CbC and GIR: How to manage 3 reporting streams from a single source

Country-by-Country Reporting is no longer a single reporting requirement. There are now three. Starting with the 2024 reporting year, your group must file not only the confidential CbC report with the Tax Authority but also a public version with the Chamber of Commerce. Starting this year, the Pillar Two surtax information return has been added to this list. Three streams that are partly derived from the same financial data, but each has its own format, channel, and deadline. Anyone who handles them separately runs the risk of a mismatch every reporting season.

The three streams at a glance

Stream 1: CbC to the Tax Authority

Since 2016, multinational groups with consolidated revenue of at least €750 million have been required to file an annual CbC report with the Tax Authority. This obligation stems from OECD BEPS Action 13 and the subsequent EU Directive 2016/881. For each country, you must report, among other things:

• Revenue (internal and external)
• Pre-tax profit
• Income tax paid and due
• Paid-in capital and retained earnings
• Number of employees
• Tangible assets

Submission takes place in XML via Digipoort, within twelve months after the end of the reporting year. This data stream is confidential and is sent only to the tax authorities. The Tax and Customs Administration then automatically exchanges the information with foreign tax authorities.

Stream 2: Public CbC with the Chamber of Commerce

Since the 2024 reporting year, EU Directive 2021/2101—the public CbC—has also applied to in-scope groups. This requires you to file an abridged CbC report publicly with the Chamber of Commerce’s Trade Register. The report is accessible to everyone, including competitors, journalists, NGOs, and investors. The public CbC partially overlaps with the confidential version but differs in a few respects:

• A more limited number of data points
• Different aggregation rules for jurisdictions outside the EU
• Mandatory filing with the Commercial Register, not in XML via Digipoort

The filing deadline is twelve months after the end of the reporting year.

Stream 3: Additional Tax Assessment Information Return (GIR)

The Minimum Tax Act 2024, the Dutch implementation of Pillar Two, has been in effect since 2024. For in-scope groups, this means a third reporting stream: the GIR (GloBE Information Return), also known in the Netherlands as the supplementary tax information return (BIA). The first deadline is June 30, 2026, for calendar-year groups that were already in scope in FY2024.

The GIR requires data per jurisdiction, such as revenue, GloBE income, taxes paid, ETR calculation, and any safe harbor application. Submission takes place in XML via Digipoort. Some of the data overlaps with the CbC, while other data comes directly from the consolidation and financial statements.

Where Things Go Wrong in Practice

The three data streams require comparable information, but this data cannot simply be extracted from a single spreadsheet. Here’s what we frequently see in practice:

1. Mismatches between the Chamber of Commerce and the Tax Authority: The public CbC is available at the Chamber of Commerce, while the confidential CbC is held by the Tax Authority. If you make a correction in one stream but not in the other, an unexplained discrepancy arises that journalists or regulators may notice. A single difference between what is publicly available and what the Tax Authority receives is enough to trigger an inquiry letter.

2. Last-minute corrections without an audit trail: Tax teams often work with separate Excel files that are updated manually. It is difficult to determine who made the correction, on what basis, and whether it was also implemented in the other data streams.

3. A GIR that does not match the CbC: The Tax Authority uses CbC data as the basis for risk selection under Pillar Two. If your GIR data per jurisdiction differs from what is in your CbC, that is an immediate red flag for further scrutiny. The alignment must be explicit, even where definitions differ slightly.

4. Multiple parties handling the same data: Often, finance, tax, and compliance teams work in different systems with different data exports. What appears in the financial statements does not always align one-to-one with what is reported to the CbC, and that, in turn, does not always align with what ends up in the GIR. Without a common data source, version control is a chronic source of errors.

One source, three outputs

The sustainable solution does not lie in better spreadsheets or more last-minute reviews. It lies in centralizing the sources from which all three data streams draw. Specifically, this means:

• One validated dataset per entity per jurisdiction, with fixed definitions that align with all three data streams.
• Automated mapping of that dataset to the three formats (XML for the Tax Authority and GIR, the Chamber of Commerce format for public CbC).
• XML validation prior to submission, so that rejections do not surface only after the filing with the Tax Authority.
• An audit trail for every change, with version control per entity, per jurisdiction, and per flow.

For groups with multiple entities or more complex structures, the difference between “three separate spreadsheet projects” and “a single pipeline with three data requests” grows every year. Not only in terms of hours, but also in terms of compliance risk.

How SureSync works in this context

SureSync connects source systems, validates data against the relevant schemas, and generates reports in the format expected by the recipient. For multinational groups, this means: a single platform that can simultaneously submit your CbC report to the tax authorities, your public CbC filing with the Chamber of Commerce, and your GIR filing for Pillar Two. Want to know how you can manage all three submissions through a single pipeline? Schedule a consultation with our experts.