What's the look-back period for unfiled sales tax, state by state?

What "look-back" actually means for unfiled sales tax

A pattern at TaxCloud: a brand walks into the exposure conversation assuming a three-year look-back applies the same way the federal income tax SOL does. The exposure number gets sized against three years of sales, the CFO approves a reserve, and the analysis moves on. The fact that reframes most of those estimates is that for an unregistered seller, the statute of limitations never started. In most states, the SOL clock runs from the filing date of a return, not from the date nexus was triggered. No return filed means no clock running.

This is statute, not policy. Cal. Rev. & Tax. Code §6487 begins the three-year limitations period "after the last day of the calendar month following the quarterly period for which the amount is proposed to be determined". For a brand that filed, that bounds exposure. For a brand that never registered and never filed, Cal. Rev. & Tax. Code §6487(a) caps the assessment period at eight years rather than leaving the obligation open indefinitely. NY Tax Law §1147(b) sets a three-year limitations period on assessments "from the date of the filing of a return"; where no return was filed, the Department of Taxation and Finance can assess at any time. Tex. Tax Code §111.201 establishes a four-year limitations period running from the later of the due date or the filed date; §111.205 makes that limit inapplicable when no return is filed or when the return was fraudulent.

The framing implication: for a $40M Shopify Plus brand that crossed California's $500,000 economic nexus threshold in 2020 and never registered, the state can reach back to 2020 in 2026. The default three-year shape does not apply. The exposure window is bounded by when nexus was triggered, not by a fixed SOL clock.

Two operator notes from this vantage point. First, the look-back number is the single largest driver of the exposure estimate; varying it by one year shifts the total by 25% to 33%. Second, this is also why a voluntary disclosure agreement carries asymmetric value for unregistered sellers: it converts an open-ended exposure into a contractually capped figure, which is the move covered in H2-3.

The default look-back for registered late filers, state by state

For brands that registered and filed late, or filed inaccurately, each state runs a fixed SOL from the return due date or filing date, whichever the statute specifies. The default falls into two clusters: three-year states and four-year states. The table below covers the states that most frequently appear in mid-market remediation portfolios.

The pattern across the grid: three-year states (CA, NY, IL, FL, MA, PA, GA, CO, NC, TN, VA, MO, CT, SC) and four-year states (TX, WA, OH, MI, WI, AZ, MD, NJ, KY, NV) dominate. The 50-state version lives at 50-state economic nexus thresholds reference, which also captures per-state measurement basis and statute citations for the threshold side of the analysis.

Two operator notes on the registered-late-filer scenario. First, the SOL applies per return period. A brand that registered in 2022 and filed every period since but filed inaccurately faces a three- or four-year reach back from each return's filing date, not a single three-year window. Second, the "substantial omission" extension (typically activated when the omitted tax exceeds 25% of the tax shown on the return) is the most common path from a clean three-year exposure into a six-year exposure. Brands that filed registered but understated taxable sales by more than a quarter should model both the three- and six-year windows in the workpaper.

How a VDA compresses the look-back to a fixed window

The pattern TaxCloud sees in M&A diligence and pre-audit cleanup is consistent: a brand maps its multi-state exposure and finds that the largest single variable is the look-back assumption, not the tax rate, taxable-mix percentage, or penalty schedule. Compressing that variable is what a voluntary disclosure agreement does, and it is the core value proposition compared with standard late registration.

A VDA is a contract between the taxpayer and the state's Department of Revenue under which the state caps look-back at a fixed window (commonly three years for three-year-SOL states and four years for four-year-SOL states), waives penalties, and grants immunity for all periods before the contractual lookback. In exchange, the brand discloses unfiled periods, files back returns covering the capped window, and pays the underlying tax owed plus interest.

The compression math is where the value shows up. A brand that crossed California's $500,000 threshold in 2019 and never registered faces six full calendar years of open look-back through 2025 under the default unregistered posture. Under a California CDTFA VDA, the look-back caps at three years prior to the application date. On a $300,000 annual California liability, that converts roughly $1.8M of gross tax exposure into $900,000 of contractually bounded exposure, plus the 10% failure-to-file penalty under Cal. Rev. & Tax. Code §6591 is waived in full. The decision math, including the per-state professional-fee crossover, is covered in When does a voluntary disclosure agreement beat standard registration? and How to build a defensible back-tax exposure estimate, state by state.

The SSUTA §402 provision is the one most operators miss. The Streamlined Sales Tax Agreement provides amnesty for qualifying sellers who register for the first time through the SST registration system, with the protection bounded by the seller's registration date and the state's specific implementation of §402. For brands with modest exposure across multiple SST states, the SST registration path can deliver effective amnesty for the prior period without a separate VDA in each state. The 24 SST member states (23 full members and 1 associate member) handle this through the consolidated CSP registration process, which is the structural reason direct SST registration through a Certified Service Provider often beats a per-state VDA in low-exposure SST states. TaxCloud is one of the program's Certified Service Providers and the registration apparatus runs through the SST consolidated process.

Fraud and willful evasion: when the SOL disappears entirely

Even in states where the default SOL applies, fraud or willful evasion removes the limitation entirely or substantially extends it. This is the failure mode that converts a bounded three-year exposure into an open-ended one even for registered late filers, and it is the line that distinguishes a back-tax problem from a personal-liability problem.

The statutory pattern: California removes the SOL entirely where a return was filed with intent to evade tax (Cal. Rev. & Tax. Code §6487). New York Tax Law §1147(c) removes the limitations period entirely for "fraudulent or false returns." Texas Tax Code §111.205 removes the limit when a return is "false, fraudulent, or filed with intent to evade tax." Washington RCW 82.32.050(4) removes the limit for fraud or intent to evade. Massachusetts and Pennsylvania reach to "false or fraudulent return" exposure with no time limit.

Florida uses an extended mechanism: Fla. Stat. §95.091(3)(b) extends Florida's three-year SOL to six years on "substantial underpayments" defined as omissions exceeding 25%. The brand that filed in good faith but materially understated taxable sales (often through misclassified product taxability or marketplace-facilitator misapplication) can land in the six-year window without intending to evade anything.

The operational takeaway is that fraud and substantial-omission exposure is most often triggered not by intentional evasion but by poorly documented taxability positions that auditors later recharacterize. The defense is the workpaper: contemporaneous documentation of the taxability position, the source authority relied upon, and the reconciliation of marketplace-collected versus direct-channel sales. What records do you need to defend a sales tax audit? covers the day-one document chain. The downside risk here is real: a confident-wrong taxability call converts three years of exposure into six or more, so the workpaper carries the position.

Successor liability: how an acquisition transfers the open look-back

The diligence trap TaxCloud sees repeatedly in M&A: an acquirer that buys a target's assets discovers, after close, that the target's unquantified nexus exposure transferred under successor liability and state bulk-sale statutes. The acquirer inherits the target's open look-back. This is why unquantified sales tax exposure becomes a deal-price adjustment or an escrow item in mid-market M&A, not a post-close cleanup project.

The statutory mechanism is bulk-sale law. Most states require the seller, the buyer, or both to notify the Department of Revenue of an asset sale (typically 10 to 30 days before close) and to obtain a clearance certificate confirming the seller's tax liability is satisfied. Absent the notice and certificate, the buyer inherits the seller's outstanding sales tax liability up to the purchase price.

The key operator move during diligence: the acquirer's diligence team requests state-by-state clearance certificates from every state where the target has filed or registered, and treats the absence of a certificate (combined with a registration history) as a flag for further investigation. For unregistered states, the diligence team builds the back-tax exposure schedule covered in How to build a defensible back-tax exposure estimate, state by state and treats the exposure as either a price adjustment or an indemnity-and-escrow item in the purchase agreement.

The diligence implication for the seller side is that VDA completion before signing converts an open-ended successor-liability risk into a contractually closed look-back, which is what acquirers and their deal counsel typically require for clean release of escrow. A brand contemplating a transaction in the next 12 to 24 months should treat VDA completion as a pre-close item, not a post-close one. The professional-fee math typically supports that even when the standalone economic case for VDA is marginal.

What this means for exposure quantification and remediation sequencing

The look-back number is the single largest input variable in any back-tax exposure estimate. A brand that uses the wrong look-back assumption produces a wrong total exposure by a factor of two to four. The sequence that holds at a $20M to $80M Shopify or Shopify Plus brand: nexus analysis to identify unregistered states, look-back determination per state under the framework above, exposure quantification through the workpaper, then a per-state remediation path (direct registration, VDA, or MTC Joint VDA).

Three operator notes on sequencing. First, the unregistered look-back is open-ended in almost every state, so any exposure estimate that assumes a three- or four-year cap absent a VDA is materially understated. Second, the VDA professional-fee crossover (commonly $5,000 to $15,000 per state) sets the floor where direct registration is the cheaper path. Below that crossover in modest-exposure SST states, the SSUTA §402 amnesty and direct CSP registration usually beat a per-state VDA. Third, M&A timing changes the math: deal counsel typically requires a closed look-back for clean escrow release, which moves the VDA professional fee out of the standalone-optimization column and into the deal-mechanics column.

The post-quantification chain is operational rather than analytical. Once the look-back per state is determined and the remediation path is set, the brand registers in the affected states, files back returns under VDA agreements where applicable, and stands up prospective compliance for current and future periods.

TaxCloud is built for that downstream chain: registration apparatus across the affected states, calculation across 13,000+ jurisdictions through one API with native Shopify, Shopify Plus, BigCommerce, and QuickBooks Online integration, consolidated SST filing across the 24 SST member states (23 full members and one associate member, Tennessee), and the audit documentation trail that supports any subsequent state inquiry with transaction-level records already organized.

The VDA negotiation itself sits with CPA or attorney representation; the prospective compliance infrastructure runs in parallel so the brand is filing current returns by the time back-period payments come due.