What Are Competent Authority Agreements for CbCR Exchange?

Competent authority agreements for CbCR exchange are the bilateral activations that let two tax administrations automatically send each other the Country-by-Country reports filed by large multinational groups in their jurisdiction. Without one in force between two countries, a CbC report filed in one stays there. As of March 2026, 114 jurisdictions have signed the Multilateral Competent Authority Agreement for CbC exchange, and over 100 use the OECD’s secure transmission system to move the files.¹ Signing the multilateral instrument is only the first step; the exchange between any two specific countries turns on when their bilateral relationship goes live and stays live.

The Legal Stack the Agreement Sits On

Three layers make an exchange legally possible.

At the top, the Multilateral Convention on Mutual Administrative Assistance in Tax Matters, developed jointly by the OECD and the Council of Europe, provides the overarching authority for tax cooperation and covers automatic exchange of information among participating countries.²

Under the Convention, the CbC Multilateral Competent Authority Agreement (the CbC MCAA) sets the specific rules for exchanging CbC reports. Instead of requiring a separate treaty between every possible pair of countries, the MCAA gives all signatories one common rulebook. When two countries have both signed the MCAA and completed the bilateral activation steps between them, CbC data can flow automatically.² Some jurisdictions rely instead on bilateral Tax Information Exchange Agreements or Double Taxation Conventions as the legal basis where the MCAA route is unavailable.

Below that, each country needs domestic authority to collect the report in the first place. In the United States, that authority runs from Internal Revenue Code Section 6038, with Treasury Regulation § 1.6038-4 translating it into the specific CbC filing obligation on Form 8975.³

How Activation Works, and How to Check It

Signing the MCAA does not by itself put a country on the receiving end of your group’s report. Before an exchange relationship goes live, each side reviews the other’s data safeguards and confirms the confidentiality, consistency, and appropriate-use conditions are met. The relationship then has to be activated bilaterally between the two competent authorities.⁴

For U.S. filers, the IRS publishes a Country-by-Country Reporting Jurisdiction Status Table that lists which jurisdictions are in negotiations, which have completed the data safeguards review, and which have a signed and active agreement. The table is the authoritative source for where U.S.-filed CbC data will be sent.⁵ The full text of each arrangement is published separately on the IRS Competent Authority Arrangements page.⁶

Watching the table matters. When a country moves from “in negotiations” to “active,” subsidiaries in that country will start receiving the group’s data and its tax authority may open transfer pricing risk inquiries on the strength of what it sees.

How the Exchange Actually Moves

Once a group files, the home country’s tax authority prepares digital files for every partner where the group has constituent entities. The data moves through the OECD’s Common Transmission System, a secure encrypted channel now used by more than 100 jurisdictions for CbC, CRS, and tax ruling exchanges.¹

The system uses public-key cryptography. The sender encrypts each file with the recipient’s public key, and only the intended recipient’s private key can decrypt it. The encryption standard is AES-256. Jurisdictions connect through a server-to-server link, a browser-based interface, or an API. An “Authorized Transmission” feature requires each competent authority to pre-approve which message types can be sent to and received from each partner, so data only reaches jurisdictions that have been cleared to receive it.¹

Timing

The OECD framework requires CbC reports to be exchanged within 15 months after the last day of the group’s fiscal year. For the first reporting period, jurisdictions generally allowed 18 months to give authorities time to stand up their systems. If a transmission fails, the sending authority receives an automated alert and must re-send or resolve compatibility issues promptly.

No Notice to the Taxpayer

The IRS does not tell a taxpayer when its CbC data has been exchanged with a specific partner, and the OECD framework does not require it. If a filer suspects a partner jurisdiction has disclosed or misused the data, the IRS provides a process to report those concerns, and instructs taxpayers not to include identifying information such as taxpayer identification numbers in those reports.³

What Partner Authorities Can and Cannot Do With the Data

A live agreement carries three conditions that the receiving jurisdiction has to keep meeting: confidentiality, consistency, and appropriate use. A country that fails on any of them can have its exchange relationships suspended and lose access to the data entirely.

Confidentiality means a legal and administrative framework that prevents unauthorized disclosure, including encryption at rest and in transit, physical server security, and restricted access. Assessments of a partner’s safeguards happen before activation and continue afterward.⁴

Appropriate use is the condition that matters most to the filer. Under OECD guidance, CbC data may only be used for three purposes: high-level transfer pricing risk assessment, assessment of other base erosion and profit shifting risks, and economic or statistical analysis where appropriate.⁷

The limits on the other side are just as important. A tax authority cannot treat the CbC report as conclusive evidence that transfer prices are right or wrong. It cannot use the data in place of a full functional and comparability analysis. And it cannot use the data to propose income adjustments on a formulary apportionment basis. The report can serve as a starting point for further inquiries in an audit, and no more.⁷

This is directly usable at the audit table. If a partner authority proposes a transfer pricing adjustment citing CbC data alone, the appropriate-use restriction gives the taxpayer a documented basis to push back.

When There Is No Agreement: The Local Filing Backstop

Where a competent authority agreement is missing, the report can still reach the foreign authority through a different route. Local filing is a backstop that lets a foreign jurisdiction require a local subsidiary of the group to file a CbC report directly with it, but only under narrow triggers: the parent’s jurisdiction has a legal instrument for automatic exchange but has not entered into a competent authority agreement within 12 months after the fiscal year end, or a “systemic failure” has occurred where the agreement exists but the parent’s jurisdiction has suspended or persistently failed to exchange. A foreign jurisdiction that does not itself meet the confidentiality, consistency, and appropriate-use conditions cannot demand local filing.³

A related point worth flagging: a foreign jurisdiction may set its own filing threshold in local currency, but it cannot require a local subsidiary of a U.S. group to file simply because the group crosses that local number when the group does not cross the U.S. $850 million threshold under Treasury Regulations.³ Where the U.S.-parented group is above the U.S. threshold and files Form 8975 with the IRS, whether that report reaches a particular foreign jurisdiction turns back on whether a competent authority agreement between the United States and that country is active.

1
OECD. Toolkit for the Implementation of the Standard for Automatic Exchange of Information
2
OECD. Convention on Mutual Administrative Assistance in Tax Matters
3
Internal Revenue Service. Frequently Asked Questions (FAQs) – Country-by-Country Reporting
4
OECD. Assistance for the Automatic Exchange of Information
5
Internal Revenue Service. Country-by-Country Reporting Jurisdiction Status Table
6
Internal Revenue Service. Competent Authority Arrangements
7
OECD. Guidance on the Appropriate Use of Information Contained in CbC Reports