per entity rather than defaulting to a standalone website disclosure that draws more attention than the law requires.

What This Means for a Compliance Function Right Now

With transposition complete and the first reporting cycle underway, the open work for most groups is no longer legal monitoring — it is entity-level scoping. That means: listing every EU subsidiary and branch, checking each one against that specific member state’s branch or subsidiary threshold (not the €750 million group figure), confirming which publication channel that state requires, and deciding — deliberately, with a documented reason — whether any line item qualifies for temporary omission. None of that is work the confidential CbCR filing already did. Because the obligation sits in company law rather than tax law, enforcement in most member states runs through whichever body administers the business registry, not the tax authority — a structural difference from the sanctions regimes we covered for confidential CbC reporting penalties by country. Groups that treat public CbCR as a copy-paste of their BEPS Action 13 scoping are the ones that end up publishing late, in the wrong place, or with a gap a journalist or NGO notices before the company does.

Frequently Asked Questions

Is public CbCR in the EU the same as OECD Country-by-Country Reporting?

No. Both use a €750 million threshold, but OECD/BEPS Action 13 CbCR is a confidential filing with tax authorities. EU public CbCR, under Directive (EU) 2021/2101, is a company-law obligation to publish the data where anyone can read it. A group can be fully compliant with one and still be missing the other.

Does a non-EU multinational need an EU parent to be caught by public CbCR?

No. An EU subsidiary or branch of a non-EU group above the €750 million consolidated threshold can trigger the obligation on its own, once it clears that member state’s own branch or subsidiary size test — typically far below €750 million.

Do companies have to disclose a full country breakdown for every country they operate in?

No. Full disaggregation is required for EU member states and for jurisdictions on the EU list of non-cooperative jurisdictions for tax purposes. Activity in every other third country can be reported as one aggregated figure.

Have all EU member states implemented the directive?

Yes. The European Commission closed its last infringement procedures over late transposition — against Cyprus, Estonia and Slovenia — by March 2025. Every EU-27 state now has transposing legislation in force, though national thresholds, publication channels and deadlines still vary by country.