How do you quantify back-tax exposure state by state?
The exposure surfaces in four contexts: an audit committee question during quarterly close, an acquirer’s diligence review of a data room, a state nexus inquiry letter, or a new controller’s first threshold scan. Each context carries different urgency. The underlying math is the same.
The liability lives in the gap between when a brand should have registered and when it actually did, or plans to. Each unregistered state has three components: base tax owed on taxable transactions, penalties under the state’s statute, and interest from original due dates. A number defensible at an audit committee, in VDA negotiations, or in a purchase price model needs four inputs per state.
Gross sales into the state by period. Pulled from Shopify or Shopify Plus order exports, order management data, or marketplace settlement reports. Structure year by year; most state lookback windows run in calendar years. If sales span more than three years, build the table period by period.
Taxable mix. The share of gross sales taxable in that specific state. A brand selling only tangible personal property in categories taxable everywhere uses 100%. A brand with apparel (exempt in New York, Pennsylvania, and Minnesota), food, or digital goods must build a product-category matrix by state. The taxable-mix percentage is the single variable that most shifts the exposure estimate; every workpaper includes a sensitivity table showing aggregate exposure at plus and minus 10 percentage points around the central assumption.
Blended rate. The sales-weighted average of state plus local rates across the brand’s actual ship-to ZIP codes. The state rate is a floor. Chicago’s combined rate is 10.25% against Illinois’ 6.25% state rate; Denver’s is 8.81% against Colorado’s 2.9%. Using only the state rate systematically understates exposure for any brand with volume concentrated in high-rate metros.
Applicable lookback window. Covered in the next section, because this is where the largest variance in total exposure sits.
Building the state-by-state calculation
With those four inputs, the calculation for each state runs:
Gross sales (period) × Taxable mix = Taxable sales
Taxable sales × Blended rate = Base tax liability per period
Base tax (all periods) + Penalties + Interest = Total state exposure
Track base tax, penalties, and interest as three separate columns. VDA negotiations and audit settlement discussions work from those components independently; a state waiving penalties still collects base tax plus interest. Keeping them separate lets the CFO or GC model the VDA discount before committing to the process.
Here are two worked examples:
- A brand with $6M in annual California sales, 85% taxable mix, and a 9.5% blended rate carries base liability of approximately $484,500 per year ($6M × 85% × 9.5%). At three years lookback under a California VDA, gross pre-penalty exposure is roughly $1.45M. California’s 10% late-filing penalty (Cal. Rev. & Tax. Code §6591) adds approximately $145,000. Interest at the CDTFA quarterly rate accrues from each return’s original due date. Total California exposure on this fact pattern runs in the $1.6M to $1.7M range before the VDA penalty waiver.
- A brand with $8M in annual Texas sales, 90% taxable mix, and an 8.25% blended rate carries base liability of approximately $594,000 per year. Texas measures its $500,000 threshold against total revenue including nontaxable and exempt sales (Tex. Tax Code §151.107), so the brand may have triggered nexus earlier than a taxable-only calculation would suggest, extending the exposure window. At four years lookback, gross pre-penalty Texas exposure is approximately $2.4M.
The sensitivity analysis shows that shifting the taxable-mix assumption from 85% to 75% reduces per-state exposure by approximately 12%; shifting to 95% increases it by approximately 12%. That range belongs in the workpaper alongside the central number; the audit committee and any acquirer will ask for it.
Source data required: order-level transaction history with ship-to state, ZIP, product SKU, gross amount, and a marketplace-facilitator flag. Once the remediation path is set, TaxCloud handles registrations across the affected states, back-period filings under VDA agreements, and ongoing returns through native Shopify and Shopify Plus integration, so the compliance infrastructure is live before the first return comes due.
Lookback windows: unregistered, late-filed, and VDA-capped
The lookback window is the exposure multiplier that most surprises finance teams new to sales tax.
Unregistered sellers face open-ended lookback. The limitations clock does not start until a return is filed. A brand that never registered in Texas and has been selling there since 2019 has exposure running back to the year it met the $500,000 threshold; Texas can assert that and claim multiple years of unpaid liability. This is the default posture for every unregistered state in the footprint, not an edge case.
Registered late filers face each state’s fixed limitations period from the return due date:
| State | SOL (filed returns) | Statute | Extended period |
|---|---|---|---|
| California | 3 years from return due date | Cal. Rev. & Tax. Code §6487 | Indefinite (fraud) |
| New York | 3 years from return due date | NY Tax Law §1147(b) | Indefinite (fraud) |
| Texas | 4 years from return due date | Tex. Tax Code §111.201 | Indefinite (fraud) |
| Washington | 4 years from return due date | RCW 82.32.050 | Indefinite (fraud) |
| Illinois | 3 years from return due date | 35 ILCS 120/4 | 6 years (substantial omission) |
| Florida | 3 years from return due date | Fla. Stat. §95.091(3)(a) | 6 years (substantial omission) |
VDA applicants receive a contractual lookback cap, typically 3-4 years from the application date. California VDAs generally cap lookback at three years plus the current period. Texas VDAs typically accept a four-year lookback. New York’s voluntary disclosure program under NY Tax Law §1700 caps lookback at three years for most applicants.
The Multistate Tax Commission’s National Nexus Program (MTC NNP) allows simultaneous VDA filings across participating states through a single application, reducing professional fees for brands with exposure in ten or more states. California and New York run separate programs outside the MTC process and require direct applications.
Illinois brands operating in the 2026 window should note the Remote Retailer Amnesty Program, which runs August 1 through October 31, 2026 and offers reduced penalties for brands that register and pay back tax during that period (35 ILCS 185).
The comparison between open-ended and VDA-capped exposure is pivotal. A brand with five years of California exposure at $300,000 per year ($1.5M) reduces that to three years ($900,000) and eliminates the 10% late-filing penalty by filing a VDA. The savings exceed the VDA professional fee by a wide margin.
Penalty and interest math: California, New York, and Texas
Three states account for a disproportionate share of total back-tax exposure for most Shopify-channel brands, given their threshold levels, ship-to volume concentration, and penalty structure. The penalty math drives the VDA-versus-standard-registration decision.
California. Cal. Rev. & Tax. Code §6591 imposes a 10% late-filing penalty; §6592 provides relief from penalties for reasonable cause. Interest accrues from the original due date at the CDTFA quarterly rate. Base tax, two penalty tiers, and compound interest typically push total California exposure to 130%–145% of base tax over three to five years of open exposure.
New York. NY Tax Law §1145(a)(1)(i) creates a civil penalty of 10% for the first month delinquent, then 1% per month, ceiling 30%. §1145(a)(1)(ii) adds a 5% per month fraud penalty up to 50% for fraudulent failure to file. Interest accrues under NY Tax Law §1142. Three years of open exposure typically models to approximately 1.30–1.40 times base tax.
Texas. Tex. Tax Code §111.061 runs 5% if paid within 30 days, 10% if paid later; §111.061(b) adds a 50% penalty for fraudulent failure to file. Interest accrues at the Comptroller-published rate, currently prime plus 1% compounded daily.
| State | Penalty type | Rate | Statute | Interest basis |
|---|---|---|---|---|
| CA | Late filing or payment | 10% flat | Rev. & Tax. Code §6591 | CDTFA quarterly rate |
| CA | Failure to remit collected tax | 40% | Rev. & Tax. Code §6597 | Same |
| NY | First month delinquent | 10% | Tax Law §1145(a)(1)(i) | Tax Law §1142 rate |
| NY | Each additional month (ceiling 30%) | +1%/month | Tax Law §1145(a)(1)(i) | Same |
| TX | 1–30 days late | 5% | Tax Code §111.061 | Prime + 1%, compounded daily |
| TX | 31+ days late | 10% cumulative | Tax Code §111.061 | Same |
| WA | Late filing/payment | 9% to 29% depending on delinquency | RCW 82.32.090 | DOR-published rate |
| FL | Failure to file | 10% per month (max 50%, min $50) | Fla. Stat. §212.12 | Fla. Stat. §213.235 rate |
A workpaper that applies a flat 20% heuristic across all states will be materially wrong for states with compound interest schedules, for returns delinquent beyond 24 months, and for any state where fraud penalty provisions may be in play. State-specific math from the statute is the only approach that holds up in VDA negotiations or on a reviewed balance sheet.
Marketplace-collected offsets: removing what the platform already remitted
Marketplace facilitator laws shift collection and remittance responsibility to the marketplace for covered transactions. Sales made through Amazon, Walmart Marketplace, and similar platforms where the marketplace collected and remitted are not part of the brand’s own tax liability. The documentation requirement to support that offset is material, and the nexus-threshold and liability calculations follow different rules.
On nexus thresholds: some states include marketplace-facilitated sales in the seller’s threshold count even when the marketplace collected the tax. California includes facilitated sales in the seller’s $500,000 threshold (Cal. Rev. & Tax. Code §6203). Florida excludes facilitated sales from the seller’s $100,000 threshold (Fla. Stat. §212.0596). A brand may have crossed a threshold on marketplace volume alone while owing nothing on those specific transactions. That creates a registration obligation without a corresponding direct liability on facilitated sales.
On tax liability: regardless of threshold treatment, tax on marketplace-collected transactions has already been remitted by the platform. The offset applies to the liability calculation in every state with a marketplace facilitator law, now covering all US sales tax states. The brand’s direct-channel Shopify sales remain fully exposed. The workpaper must show both: total gross sales into the state by period, the marketplace-facilitated portion, and the direct-channel portion. Without that breakdown, a state examiner can treat the full gross figure as the liability base.
Pull marketplace settlement reports by state and period alongside the Shopify transaction export. Settlement reports include state-level tax collected and remitted by the marketplace; reconciled to each state’s facilitated-sales rules, that figure produces the net exposure base. TaxCloud’s reporting API maintains transaction-level records across all 13,000+ jurisdictions, keeping facilitated and direct-channel data cleanly separated so the offset is auditable if a state contests it.
The exposure-to-decision bridge and the audit-defensible workpaper
A completed exposure schedule drives three decisions: the remediation path, the balance sheet reserve, and whether the matter stays in finance or moves to legal.
The remediation path. VDA professional cost typically runs $3,000–$15,000 per state depending on complexity, lookback years, and whether the brand uses outside counsel or a specialist firm. The decision thresholds:
- Below approximately $5,000 in per-state base tax: standard late registration and payment often costs less than a formal VDA. The state is unlikely to look back aggressively on a brand that registers, files, and begins collecting prospectively.
- Between approximately $5,000 and $50,000 per state: VDA territory. The penalty waiver alone (10% in California, up to 25% in New York) typically exceeds the professional fee. The lookback cap compounds the savings.
- Above approximately $50,000 per state, or six-figure aggregate: the matter moves from the controller to general counsel. The exposure is large enough to require legal privilege on the analysis, potential M&A disclosure review, and a structured remediation timeline with documented milestones.
- In M&A contexts: the exposure schedule and VDA plan typically appear in the purchase agreement as a representation and indemnity item or an escrow provision. The acquirer needs a defensible state-by-state figure, not an aggregate range.
The balance sheet reserve. Once the schedule is complete, the accounting question is whether aggregate exposure meets the “probable and estimable” accrual threshold under ASC 450 (Contingencies). The workpaper provides both the estimate (base tax, penalty, and interest by state) and the probability basis (the nexus determination and threshold analysis for each state). Outside accountants performing an audit will expect to see this analysis; a gap in it is an audit finding.
The workpaper itself contains seven elements: (1) order-level source data with ship-to state, ZIP, and period; (2) taxable-mix analysis by product category and state; (3) blended rate methodology showing state rate, weighted local rate, and ZIP-code weighting; (4) lookback period per state with basis applied (VDA cap, state SOL, or registration date); (5) penalty and interest per state from the applicable statute; (6) sensitivity table at ±10 percentage points on the taxable-mix assumption; and (7) per-state remediation recommendation with threshold-relative rationale.
The controller and outside counsel sign off before the workpaper goes to the audit committee. The GC uses it as the basis for VDA applications or audit responses. The CFO uses the aggregate as the balance sheet reserve figure or M&A disclosure number.
Once the workpaper is signed off and the remediation path is set, the operational layer activates: registrations across affected states, back-period filings under VDA agreements, and an ongoing compliance infrastructure for current obligations. TaxCloud handles that chain: 13,000+ jurisdictions through one API, consolidated SST filing across the 24 member states (23 full members plus Tennessee as an associate member, which is not counted among the full members for filing-consolidation purposes), and the audit documentation trail that supports any subsequent state inquiry with transaction-level records already organized. A brand completing a back-tax analysis is typically registering in 8–15 new states simultaneously, and the compliance infrastructure needs to be operational before the first return comes due.