A multinational group may have a technically strong transfer pricing policy, polished intercompany agreements and a local file running into hundreds of pages. But before a tax authority reads any of them, it may already have seen a much simpler picture.

One jurisdiction reports a substantial share of the group’s profit. Another employs most of the people. A third owns the factories and warehouses. The holding or intellectual-property entity has a small team but earns the highest margin. Related-party revenue dominates the group’s activity in an investment hub, while operating entities in larger markets earn comparatively modest returns.

None of this automatically means the transfer pricing is wrong. It does, however, create an obvious question:

Why is the profit there?

The OECD’s Corporate Tax Statistics 2026, released on 21 July 2026, shows how powerful Country-by-Country Reporting, commonly called CbCR, has become as a tax-risk tool. The latest anonymised dataset covers FY 2023 information for more than 9,400 multinational enterprise groups headquartered across 60 jurisdictions.

The report continues to identify mismatches between where multinational profits are reported and where employees and tangible assets are located, particularly in investment hubs. These are aggregate statistics, not findings against individual companies. Yet they demonstrate the analytical lens that tax administrations can apply to a group’s own confidential CbC report before deciding where to ask questions.

The practical message is not that profit must follow headcount mechanically. It is that profit, people, assets, risks and decision-making must form a coherent commercial story.

What Country-by-Country Reporting Actually Shows

CbCR was introduced under Action 13 of the OECD/G20 Base Erosion and Profit Shifting project. It applies to large multinational groups, generally those with consolidated group revenue of at least EUR 750 million or the domestic-currency equivalent under the applicable jurisdictional rules.

The ultimate parent or another permitted reporting entity prepares an annual report showing prescribed information for every tax jurisdiction in which the group operates.

This includes unrelated-party and related-party revenue, profit or loss before income tax, income tax paid and accrued, stated capital, accumulated earnings, number of employees and tangible assets other than cash. The report also identifies the constituent entities operating in each jurisdiction and their principal business activities.

This is not intended to replace the master file, local file or detailed transfer pricing analysis.

The master file explains the global business and transfer pricing framework. The local file analyses specific material transactions involving the local taxpayer. The CbC report gives the tax authority a high-level global dashboard.

And dashboards are useful because unusual patterns become visible quickly.

A jurisdiction with high profit but very limited employees may attract attention. So may sustained losses in an important operating market, significant related-party revenue in a low-substance entity, or a large return attributed to an entity whose reported activity is merely holding shares.

CbCR does not answer whether these outcomes are arm’s length. It tells the tax authority where to begin looking.

What the OECD’s 2026 Data Tells Us

The new publication contains several findings that matter for multinational tax governance.

Large multinational groups accounted for an average of 44.5% of total corporate tax revenues in 2023 across the 60 jurisdictions supplying relevant CbCR data. This was higher than the corresponding 42.8% share reported for 2017.

That figure helps explain the regulatory focus. Large multinationals are not a small or peripheral part of the corporate tax base. In many countries, they are central to it.

The OECD also found continuing differences between the distribution of profits and indicators of economic activity.

Across investment hubs, multinational groups reported approximately 25% of foreign profits, compared with around 6% of employees and 15% of tangible assets. By comparison, high- and middle-income jurisdictions held larger shares of employees and tangible assets than of reported profits.

Revenue per employee also remained substantially higher in investment hubs. The median was approximately USD 1.811 million per employee, compared with USD 477,000 in high-income jurisdictions, USD 211,000 in middle-income jurisdictions and USD 153,000 in low-income jurisdictions.

Related-party revenue represented more than 30% of total revenue in investment hubs. The comparable median proportions were approximately 20% in high-income jurisdictions, 14% in middle-income jurisdictions and 7% in low-income jurisdictions.

The predominant business activity recorded in investment hubs was holding shares or other equity instruments, which differs materially from the greater concentration of sales, manufacturing and services activities in other jurisdiction groups.

These figures do not establish that every investment-hub structure involves profit shifting. They do show why entities with significant profits, limited operational activity and substantial intragroup transactions are likely to receive attention.

A Mismatch Is a Risk Indicator, Not a Tax Adjustment

This distinction is critical.

CbCR was designed for high-level transfer pricing and BEPS risk assessment. A tax authority should not use the report alone to make a transfer pricing adjustment.

Headcount and tangible assets are important indicators of activity, but they are not the only drivers of profit. A capital-intensive business may earn significant income with relatively few employees. A valuable intangible may produce substantial returns without requiring a large physical asset base. A finance entity may manage a large loan portfolio through a specialised but small team.

Commercially valid differences therefore exist.

The OECD itself acknowledges several limitations. The aggregate data may be affected by differences in reporting practices, incomplete geographical disaggregation, inflation and economic turbulence. Profit figures may also be distorted by the inclusion of intragroup dividends in some jurisdictions.

The data must therefore be interpreted cautiously.

However, “the data has limitations” is not a useful defence where the group cannot explain its own numbers.

A tax authority looking at an individual CbC report will not ask whether every employee should produce the same amount of profit. It will ask why the entity receiving the return performs the economically significant functions, controls the relevant risks and possesses the capabilities required to earn that return.

That question comes directly back to the arm’s-length principle.

Legal Ownership Alone Cannot Carry the Profit Story

Consider a group that legally owns its global intellectual property through a company in a low-tax or investment-hub jurisdiction.

The IP entity receives substantial royalties from operating companies around the world. Its CbCR profile shows high profit, limited employees and few tangible assets.

This may be commercially defensible, but only if the wider facts support it.

Who decides which technology will be developed? Who approves the research budget? Who evaluates and manages development risk? Who controls legal protection and infringement strategy? Who makes decisions about enhancement, maintenance and commercial exploitation? Does the IP owner have suitably qualified people to control these matters, or are the important decisions actually taken elsewhere?

Under the OECD transfer pricing framework, returns from intangibles depend on the functions relating to their development, enhancement, maintenance, protection and exploitation, often referred to as the DEMPE functions. Legal title is relevant, but it does not automatically entitle an entity to all residual profit.

A licence agreement stating that the hub “owns all IP risk” will be of limited assistance if the people controlling the risk sit in India, the United States, Germany or another operating jurisdiction.

CbCR makes the gap visible. The local file and functional analysis must then explain it.

Finance and Holding Companies Need More Than a Registered Address

A similar issue arises with treasury and holding structures.

An investment hub may contain the group’s financing company, regional holding company or acquisition vehicle. Such entities can perform genuine commercial functions. They may raise external funding, manage liquidity, analyse credit risk, coordinate investments and exercise shareholder oversight.

But the return must reflect what the entity actually does.

Suppose a finance company earns a large interest spread from loans to group entities. It has two employees, while funding decisions, borrower evaluation, covenant monitoring and refinancing strategy are handled by the parent company’s treasury team elsewhere.

The finance company may legally own the loans, but the transfer pricing analysis must determine who controls the economically significant financial risks and provides the capital.

The same applies to holding companies. Receiving dividends or capital gains does not necessarily indicate aggressive tax planning. But charging management fees, earning strategic returns or claiming entrepreneurial status requires evidence of genuine decision-making and capability.

A board meeting schedule, by itself, is not substance. The board must actually understand, evaluate and decide the matters allocated to it.

Principals and Regional Hubs Must Match the Operating Reality

Many multinational groups use a principal structure.

A central company owns inventory or intangibles, sets commercial strategy, bears market risk and engages limited-risk distributors or contract manufacturers in other jurisdictions. The principal earns the residual return, while the operating entities earn routine margins.

This can be entirely consistent with the arm’s-length principle.

The problem begins when the principal’s contractual profile does not match the actual conduct.

If local teams negotiate critical customer terms, decide pricing, manage inventory exposure, control marketing strategy or resolve key supply-chain risks, their functions may be more valuable than the routine characterisation suggests.

Imagine a regional principal reporting substantial profit with 20 employees, while its Indian distributor employs 500 people and manages sales, marketing, customer credit and after-sales support. The headcount difference alone does not determine the outcome. But it invites a closer examination of where commercial decisions and risks are actually controlled.

The CbC report supplies the aerial view. The transfer pricing study must explain the business at ground level.

Routine Captives Are Not Outside the CbCR Discussion

Indian captive service providers, R&D centres and contract manufacturers may assume that CbCR is primarily a concern for low-tax holding or IP entities.

That is too narrow.

A captive entity described as a limited-risk service provider would ordinarily be expected to earn a stable routine return, subject to its actual functions and economic conditions. If the CbCR repeatedly shows losses or unusually low profitability in that entity while the overseas principal earns substantial returns, the pattern may attract questions.

There may be valid explanations: exceptional employee costs, unused capacity, a major project failure, foreign exchange movements or an unexpected business disruption.

The issue is whether these events were properly allocated under the intercompany agreement and arm’s-length conduct.

Would an independent limited-risk provider absorb the entire loss? Did the overseas principal control the decisions that created the cost? Was a year-end true-up required? Were extraordinary costs separated from the routine cost base?

A year-end transfer pricing report cannot repair an operating model that was never implemented in the accounts.

Why the Master File, Local File and CbCR Must Reconcile

The greatest practical risk is often not an aggressive policy. It is inconsistency between different sources of information.

The CbCR may identify one company as carrying out R&D. The master file may describe another company as controlling product development. The local file may characterise the Indian entity as providing routine software services, while employee profiles show that its senior leaders approve product architecture and global roadmaps.

The financial numbers can also diverge.

CbCR revenue may not reconcile with consolidated reporting. The local-file tested-party margin may be calculated from management accounts that do not bridge clearly to statutory accounts. Employee numbers may be reported differently across HR and tax systems. Tangible assets may be classified inconsistently.

Each difference may have an innocent explanation. Together, they can look like poor control.

A multinational group should therefore carry out a pre-filing CbCR risk review, not merely a form-completion exercise. The review should test whether the master file, local files, intercompany agreements, statutory accounts, tax returns and CbCR present one consistent description of the business.

Consistency does not mean repeating the same words. It means that different documents do not contradict the underlying economic reality.

What Tax Authorities Can See Before an Audit Begins

CbCR changes the sequence of a transfer pricing review.

sequence of a transfer pricing review.

Historically, an authority might begin with the taxpayer’s return, request the transfer pricing report and then develop questions from the documentation.

Today, it can use CbCR to identify risks before requesting the local file.

It can compare profit per employee across the group. It can identify jurisdictions with large related-party revenue. It can examine whether tax accrued appears proportionate to reported profit. It can see where entities are classified as holding companies, finance companies, R&D centres or service providers.

The tax authority still needs a proper legal and factual analysis before making an adjustment. But the initial questions can be far more targeted.

This makes the first response to an audit increasingly important. The company may need to explain a global pattern, not merely defend one transaction.

A Practical CbCR Readiness Review

Multinational groups should begin with a simple visual map showing each jurisdiction’s revenue, profit, tax, employees, assets and principal activities.

The purpose is not to force every ratio into alignment. It is to identify where a reasonable tax authority would ask for an explanation.

Each significant mismatch should then be connected to the group’s functional analysis. A high-profit IP entity should be linked to DEMPE functions and risk control. A finance hub should demonstrate treasury capability and decision-making. A low-margin distributor should have a factual limited-risk profile. A captive service provider’s profitability should reconcile with the agreed cost base and true-up mechanism.

Groups should also test the data itself. Employee counts, entity classifications, permanent establishments, stateless income, intercompany dividends and related-party revenues require particular care.

Finally, explanations should be written before filing. “We will work it out if the tax authority asks” is no longer a sensible documentation policy.

Conclusion: CbCR Does Not Require Perfect Symmetry, but It Requires Credibility

The OECD’s 2026 statistics do not prove that investment hubs are inherently abusive or that every profit concentration reflects BEPS.

They do show that tax administrations now have a powerful body of comparative data to evaluate multinational structures. The dataset is wider, more detailed and increasingly capable of showing where profit appears disconnected from employees, assets and ordinary business activities.

For businesses, the correct response is not to push profit mechanically toward the largest workforce or physical asset base. That would be as crude as ignoring substance altogether.

The correct response is to ensure that profit follows value creation under the arm’s-length principle. People who make important decisions, assets that enable the business, intangibles that generate returns, capital that bears risk and entities that control those risks must fit into one coherent model.

A CbC report is not a verdict.

But when profit, people and assets tell three different stories, it is often the document that tells the tax authority where to start reading.