TL;DR

• Unregistered nexus in a state creates back-tax liability calculated on your gross sales into that state, not net revenue, which inflates the number beyond most finance teams' estimates.

• States add penalties that typically run 10 to 25 percent of the tax owed, applied on top of the base liability.

• Interest accrues on the combined tax-plus-penalty balance and compounds monthly or daily, growing every quarter you wait.

• Audit lookback periods typically run three to four years, and each additional year multiplies every other variable in the calculation.

• A Voluntary Disclosure Agreement entered before a state contacts you shortens the lookback window and waives penalties, turning an open-ended audit into a controlled, lower exposure.

When a State Notice Arrives: What Just Happened to Your Company

A Controller opens an envelope from a state department of revenue and reads a demand for back taxes, penalties, and interest covering a period the company never filed a return. The first reaction is usually confusion. The company has no office in that state, no employees there, and no record of registering. The notice tells a different story. The state has decided the company owed tax for years, and the clock on that liability started running long before anyone at the company knew it existed.

That gap between when liability begins and when a company discovers it is the heart of the problem. Sales tax obligations no longer depend on physical presence. After the Supreme Court's 2018 decision in South Dakota v. Wayfair, states can require a company to collect and remit sales tax based on economic activity alone. Most states set a threshold around $100,000 in sales or 200 transactions into the state in a year. Cross that line, and you have nexus, whether or not you ever set foot there.

A SaaS company selling subscriptions nationwide or an e-commerce brand shipping to all 50 states can trip these thresholds in a dozen states without a single physical connection to any of them. The obligation attaches automatically the moment sales cross the line. By the time a notice arrives, the company has often accrued three or more years of unfiled tax in that state. The question stops being whether you have a tax problem. It becomes how large the number already is.

How Back-Tax Liability Is Calculated

Three variables determine what you owe a state in back taxes, and you can estimate your own exposure by mapping each to your numbers. The first is your gross sales into that state over the period you had nexus. The second is the state's applicable tax rate. The third is the lookback period, meaning how many years back the state can reach. Multiply the first two and apply them across the third, and you have the base liability before any penalties or interest.

Each variable pushes the total in a direction finance teams tend to underestimate. A higher volume of sales into a state raises the base. A higher combined state and local rate raises it further, and that rate varies widely depending on the jurisdictions where your customers sit. The lookback period acts as a multiplier across both, because every additional year you owe applies the rate to another full year of sales.

The variable that consistently catches finance teams off guard is the base itself. Auditors apply the tax rate to your gross receipts into the state, not your net revenue. They do not subtract refunds, discounts, processing fees, or your cost of goods. They start from the top-line total of what you collected from customers in that state and calculate as though tax should have sat on every dollar of it.

That gross-versus-net distinction inflates the liability well beyond what an intuitive estimate produces. A Controller modeling exposure off net margin or net revenue will arrive at a number that understates the real figure, sometimes by a wide margin, because the auditor never touches the deductions that shrink net. The gap widens for low-margin e-commerce sellers, where net revenue is a fraction of gross and the tax still attaches to the whole.

When you map your own exposure, start from gross sales by state, apply the destination rate for each jurisdiction, and stretch that across the full lookback window the state allows. The result is your base liability. Penalties and interest, covered next, stack on top of that number rather than replacing any part of it.

Penalty Structures and Interest: How the Number Keeps Growing

The penalty and interest layer turns a base tax bill into a number that climbs every month you wait. Most states assess a penalty between 10% and 25% of the tax owed, often built from a late-filing penalty stacked on a late-payment penalty. A company that owes tax for several periods can face the penalty applied to each period separately, so the percentage compounds across the lookback window rather than landing once on the total.

Interest works differently and rarely stops growing. States charge interest on the combined balance of unpaid tax plus assessed penalty, and they accrue it from the original due date of each period, not from the date the state contacts you. Depending on the state, that interest compounds monthly or daily. The longer the gap between the original due date and the day you finally pay, the more interest has accrued on a balance that already includes penalty. A liability discovered four years late carries far more interest than the same tax discovered one year late, because each period has been compounding the entire time.

The lookback period sets how far back all of this reaches. Most states apply a standard lookback of three to four years, which means an auditor can assess tax, penalty, and interest for every period inside that window. Some states extend the lookback under specific conditions, such as fraud, willful non-filing, or no return ever having been filed for a tax the company was required to collect. Verify the lookback rules and any extension triggers with the relevant state department of revenue, because the conditions vary and a wrong assumption here understates your exposure by years.

Each additional year of lookback multiplies every other variable in the calculation. A longer window adds more periods of gross sales to the base, applies the penalty percentage to more periods, and gives interest more time to compound on each one. A single extra year does not add a flat increment. It scales the tax, the penalty, and the interest together, which is why a four-year lookback can produce a liability disproportionately larger than a three-year window on the same business. Treat the lookback length as the variable that determines the size of everything else, and confirm yours before you estimate the total.

What Triggers a Sales Tax Audit — and How States Find You

States rarely stumble onto unregistered businesses by accident. They run data-matching programs that compare information from multiple sources against their registration rolls, and a company that shows revenue in a state but holds no sales tax permit stands out immediately. A revenue department in one state can see your activity through several channels at once, which means the question is not whether they will find you but when.

Payment processors hand states a direct line into your sales activity through 1099-K reporting. When a processor files a 1099-K showing gross payment volume tied to a state, the revenue department matches that figure against its own records. A high transaction volume with no corresponding sales tax filing flags the account for review. Stripe, PayPal, and similar processors file these forms automatically, so the data reaches the state regardless of what you report.

Marketplace facilitator laws created a second reporting stream that exposes sellers indirectly. When Amazon, Shopify, or another marketplace collects and remits tax on your behalf, it reports the underlying seller activity to the state. A state can see that you sold into its jurisdiction through a marketplace, then ask why your direct sales through your own website went unreported. The marketplace data establishes that you have customers in the state, which undercuts any claim that you lacked nexus there.

Competitors and former employees supply another trigger that companies underestimate. Many states operate tip programs that reward or accept reports of non-compliant businesses, and a disgruntled former finance employee who knows your filing history makes a credible source. A single tip can open an inquiry that pulls in all the data-matching evidence the state already holds.

The most consequential mechanism is the information-sharing arrangement that links states to one another. States increasingly coordinate enforcement through reciprocal agreements and shared audit findings, so an audit in one jurisdiction does not stay contained. When an auditor in one state reviews your sales records, those records show where else you ship, where your customers sit, and which states you have crossed economic thresholds in. That information travels. An auditor who finds unregistered nexus in their own state often refers the case to neighboring states, and you can face simultaneous inquiries from several jurisdictions that learned about you from a single source.

Each of these mechanisms feeds the others, which is why waiting rarely works as a strategy. A company that stays quiet hoping to avoid notice is betting against payment processors, marketplaces, and a growing network of states that share what they find. The longer you wait, the more reporting cycles accumulate evidence of your activity, and the more states have a chance to compare notes.

Auditor-Calculated Liability vs. Self-Reported Liability: The Gap That Matters

The same unfiled tax produces two very different final numbers, and the only variables that change are who runs the calculation and when. When a state auditor finds you, the state controls every input in your favor's opposite direction. When you come forward first, you control the timing and the methodology. That control is worth more than most finance teams expect.

An auditor calculates liability to maximize collection. The auditor applies the full statutory lookback, often three to four years and longer where state law allows, and starts interest accruing from each original due date you missed. Penalties land at or near the top of the statutory range because the state, not you, initiated contact. The auditor also has no reason to accept your sales sourcing or exemption assumptions. When records are incomplete, the auditor estimates, and the estimate rarely favors the taxpayer.

Self-reporting reverses each of those inputs. You decide when to come forward, which fixes the lookback window at the date you initiate rather than letting it stretch as more quarters accrue. You prepare the sales-by-state calculation yourself, so the methodology reflects your actual transaction data instead of an auditor's estimate. Penalties are typically waived as a standard term of a voluntary disclosure agreement, and the lookback is often negotiated shorter than the audit default. You still owe the base tax and interest, but you strip out the two layers that grow the number fastest.

The dollar gap between these two paths is the core economic reason to act before a state makes contact. The base tax liability is roughly fixed either way, because it tracks your historical sales. The penalty layer and the extended lookback are not fixed. They are levers the state pulls only when it finds you first, and they disappear the moment you self-report through a VDA. Every quarter you wait narrows the gap in the wrong direction, because the eventual liability keeps growing whether or not a notice has arrived. Acting first does not erase what you owe. It removes the multipliers that turn a manageable number into a damaging one.

How a Voluntary Disclosure Agreement Works

A Voluntary Disclosure Agreement is the formal process a company uses to come forward to a state, report its unfiled tax, and settle the liability on negotiated terms before the state initiates contact. It works through four distinct mechanics, and a Controller can evaluate each one as a line item that changes the eventual cost.

The process starts anonymously. Your tax representative approaches the state on your behalf without naming the company, describes the general business profile and the nature of the exposure, and negotiates the terms before you ever identify yourself. You disclose the company name only after the state agrees to the framework, so you learn what the deal looks like before you commit to it. A state that has not yet identified you has no leverage to demand more.

The lookback period defines how many years of back tax the agreement covers, and it is the variable that moves the total liability the most. A standard VDA lookback typically matches the state's audit window of three to four years. Your representative can often negotiate a shorter window, which caps the number of years the state can reach back regardless of how long the company has actually had nexus. A company with seven years of unregistered nexus that negotiates a three-year lookback removes four years of tax, penalty, and interest from the calculation entirely.

Penalty waiver is a standard term of nearly every VDA. The state agrees to drop the 10 to 25 percent penalty it would otherwise apply, because the company came forward voluntarily rather than getting caught. That waiver alone often justifies the process, since penalties scale with the base tax and grow with each year of the lookback.

Interest is the one piece a VDA rarely eliminates. States generally still charge interest on the reduced tax base for the covered years, calculated from each period's original due date. A VDA is not a free pass. It is a structurally better deal than audit discovery, because it shrinks the lookback, removes the penalty, and leaves only the base tax and interest standing on a smaller number of years.

For companies with exposure across several states, the Multistate Tax Commission runs a National Nexus Program that offers a multi-state VDA pathway through a single application. The program lets you negotiate disclosure terms with multiple participating states at once rather than filing separate agreements state by state. Program terms, participating states, and standard lookback windows change over time, so verify the current terms at the MTC's site and confirm the specifics on each individual state department of revenue page before you draw conclusions about your own exposure. The mechanics above describe how VDAs generally function, but the exact lookback, penalty treatment, and interest rate are set by each state.

The Cost of Inaction: A Framework for Evaluating Your Exposure

Waiting is a decision with a price that grows every quarter. Each period you continue not filing in a state where you have nexus adds another quarter of tax to the eventual liability, plus another quarter of penalty accrual and compounding interest on top. The liability does not freeze while you decide whether to act. It expands on a schedule you do not set.

The most expensive consequence of waiting is losing access to a Voluntary Disclosure Agreement. A VDA stays available only until a state initiates contact with your company. Once an auditor sends a notice or a state opens an inquiry, you forfeit the shorter lookback, the penalty waiver, and the anonymity that a VDA provides. The same exposure that could have been resolved on favorable terms now gets resolved on the state's terms.

You control three variables right now, and they determine almost everything about your outcome. The first is timing, meaning how soon you act before any state reaches out. The second is scope, meaning which states you choose to address and in what order. The third is method, meaning whether you resolve the exposure through a VDA or simply register and file going forward. Each of these stays in your hands as long as no state has made contact.

Once an audit begins, those three variables are replaced by three you cannot touch. The auditor sets the lookback length within the state's statutory limits. The auditor applies penalties at the state's standard rate rather than waiving them. The auditor selects the calculation methodology, including whether to apply the rate to gross receipts and how to compound interest from the original due date.

The framework reduces to a single question. You can resolve a known liability on terms you negotiate, or you can wait and resolve an unknown liability on terms a state dictates. The exposure is the same dollars either way. The difference lies entirely in who holds the controllable variables when the resolution happens, and that depends on whether you move before a state does.

Running a Nexus Study Before a State Runs One on You

A nexus study replaces guesswork with a state-by-state map of exactly where your sales have crossed economic thresholds and where you still sit below them. The study pulls your transaction and revenue data, applies each state's current threshold rules, and tells you precisely which states you now owe tax in. Instead of estimating your exposure from a national revenue figure, you see liability broken out by jurisdiction, ranked from highest to lowest.

That ranking changes what you do next. A state where you crossed the threshold three years ago and have ignored it represents real back-tax exposure, and it belongs in the VDA column. A state you crossed last quarter carries far less accrued liability and usually calls for straightforward registration going forward. Sorting states into VDA candidates versus registration-only situations lets you spend your effort where the dollars actually sit, rather than treating every state as an equal emergency.

The study also tells you how much time you have. States that share data or run matching programs against your payment processor records pose a nearer-term audit risk, and those move to the front of the line. You enter every negotiation knowing your own numbers before a state shows up with theirs, which keeps you in control of the lookback period and the calculation methodology.

If you want to establish your actual exposure before a state makes contact, you can book a nexus review at taxwire.com/contact. A clear picture of where you stand turns an open-ended liability into a finite list of decisions you can act on this quarter.

FAQs

What is the typical lookback period for a sales tax audit?

A sales tax audit lookback period defines how many prior years a state can assess for unpaid tax, and most states reach back three to four years. Several states extend that window when a company never registered or never filed, because the statute of limitations only starts running once you file a return. Confirm the exact period with each state's department of revenue, since the rules vary by jurisdiction and by whether you ever registered.

Can I still file a VDA if I have already received a state inquiry?

In most cases, no. A voluntary disclosure agreement requires that you approach the state before it contacts you, and a state inquiry or audit notice usually disqualifies you for that jurisdiction. The disqualification is state-specific, so a notice from one state does not block a VDA in others where you still have unaddressed exposure. Act on the states that have not yet reached out before that option closes.

Does a VDA cover all states at once or do I need one per state?

You generally negotiate a separate VDA with each state where you have exposure, since each state administers its own tax and sets its own terms. The Multistate Tax Commission runs a National Nexus Program that lets you pursue agreements with multiple member states through a single application, which reduces the administrative load. Verify current participation and terms at the MTC's website and the relevant state department of revenue pages before you proceed.

How does my company's nexus exposure in one state affect other states?

Nexus is determined state by state, so crossing an economic threshold in one state does not automatically create liability elsewhere. The practical risk is enforcement, because states share taxpayer data and coordinate audits through information-sharing agreements. An audit that opens in one state can surface your sales volume into neighboring states and prompt them to examine your filings, which is why a single trigger often exposes liability across several jurisdictions at once.

Reviewed by Marco Puopolo, International Tax Lead. Last updated June 2026.