Handling CbCR, and the penalties and impact of non-compliance