How do state revenue agencies actually identify unregistered remote sellers?
The discovery vector that surprises brands at $20M to $80M is rarely the state proactively hunting. The pattern that recurs across the customer base is quieter and more mechanical: marketplace settlement data and the 1099-K feed arrive on the state's desk, a matching algorithm flags a seller with in-state sales and no registration, and the inquiry letter follows. A brand that assumes it is invisible because it is small on any one channel is visible in aggregate.
Five discovery layers feed enforcement targeting in 2026:
- Federal data flowing to states. Payment processor 1099-Ks under IRC §6050W (Shopify Payments, Stripe, PayPal, Square) are reported to the IRS, then shared with participating state DORs through the federal-state data-sharing agreement administered by the Federation of Tax Administrators.[1][2]
- Marketplace facilitator reports. Amazon, Walmart, eBay, Etsy, and TikTok Shop report seller-level settlement data to states under marketplace facilitator statutes including Cal. Rev. & Tax. Code §6041[3] and NY Tax Law §1132(a-1).[4]
- State-to-state data sharing. The Multistate Tax Commission's Joint Audit Program and the Multistate Information Sharing Agreement (MISA) propagate registration, audit, and assessment data across more than 40 participating states.[5][6]
- Whistleblower and referral programs. State tip lines (California CDTFA, Texas Comptroller, New York DTF, Pennsylvania DOR) accept and compensate informant submissions, with former employees, ex-partners, and competitors as the highest-credibility sources.[7][8]
- Public signals. Shopify partner directory listings, funding announcements, in-state press coverage, and LinkedIn job posts naming a state feed enforcement-targeting databases that DOR audit units cross-reference against their registered-seller lists.
These layers do not operate in isolation. A 1099-K alone is a data point. A 1099-K combined with an Amazon settlement report and a press announcement of a Series B funding round, attached to a seller with no registration on file, is a selection event.
1099-K reporting and the data feeds states receive
A pattern worth naming first. Brands processing $400,000 through Shopify Payments in California and $250,000 through Stripe in Texas often treat these as private revenue numbers. They are not. Under IRC §6050W, payment settlement entities are required to report gross payment volume to the IRS,[1] and the IRS transmits that data to participating state DORs under the federal-state data-sharing agreement.[2] The state sees the gross volume before any audit selection occurs.
The post-ARPA reporting threshold has moved multiple times. The American Rescue Plan Act of 2021 lowered the §6050W threshold from $20,000 and 200 transactions to $600 with no transaction count. The IRS published transition relief in Notice 2023-10, Notice 2023-74, and Notice 2024-85, setting interim floors of $5,000 (TY2024) and $2,500 (TY2025).[1] Congress reset the threshold in 2025, restoring the historical $20,000 / 200-transaction floor for TY2026 and forward.
The structural fact is constant regardless of the floor. The data feed to states does not turn on. Payment processors file 1099-Ks at whatever threshold applies. The IRS shares the data with states. State DOR systems run matching logic against their registered-seller files.
Two operational consequences follow for a brand at $20M to $80M:
- The 1099-K is not the brand's data. Shopify Payments, Stripe, PayPal, and Square each file independently. A brand operating across three processors generates three independent data trails, each with the same gross-payment-volume picture, against the same state.
- The state's lookback runs from the date the data lands, not the date of the audit. A 1099-K filed in January 2025 for TY2024 enters the state's matching system shortly after. A registration filed in March 2027 does not erase the 2024 data. It establishes that the brand was visible and unregistered for two years.
The operating-model question is not "how do we hide the data from the state." The data is already there. The question is whether the brand registers before the matching algorithm runs, or after the inquiry letter arrives. TaxCloud's monitoring view flags threshold crossings against the state's published economic-nexus rule before the seller's 1099-K and marketplace data combine into a selection event, and the registration apparatus runs the filings the moment a state crosses.
Marketplace facilitator data sharing under CA RTC §6041 and NY Tax Law §1132(a-1)
The marketplace facilitator layer is the second feed and the one most likely to catch a multi-channel brand off guard. Under marketplace facilitator statutes now enacted in every state with a sales tax, platforms like Amazon, Walmart, eBay, Etsy, and TikTok Shop collect and remit tax on facilitated sales.[3][4] They also report seller-level settlement data to state DORs.
The mechanics vary by state. The two anchor citations:
- California. Cal. Rev. & Tax. Code §6041 (added by AB 147, Stats. 2019, ch. 5) defines marketplace facilitator and requires platforms to collect tax on facilitated sales. Facilitators report to the CDTFA at the seller level. [3]
- New York. NY Tax Law §1132(a-1) imposes collection on marketplace providers and triggers reporting obligations to the New York DTF.[4] Coupled with NY's $500,000 AND >100 transactions economic-nexus rule under §1101(b)(8), the data lets the state cross-reference marketplace-facilitated revenue against the seller's own registered footprint.[9]
Every state with a sales tax now operates a parallel structure. The data feed flowing from the marketplace to the state DOR is independent of the 1099-K feed flowing from the payment processor to the IRS to the state DOR.
A brand generating $1.5M through Amazon and $800,000 through its own Shopify storefront in a state with a $500,000 threshold appears in two state-side data systems simultaneously: the marketplace facilitator settlement data (Amazon volume), and the 1099-K from Shopify Payments (Shopify volume). The brand may believe its Shopify direct volume is the only revenue that "counts" toward the threshold because Amazon collects and remits the tax. State threshold rules vary on whether marketplace-facilitated sales count toward the seller's own nexus threshold; in many states they do. Even where facilitated sales are excluded from the threshold calculation, the marketplace report and the 1099-K together still make the seller visible.
The brands surprised by this are usually surprised at the same point in the lifecycle. A $30M Shopify Plus brand that registered with five states based on direct-channel volume opens an inquiry letter from a sixth where marketplace volume pushed the seller across a threshold the seller never tracked. The discovery feed is unambiguous and pre-dates any audit selection.
Cross-state data sharing through the MTC Joint Audit Program
Discovery does not stay in one state. The Multistate Tax Commission operates the Joint Audit Program, which coordinates simultaneous sales and use tax audits across multiple member states from a single examination.[5] An auditor from one participating state conducts the fieldwork; findings are shared with and accepted by the other participating states. More than 40 states participate as of 2026.[5]
The data-sharing mechanism that feeds joint-audit selection is the Multistate Information Sharing Agreement (MISA), which lets state DORs exchange taxpayer data with each other.[6] A registration event, a VDA filing, an assessment, or an unresolved notice in one state creates a record that flows to other states through MISA. The architecture is built so that surfacing in one state surfaces the seller in adjacent states.
Three operational patterns follow:
- The cascading inquiry. A California CDTFA inquiry that produces a registration and back-tax assessment generates a MISA record. New York, Texas, Washington, and Illinois, each of which had the same 1099-K and marketplace data on file but had not yet selected the seller, now have a corroborating event. The selection threshold drops.
- The VDA-cascade pattern. A brand that completes a VDA in one state shows up in adjacent-state audit pipelines because the VDA data trail signals prior unregistered operation. The cross-state propagation is the reason VDAs are typically filed in parallel across all exposed states, not serially.
- The Streamlined Sales Tax (SST) overlay. SST's Central Registration System (CRS) lets a seller register in all 24 participating states through a single process, and the registration data is shared across the SST member states by design. This is a feature, not a leak. It is how the program coordinates filing. The operational effect is that a seller's footprint becomes immediately visible to all participating states the moment registration completes.
For a brand whose multi-state exposure is concentrated in SST states, the consolidated SST filing apparatus is what compresses 24 separate state filings into one operational process. TaxCloud, as one of the program's Certified Service Providers, files in the 24 SST states through this consolidated process. The data-sharing that surfaces unregistered exposure across states is the same plumbing that makes filing tractable once the brand is registered.
Whistleblowers, referrals, and the public-signal layer
The non-data feeds are smaller in volume than the 1099-K and marketplace pipelines but produce a disproportionately high audit-selection rate per submission.
State whistleblower and tip programs. Most state DORs operate a formal tip line and reward program for tax noncompliance information.
- California. The CDTFA accepts and compensates tips through its informant program.[7]
- Texas. The Texas Comptroller's office maintains a published informant policy and reward structure.[8]
- New York. The NY DTF Tax Fraud Reporting program accepts confidential submissions.[10]
- Pennsylvania. The PA DOR Fraud Detection Unit operates a tip portal.[11]
Former employees with specific knowledge of unreported sales in a given state are the highest-credibility signal a DOR audit unit can receive. Competitor referrals are also common, particularly in product categories where local sellers have nexus and remote sellers do not. The local seller has a direct interest in compelling the remote seller's compliance.
Public signals. The signals brands underestimate most are the ones they produce themselves through ordinary growth marketing. Each of the following feeds enforcement-targeting databases that DOR audit units cross-reference against registered-seller lists:
- Shopify partner directory listings. A brand listed in a directory with the merchant's location and key markets disclosed creates a discoverable record.
- Funding announcements. Series A, Series B, and growth-round press releases naming the brand, the round size, and the markets the brand is targeting feed VC-press monitoring databases that some state DOR units subscribe to.
- Press coverage and trade publications. A Modern Retail or Glossy piece naming a brand's expansion into a state ("brand X is now selling into Texas") is a public-domain enforcement-targeting input.
- LinkedIn job posts. A job listing for a "Customer Success Manager (Austin, TX)" or a "Warehouse Lead (Atlanta, GA)" is a physical-nexus signal as well as a discovery signal. A remote employee creates physical nexus in many states.
- Investor decks and pitch materials. Decks that name customer geography, employee locations, or 3PL nodes become discoverable when shared with partners, and occasionally surface to enforcement units.
The brand's own growth marketing is a discovery vector. The Series B announcement that names the brand's expansion into 12 new states puts those 12 states on notice of the seller before the brand's quarterly nexus review surfaces the threshold crossing internally.
What the discovery timeline means for VDA timing
The reader at $20M to $80M with unregistered exposure in two to ten states is making a real decision: register now under standard process, file VDAs in the exposed states, or do nothing and hope the discovery feed runs slowly. The third option is the one the discovery architecture punishes most heavily.
The mechanics that bound the decision:
- VDA eligibility closes the moment the state makes contact. Every state with a VDA program disqualifies a seller from voluntary disclosure once an inquiry letter, audit notice, or registration demand has issued. Once the state has the data (a 1099-K filed, a marketplace report received), the timeline to a state-initiated contact is short, often weeks rather than years for active states.
- Standard registration with a back-tax estimate carries full lookback and full penalties. The brand pays back tax for every period it should have collected, plus interest and penalties.
- A VDA caps the lookback (typically three to four years) and waives penalties in exchange for full disclosure. The brand pays back tax for the capped lookback window plus interest, no penalties.
The VDA-timing decision is a question for a CPA or sales tax attorney. The data point that matters operationally is the one the discovery architecture surfaces: the brand is on the clock the moment the 1099-K or marketplace report lands, not the moment the inquiry letter arrives. The window between those two events is the VDA window.
Two adjacent guides cover the next steps once a state makes contact: What happens if you ignore a state sales tax notice and How to respond to an audit notice from a state where you never registered.
The operating model that stays ahead of the discovery clock has three load-bearing parts. Monthly threshold tracking against each state's published rule so the brand sees the crossing before the matching algorithm does. A registration apparatus that can register and begin collecting in days rather than months once a threshold is crossed. And consolidated SST filing across the 24 participating states that compresses the post-registration work into a tractable cadence.
The reader here is past wondering whether discovery is real. The question is what the operating model looks like when ten new states are crossing thresholds every quarter and the 1099-K is filing whether the brand is ready or not. TaxCloud is built for exactly that: monthly threshold tracking against each state's published rule, registration that gets a brand collecting in days rather than months, and consolidated SST filing across the 24 member states.