prop · H40347 · 2016-12-06 00:00:00 — Notwithstanding the foregoing, a CbC Report is only required to be exchanged, if both have this Agreement in effect and their respective Jurisdictions have in effect legislation that requires the filing of CbC Reports with respect to the fiscal year to which the CbC Report relates and that is consistent with the scope of exchange provided for in Section 2. 3.Subject to paragraph 2, the CbC Report is to be exchanged as soon as possible and no later than 15 months after the last day of the fiscal year of the to which the CbC Report relates. 4.The Competent Authorities will automatically exchange the CbC Reports through a common schema in Extensible Markup Language. 5.The Competent Authorities will work towards and agree on one or more methods for electronic data transmission, including encryption standards, with a view to maximising standardisation and minimising complexities and costs and will notify the Co-ordinating Body Secretariat of such standardised transmission and encryption methods. Collaboration on Compliance and Enforcement A Competent Authority will notify the other Competent Authority when the first- mentioned Competent Authority has reason to believe, with respect to a Reporting Entity that is resident for tax purposes in the jurisdiction of the other Competent Authority, that an error may have led to incorrect or incomplete information reporting or that there is non- compliance of a Reporting Entity with respect to its obligation to file a CbC Report. The notified Competent Authority will take appropriate measures available under its domestic law to address the errors or non-compliance described in the notice. TRANSFER PRICING DOCUMENTATION AND COUNTRY-BY-COUNTRY REPORTING © 2015 ANNEx Iv TO ChAPTER v. COUNTRY-BY-COUNTRY REPORTING IMPLEMENTATION PACKAGE – 49 Confidentiality, Data Safeguards and Appropriate Use All information exchanged is subject to the confidentiality rules and other safeguards provided for in the Convention, including the provisions limiting the use of the information exchanged. In addition to the restrictions in paragraph 1, the use of the information will be further limited to the permissible uses described in this paragraph. In particular, information received by means of the CbC Report will be used for assessing high-level transfer pricing, base erosion and profit shifting related risks, and, where appropriate, for economic and statistical analysis. The information will not be used as a substitute for a detailed transfer pricing analysis of individual transactions and prices based on a full functional analysis and a full comparability analysis. It is acknowledged that information in the CbC Report on its own does not constitute conclusive evidence that transfer prices are or are not appropriate and, consequently, transfer pricing adjustments will not be based on the CbC Report. Inappropriate adjustments in contravention of this paragraph made by local tax administrations will be conceded in any competent authority proceedings. Notwithstanding the above, there is no prohibition on using the CbC Report data as a basis for making further enquiries into the ’s transfer pricing arrangements or into other tax matters in the course of a tax audit and, as a result, appropriate adjustments to the taxable income of a Constituent Entity may be made. To the extent permitted under applicable law, a Competent Authority will notify the Co-ordinating Body Secretariat immediately of any cases of non-compliance with paragraphs 1 and 2 of this Section, including any remedial actions, as well as any measures taken in respect of non-compliance with the above-mentioned paragraphs. The Co-ordinating Body Secretariat will notify all with respect to which this is an Agreement in effect with the first-mentioned Competent Authority. 1.In case an adjustment of the taxable income of a Constituent Entity, as a result of further enquiries based on the data in the CbC Report, leads to undesirable economic outcomes, including if such cases arise for a specific business, the of the Jurisdictions in which the affected Constituent Entities are resident shall consult each other and discuss with the aim of resolving the case. 2.If any difficulties in the implementation or interpretation of this Agreement arise, a Competent Authority may request consultations with one or more of the to develop appropriate measures to ensure that this Agreement is fulfilled. In particular, a Competent Authority shall consult with the other Competent Authority, before the first-mentioned Competent Authority determines that there is a systemic failure to exchange CbC Reports with the other Competent Authority. where the first mentioned Competent Authority makes such a determination it shall notify the Co-ordinating Body Secretariat which, after having informed the other Competent Authority concerned, will notify all . To the extent permitted by applicable law, either Competent Authority may, and if it so wishes through the Co-ordinating Body Secretariat, involve other that have this Agreement in effect with a view to finding an acceptable resolution to the issue. TRANSFER PRICING DOCUMENTATION AND COUNTRY-BY-COUNTRY REPORTING © 2015 50 – ANNEx Iv TO ChAPTER v. COUNTRY-BY-COUNTRY REPORTING IMPLEMENTATION PACKAGE The Competent Authority that requested the consultations pursuant to paragraph 2 shall ensure, as appropriate, that the Co-ordinating Body Secretariat is notified of any conclusions that were reached and measures that were developed, including the absence of such conclusions or measures, and the Co-ordinating Body Secretariat will notify all , even those that did not participate in the consultations, of any such conclusions or measures. Taxpayer-specific information, including information that would reveal the identity of the taxpayer involved, is not to be furnished. This Agreement may be amended by consensus by written agreement of all of the that have the Agreement in effect. Unless otherwise agreed upon, such an amendment is effective on the first day of the month following the expiration of a period of one month after the date of the last signature of such written agreement. A Competent Authority must provide, at the time of signature of this Agreement or as soon as possible thereafter, a notification to the Co-ordinating Body Secretariat: a)that its Jurisdiction has the necessary laws in place to require Reporting Entities to file a CbC Report and that its Jurisdiction will require the filing of CbC Reports with respect to fiscal years of Reporting Entities commencing on or after the date set out in the notification; b)specifying whether the Jurisdiction is to be included in the list of non-reciprocal Jurisdictions; c)specifying one or more methods for electronic data transmission including encryption; d)that it has in place the necessary legal framework and infrastructure to ensure the required confidentiality and data safeguards standards in accordance with Article 22 of the Convention and paragraph 1 and Section 5 of this Agreement, as well as the appropriate use of the information in the CbC Reports as described in paragraph 2 of Section 5 of this Agreement, and attaching the completed confidentiality and data safeguard questionnaire attached as to this Agreement; and e)that includes (i) a list of the Jurisdictions of the with respect to which it intends to have this Agreement in effect, following national legislative procedures for entry into force (if any) or (ii) a declaration by the Competent Authority that it intends to have this Agreement in effect with all other that provide a notification under paragraph 1e) of Section 8. must notify the Co-ordinating Body Secretariat, promptly, of any subsequent change to be made to any of the above-mentioned content of the notification. This Agreement will come into effect between two on the later of the following dates: (i) the date on which the second of the two has provided notification to the Co-ordinating Body Secretariat under TRANSFER PRICING DOCUMENTATION AND COUNTRY-BY-COUNTRY REPORTING © 2015 ANNEx Iv TO ChAPTER v. COUNTRY-BY-COUNTRY REPORTING IMPLEMENTATION PACKAGE – 51 paragraph 1 that includes the other Competent Authority’s Jurisdiction pursuant to subparagraph 1e) and (ii) the date on which the Convention has entered into force and is in effect for both Jurisdictions. 3.The Co-ordinating Body Secretariat will maintain a list that will be published on the website of the that have signed the Agreement and between which this is an Agreement in effect. In addition, the Co-ordinating Body Secretariat will publish the information provided by pursuant to subparagraphs 1a) and b) on the website. 4.The information provided pursuant to subparagraphs 1c) through e) will be made available to other signatories upon request in writing to the Co-ordinating Body Secretariat. 5.A Competent Authority may temporarily suspend the exchange of information under this Agreement by giving notice in writing to another Competent Authority that it has determined that there is or has been significant non-compliance by the second-mentioned Competent Authority with this Agreement. Before making such a determination, the first-mentioned Competent Authority shall consult with the other Competent Authority. For the purposes of this paragraph, significant non-compliance means non-compliance with paragraphs 1 and 2 of Section 5 and paragraph 1 of Section 6 of this Agreement and/ or the corresponding provisions of the Convention, as well as a failure by the Competent Authority to provide timely or adequate information as required under this Agreement. A suspension will have immediate effect and will last until the second-mentioned Competent Authority establishes in a acceptable to both that there has been no significant non-compliance or that the second-mentioned Competent Authority has adopted relevant measures that address the significant non-compliance. To the extent permitted by applicable law, either Competent Authority may, and if it so wishes through the Co-ordinating Body Secretariat, involve other that have this Agreement in effect with a view to finding an acceptable resolution to the issue. 6.A Competent Authority may terminate its participation in this Agreement, or with respect to a particular Competent Authority, by giving notice of termination in writing to the Co-ordinating Body Secretariat. Such termination will become effective on the first day of the month following the expiration of a period of 12 months after the date of the notice of termination. In the event of termination, all information previously received under this Agreement will remain confidential and subject to the terms of the Convention. Unless otherwise provided for in the Agreement, the Co-ordinating Body Secretariat will notify all of any notifications that it has received under this Agreement and will provide a notice to all signatories of the Agreement when a new Competent Authority signs the Agreement. Done in English and French, both texts being equally authentic. TRANSFER PRICING DOCUMENTATION AND COUNTRY-BY-COUNTRY REPORTING © 2015 ANNEx Iv TO ChAPTER v. COUNTRY-BY-COUNTRY REPORTING IMPLEMENTATION PACKAGE – 53 to the Agreement – Confidentiality and Data Safeguards Questionnaire A legal framework must ensure the confidentiality of exchanged tax information and limit its use to appropriate purposes. The two basic components of such a framework are the terms of the applicable treaty, Agreement (TIEA) or other bilateral agreement for the exchange of information, and a jurisdiction’s domestic legislation. 1.1 Tax Conventions, Agreements • Provisions in tax treaties, TIEAs and international agreements requiring confidentiality of exchanged information and restricting use to intended purposes How do the exchange of information provisions in your Tax Conventions, TIEAs, or other exchange agreements ensure confidentiality and restrict the use of both outgoing information to other Contracting States and incoming information received in response to a request? • Domestic law must apply safeguards to taxpayer information exchanged pursuant to Primary Check-list Areas a treaty, TIEA or other international agreement, and treat those information exchange agreements as binding, restrict data access and use and impose penalties for violations. How do your domestic laws and regulations safeguard and restrict the use of information exchanged for tax purposes under Tax Conventions, TIEAs, or other exchange instruments? How does the tax administration prevent the misuse of confidential data and prohibit the transfer of tax information from the tax administrative body to non-tax government bodies? The information security management systems used by each jurisdiction’s tax administration must adhere to standards that ensure the protection of confidential taxpayer data. For example, there must be a screening process for employees handling the information, limits on who can access the information, and systems to detect and trace unauthorized disclosures. The internationally accepted standards for information security are known as the “ISO/IEC 27000-series”. As described more fully below, a tax administration should be able to document that it is compliant with the ISO/IEC 27000-series standards or that it has an equivalent information security framework and that taxpayer information obtained under an exchange agreement is protected under that framework. TRANSFER PRICING DOCUMENTATION AND COUNTRY-BY-COUNTRY REPORTING © 2015 54 – ANNEx Iv TO ChAPTER v. COUNTRY-BY-COUNTRY REPORTING IMPLEMENTATION PACKAGE 2.1.1 Background Checks and Contracts • Screenings and background investigations for employees and contractors Primary Check-list Areas • Hiring process and contracts • Responsible Points of Contact What procedures govern your tax administration’s background investigations for employees and contractors who may have access to, use, or are responsible for protecting data received through exchange of information? Is this information publicly available? If so, please provide the reference. If not, please provide a summary of the procedures. 2.1.2 Training and Awareness • Initial training and periodic security awareness training based on roles, security risks, and What training does your tax administration provide to employees and contractors regarding confidential information including data received from partners through the Exchange of Information? Does your tax administration maintain a public version of the requirements? If so, please provide the reference. If not, please provide a summary of the requirement. Primary Check-list Areas • Departure policies to terminate access to confidential information What procedures does your tax administration maintain for terminating access to confidential information for departing employees and consultants? Are the procedures publicly available? If so, please provide the reference. If not, please provide a summary of the procedures. 2.2.1 : Access to Premises • Security measures to restrict entry to premises: security guards, policies, entry access What procedures does your tax administration maintain to grant employees, consultants, and visitors access to premises where confidential information, paper or electronic, is stored? Are the procedures publicly available? If so, please provide the reference. If not, please provide a summary of the procedures. 2.2.2 : Physical Document Storage Primary Check-list Areas • Secure physical storage for confidential documents: policies and procedures What procedures does your tax administration maintain for receiving, processing, archiving, retrieving and disposing of hard copies of confidential data received from taxpayers or exchange of information partners? Does your tax administration maintain procedures employees must follow when leaving their workspace at the end of the day? Are these procedures publicly available? If yes, please provide the reference. If not, please provide a summary. Does your tax administration have a data classification policy? If so, please describe how your document storage procedures differ for data at all classification levels. Are these procedures publicly available? If yes, please provide the reference. If not, please provide a summary. Primary Check-list Areas • Planning documentation to develop, update, and implement security information systems What procedures does your tax administration maintain to develop, document, update, and implement security for information systems used to receive, process, archive and retrieve confidential information? Are these procedures publicly available? If yes, please provide the reference. If not, please provide a summary. What procedures does your tax administration maintain regarding periodic Plan updates to address changes to the information systems environment, and how are problems and risks identified during the implementation of Plans resolved? Are these procedures publicly available? If yes, please provide the reference. If not, please provide a summary. TRANSFER PRICING DOCUMENTATION AND COUNTRY-BY-COUNTRY REPORTING © 2015 ANNEx Iv TO ChAPTER v. COUNTRY-BY-COUNTRY REPORTING IMPLEMENTATION PACKAGE – 55 Primary Check-list Areas • Configuration management and security controls What policies does your tax administration maintain to regulate system configuration and updates? Are the policies publicly available? If yes, please provide the reference. If not, please provide a summary. [/End question] • Access Control Policies and procedures: authorized personnel and international exchange What policies does your tax administration maintain to limit system access to authorized users and safeguard data during transmission when received and stored? Please describe how your tax administration’s access authorization and data transmission policies extend to data received from an exchange of information partner under a treaty or TIEA or other exchange agreement. Are the policies publicly available? If yes, please provide the reference. If not, please provide a summary. 2.6 Identification and Authentication Primary Check-list Areas • Authenticating the identifying users and devices that require access to information systems What policies and procedures does your tax administration maintain for each information system connected to confidential data? Are the policies and procedures publicly available? If so, please provide a reference. If not, please provide a summary. What policies and procedures govern the authentication of authorized tax administration users by systems connected to confidential data? Are the policies and procedures publicly available? If so, please provide a reference. If not, please provide a summary. 2.7 Audit and Accountability • Traceable electronic actions within systems Primary Check-list Areas • System audit procedures: monitoring, analyzing, investigating, and reporting of unlawful/ unauthorized use What policies and procedures does your tax administration maintain to ensure system audits take place that will detect unauthorized access? Are the policies publicly available? If so, please provide a reference. If not, please provide a summary. • Periodic and timely maintenance of systems Primary Check-list Areas • Controls over: tools, procedures, and mechanisms for system maintenance and personnel use What policies govern effective periodic system maintenance by your tax administration? Are these policies publicly available? If so, please provide a reference. If not, please provide a summary. What procedures govern the resolution of system flaws identified by your tax administration? Are these procedures publicly available? If so, please provide a reference. If not, please provide a summary. 2.9 System and Communications Protection • Procedures to monitor, control, and protect communications to and from information What policies and procedures does your tax administration maintain for the electronic transmission and receipt of confidential data. Please describe the security and encryption requirements addressed in these policies. Are these policies publicly available? If so, please provide a reference. If not, please provide a summary. TRANSFER PRICING DOCUMENTATION AND COUNTRY-BY-COUNTRY REPORTING © 2015 56 – ANNEx Iv TO ChAPTER v. COUNTRY-BY-COUNTRY REPORTING IMPLEMENTATION PACKAGE 2.10 System and Information Integrity • Procedures to identify, report, and correct information system flaws in a timely • Protection against malicious code and monitoring system security alerts What procedures does your tax administration maintain to identify, report, and correct information system flaws in a timely ? Please describe how these procedures provide for the protection of systems against malicious codes causing harm to data integrity. Are these procedures publicly available? If so, please provide a reference. If not, please provide a summary. • Processes used to test, validate, and authorize the security controls for protecting data, correcting deficiencies, and reducing vulnerabilities What policies does your tax administration maintain and regularly update for reviewing the processes used to test, validate, and authorize a security control plan? Is the policy publicly available? If so, please provide a reference. If not, please provide a summary. • Plans for emergency response, backup operations, and post-disaster recovery of What contingency plans and procedures does your tax administration maintain to reduce the impact of improper data disclosure or unrecoverable loss of data? Are the plans and procedures publicly available? If so, please provide a reference. If not, please provide a summary. • Potential risk of unauthorized access to taxpayer information Primary Check-list Areas • Risk and magnitude of harm from unauthorized use, disclosure, or disruption of the taxpayer information systems • Procedures to update risk assessment methodologies Does your tax administration conduct risk assessments to identify risks and the potential impact of unauthorized access, use, and disclosure of information, or destruction of information systems? What procedures does your tax administration maintain to update risk assessment methodologies? Are these risk assessments and policies publicly available? If so, please provide a reference. If not, please provide a summary. 2.14 Systems and Services Acquisition • Methods and processes to ensure third-party providers of information systems process, Primary Check-list Areas store, and transmit confidential information in accordance with computer security What process does your tax administration maintain to ensure third-party providers are applying appropriate security controls that are consistent with computer security requirements for confidential information? Are the processes publicly available? If so, please provide a reference. If not, please provide a summary. • Processes to protect information in printed or digital form Primary Check-list Areas • Security measures used to limit media information access to authorized users only • Methods for sanitizing or destroying digital media prior to disposal or reuse What processes does your tax administration maintain to securely store and limit access to confidential information in printed or digital form upon receipt from any source? How does your tax administration securely destroy confidential media information prior to its disposal? Are the processes available publicly? If so, please provide a reference. If not, please provide a summary. TRANSFER PRICING DOCUMENTATION AND COUNTRY-BY-COUNTRY REPORTING © 2015 ANNEx Iv TO ChAPTER v. COUNTRY-BY-COUNTRY REPORTING IMPLEMENTATION PACKAGE – 57 2.16 Protection of Treaty-Exchanged data (formerly Prevention of Data Commingling) • Procedures to ensure treaty-exchanged files are safeguarded and clearly labeled