When should you bring in tax counsel on a state nexus matter?

When does a state nexus matter need outside tax counsel?

At TaxCloud, we see brands assume the existing CPA handles the state letter by default. Sometimes that is right. Often it costs them the privilege over the exposure analysis and the anonymous-VDA path before anyone has finished reading the second paragraph of the notice.

Three actors share the work at a $20M to $80M Shopify or Shopify Plus brand handling a nexus matter. In-house finance assembles source data: Shopify exports by state and period, marketplace settlement reports from Amazon and Walmart, the current physical footprint map. The existing CPA or sales tax provider handles routine compliance work and the factual sections of a nexus questionnaire. Outside tax counsel is required for contested nexus, anonymous-VDA negotiation, privilege protection over the exposure analysis, and any document carrying audit or assessment language.

The triage rests on two variables: the classification of the document, and the size of the estimated exposure. The classification call is binary and based on the notice's language; the exposure call is a per-state number the brand should already have from its own quantification work. How to build a defensible back-tax exposure estimate, state by state covers the calculation model.

A controller treating every notice as a CPA matter risks losing privilege over the exposure analysis and closing the VDA window. Treating every notice as a counsel matter wastes representation cost on items the CPA can close cleanly. The classification call drives the resource decision; the exposure number drives the strategic decision.

The roles in the table sort the response work. The post-response chain (registration in confirmed states, ongoing calculation, prospective filing) is a separate operating layer. TaxCloud handles that layer: registration across confirmed-nexus states, native Shopify, Shopify Plus, BigCommerce, and QuickBooks Online integration, and the transaction-level documentation through the reporting API that supports counsel's protest or VDA work.

The signals that escalate a nexus matter from CPA-level to counsel-level

The signal that should trigger a call to counsel, not just the CPA, is audit language, a multi-year scope, or any hint of a referral. A questionnaire asking for sales history is a CPA-level response. A notice proposing a multi-year assessment with penalty language is a counsel-level event, and brands that do not escalate early lose the privilege and the anonymous-VDA options.

Six signals, ordered by frequency:

1. Audit or examination language. Words like "audit," "examination," "Notice of Determination," "proposed assessment" invoke statutory examination authority. A questionnaire is information-gathering. An audit notice is a proceeding with statutory timelines and subpoena-equivalent information demands.
2. Multi-year scope. A questionnaire bounded to current-year activity is structurally different from a notice referencing a four- or five-year lookback period. The latter typically signals the state has already estimated exposure and is preparing to assess against multiple periods.
3. Penalty or fraud references in the notice. Citations to Cal. Rev. & Tax. Code §6591 (10% late-filing penalty), §6484 (10% negligence penalty), NY Tax Law §1145(a)(1)(i) (penalty stack to 30%, fraud penalty to 50%), or Tex. Tax Code §111.061 (5% then 10% progression) signal an enforcement posture rather than an inquiry.
4. Jeopardy assessment posture. Notices issued under Cal. Rev. & Tax. Code §6536, NY Tax Law §1138, or Tex. Tax Code §111.022 compress the protest window to days and accelerate lien and seizure powers. Same-day counsel engagement is required. Any document referencing jeopardy authority is a counsel-from-day-one matter.
5. Criminal referral or fraud language. Rare but unambiguous. Any reference to criminal investigation, willful evasion, or coordination with the state attorney general moves the matter outside any CPA's scope and outside the limited tax-practitioner privilege under IRC §7525.
6. State attorney general or treasury-department letterhead. A letter from a state Department of Revenue is one posture. A letter from the state AG, treasury, or a tax-fraud unit signals a different proceeding entirely. Treat as counsel-led on day one regardless of the underlying tax dollar figure.

The reflex pattern we see most often: the existing CPA opens the response, the questionnaire turns out to cover prior periods, the CPA's factual answer establishes the facts the state needed, and by the time anyone calls counsel the privilege channel and the anonymous-VDA channel are both closed. The classification call has to happen before any drafting begins. How to respond to a state nexus questionnaire covers the answer-direct versus counsel-first taxonomy at the question level.

How counsel-before-responding preserves privilege and VDA options

Engaging counsel before responding is what preserves options. Attorney-client privilege over the exposure analysis, and the ability to run an anonymous VDA through counsel as the named representative. Respond first, then call counsel, and both options may already be gone.

Three protections close in different ways once the brand has engaged the state without counsel.

1. Attorney-client privilege over the exposure analysis. When outside tax counsel directs the back-tax exposure analysis, the work product is generally protected from discovery under state attorney-client privilege rules (Cal. Evid. Code §954; N.Y. CPLR §4503(a); see also ABA Model Rule 1.6 on confidentiality of client information). The brand's internal exposure quantification, draft response language, and counsel's nexus analysis are not discoverable in a subsequent assessment dispute. If the CPA prepared the same analysis directly for the brand without counsel direction, the work product is generally discoverable. The protection applies to communications in confidence for the purpose of obtaining legal advice; it does not extend to the underlying source documents (Shopify exports, marketplace settlement reports) or to communications outside that purpose. Upjohn Co. v. United States, 449 U.S. 383 (1981) is the federal corporate-privilege baseline most states track.

2. The Kovel arrangement for CPA work under privilege. A CPA's analysis can be brought under attorney-client privilege when the CPA is engaged by counsel, not by the brand directly, for the purpose of providing technical assistance to counsel's representation. The doctrine traces to United States v. Kovel, 296 F.2d 918 (2d Cir. 1961). The engagement letter has to run counsel-to-CPA; the CPA's work has to be at counsel's direction; and deliverables have to run to counsel rather than to the brand directly. A CPA already engaged on a direct retainer can be re-engaged through counsel for the limited scope of the nexus matter, preserving privilege over that scope while leaving the routine compliance engagement undisturbed.

3. The federally authorized tax practitioner privilege does not substitute. IRC §7525 creates a limited privilege for certain tax advice from federally authorized practitioners. It applies only to noncriminal federal tax matters before the IRS or in federal court, does not extend to state tax proceedings, and does not extend to written communications in connection with tax shelter promotion. For state sales tax controversies, attorney-client privilege through counsel (or a CPA acting under Kovel) is the load-bearing protection.

The anonymous-VDA channel through counsel. Most state VDA programs and the Multistate Tax Commission Joint Voluntary Disclosure Program permit a representative to submit the initial disclosure without identifying the taxpayer until terms are agreed. The representative must be a CPA or attorney; in practice, state programs that preserve privilege over the prior-period analysis require counsel. The anonymous channel closes once the state has made contact about the period in question, and a questionnaire response acknowledging in-state activity is contact. The remediation decision must be made before the response is finalized and sent.

Cost-benefit by exposure band

The cost-benefit is a function of exposure. At $50,000 of estimated exposure in a single state, counsel often costs more than it saves and the CPA handles it. At $500,000, the privilege and negotiation leverage counsel brings runs a fraction of the assessment exposure it protects against. The crossover sits in the middle, and the per-state number is what matters.

Cost inputs to the decision:

• CPA-led questionnaire response: typically $2,000 to $8,000 per state for a complete factual response, depending on data complexity.
• CPA-led standard registration after confirmed nexus: typically $1,500 to $5,000 per state.
• Counsel-led VDA representation: typically $5,000 to $15,000 per state, plus the CPA's data and filing fees.
• Counsel-led protest of a Notice of Determination: typically $15,000 to $50,000 per state, scaled to exposure and complexity.

Benefit inputs:

• Lookback cap under VDA: typically three to four years versus open-ended for unregistered sellers.
• Penalty waiver under VDA: full waiver of failure-to-file and failure-to-pay penalties. California's 10% under §6591, New York's progression to 30% under §1145(a)(1)(i), Texas's 5% to 10% under §111.061.
• Privilege protection: prevents the exposure analysis from being discoverable in a state assessment dispute.
• Negotiation leverage: anonymous-channel disclosure and a capped-lookback structure give counsel a framework the state programs are built to recognize.

Worked example, $50K California exposure. A brand with $1.5M in California sales over 18 months past the $500,000 economic threshold (Cal. Rev. & Tax. Code §6203) carries base liability around $130,000 at the state rate, plus $13,000 in late-filing penalty under §6591. The VDA savings are limited: the lookback cap is moot because only 18 months of exposure exist, and the $13,000 penalty waiver falls close to the $10,000 to $12,000 counsel representation cost once ancillary fees are layered in. The CPA can submit a direct registration, file back returns, and request penalty abatement through the CDTFA's reasonable-cause framework at lower total cost.

Worked example, $500K California exposure. A brand with $6M in annual California sales for four years past the threshold carries base liability roughly $1.94M at a 9.5% blended rate and 85% taxable mix. The 10% late-filing penalty under §6591 alone runs $190,000-plus. A California VDA capping lookback at three years saves roughly $485,000 in base tax (one year of exposure beyond the cap) plus the full penalty stack. Counsel representation at $12,000 to $15,000 delivers a leverage ratio above 40:1 before interest savings. Privilege over the exposure work product is the secondary benefit; in a contested matter, that protection is what keeps a $1.9M assessment from anchoring a $3M-plus settlement demand.

The multistate adjustment. Per-state economics flip when the brand carries material exposure in 10 or more states. Counsel-led portfolio negotiation, including the MTC Joint VDA Program for participating states, coordinates strategy across the footprint: which states to VDA, which to standard-register, and how to sequence disclosures to preserve VDA eligibility in uncontacted states. The marginal cost of counsel as orchestrator is lower than the cost of decision errors in any single state, and privilege over the consolidated exposure analysis covers the full portfolio rather than state by state.

The Kovel arrangement and day-one sequencing on a live matter

The day a state notice arrives is the highest-leverage day in the matter. Four moves in the first 72 hours set up everything downstream, and the Kovel arrangement is the structural piece that lets the existing CPA continue working without breaking privilege.

Days one to two: classify the document. Read the notice. Test it against the six escalation signals above. If any signal is present, the matter is counsel-led from this point forward. If none is present and per-state exposure is below $50,000, the existing CPA can take it on the standard answer-direct workflow.

Days two to three: engage counsel through a Kovel-form letter when warranted. When counsel is required, the engagement runs counsel-to-brand for the legal representation and counsel-to-CPA for any technical work the CPA will perform under privilege. The CPA's existing direct retainer for ongoing compliance work stays in place; the Kovel scope is limited to the nexus matter. The engagement letter should reference United States v. Kovel, 296 F.2d 918 (2d Cir. 1961), state that the CPA's work is for the purpose of providing technical assistance to counsel's representation, and route deliverables to counsel rather than to the brand directly.

Days two to seven: data assembly in parallel. In-house finance pulls the source data without waiting for counsel's full nexus analysis. Shopify and marketplace exports by state and period, current physical footprint, registration history. The data work happens regardless of who drives strategy; counsel's role is to receive it through the right channel and to direct what enters the response.

Days three to thirty: nexus analysis, remediation recommendation, response or VDA initiation. Counsel reviews the data, the notice, and the brand's prior compliance history, then issues a per-state recommendation: respond direct, respond with counsel-drafted language, initiate VDA, or pursue a contested nexus position. Most state questionnaires carry a 30-day deadline from the letter date, not the receipt date. Counsel's strategy has to be set with enough runway for drafting, brand review, and filing via certified mail or state portal with submission confirmation preserved. If VDA is the path, the anonymous representative file is initiated through counsel before any direct contact with the state.

The pattern that breaks the sequence: the CPA receives the notice, files a routine response within ten days, and counsel is brought in only after the state replies with a registration demand or proposed assessment. By that point, the questionnaire response has established the facts and any contested-nexus or anonymous-VDA position has to overcome the brand's own prior admissions.

Once the response strategy is set and registrations begin, the prospective filing chain has to come online before new revenue accumulates in confirmed-nexus states. TaxCloud handles registration across those states, native Shopify, Shopify Plus, BigCommerce, and QuickBooks Online integration for ongoing calculation, and consolidated SST filing across the 24 SST member states (Tennessee participates in the program as an associate member and is not counted among the 24 full member states for filing-consolidation purposes) through one process rather than 24 separate filings.

The operating model once the response strategy is set

The reader here is past the document classification call. Counsel is engaged where it is needed, the CPA is engaged through the right channel, and the brand has either submitted a factual response or initiated VDA negotiations through counsel. The question becomes what the operating model looks like for the next 18 to 24 months.

Three workstreams run in parallel.

Counsel runs the contested or VDA work. The VDA negotiation, the protest of any Notice of Determination, and the closing agreement that resolves the prior-period liability. Counsel also tracks the cross-state cascade: a final assessment or VDA agreement in one state typically produces correspondence from adjacent states within 90 days through the Multistate Tax Commission Joint Audit Program and IRC §6103(d) state-federal information exchange.

The CPA runs back-period filings and the ongoing-compliance hand-off. Under a VDA, back returns are filed within a 30 to 90 day window from the agreement effective date. Under standard registration, delinquent returns are filed under the state's back-filing process. In both paths, the CPA's work transitions from one-time remediation to ongoing return preparation, and the engagement scope contracts accordingly.

The brand runs prospective compliance. Registration in confirmed-nexus states, ongoing calculation at checkout across all jurisdictions where the brand collects, monthly close reconciliation between the calculation engine and the filed returns, and the documentation chain that supports both audit defense and audit-committee reserve estimation under ASC 450. At a 20-to-40-state footprint, this is the workstream that has to operate without exception while counsel and the CPA work through the prior periods.

The engage-counsel decision is the brand's to make with its advisors. The operating model is what has to scale once that strategy is set. TaxCloud is built for that: registration across confirmed-nexus states, native Shopify, Shopify Plus, BigCommerce, and QuickBooks Online integration, consolidated SST filing across the 24 SST member states (Tennessee participates in the program as an associate member and is not counted among the 24 full member states for filing-consolidation purposes), and the transaction-level reporting trail that supports both counsel's protest documentation and the audit committee's quarterly contingent-liability review.