What changed, and why it still catches people
Before 2018, a state generally could not require you to collect sales tax without some physical presence there - an office, staff, inventory. South Dakota v. Wayfair removed that requirement. States may now assert a collection obligation based on economic presence alone: revenue into the state, or transaction count, over a period.
Every state set its own thresholds and its own measurement rules, and they have been revising them ever since. There is no federal registry, no notification, and no moment where anyone tells you the obligation has begun. You simply become liable, and find out later.
Why software and e-commerce businesses are most exposed
A business with warehouses knows where it has presence. A SaaS company selling a subscription from a laptop does not think of itself as being in Illinois at all - but a few hundred subscribers there, and it may well be.
Three factors compound:
- Taxability of software varies by state. SaaS is taxable in some, exempt in others, and treated differently again depending on whether it is delivered as a service or downloaded. The same product can be taxable in one state and not in its neighbour.
- Transaction-count thresholds catch low-value, high-volume businesses. A state with a 200-transaction threshold is reached by 200 subscriptions at any price - a business can cross on volume long before it crosses on revenue.
- Marketplace facilitator rules shift responsibility. Where a marketplace collects on your behalf, those sales may still count toward your threshold even though you did not collect them.
What it actually costs to be late
This is the part worth understanding clearly, because the instinct on discovering unregistered exposure is to hope nobody notices, and that instinct is expensive.
Sales tax is a trust tax. It is money you were supposed to collect from your customer and hold for the state. When you have not collected it, the liability does not disappear - it becomes yours, out of your margin, plus penalties and interest, and it accrues for as long as the position is unresolved. There is generally no statute of limitations running in your favor on unfiled returns.
It is also the item that most reliably surfaces in diligence. Buyers and investors ask about state tax registrations early, and an unquantified multi-state exposure has repriced or delayed more deals than almost any other accounting issue.
The order to fix it in
- Measure, do not guess. Revenue and transaction counts by state, by year, against each state's threshold as it stood at the time. This is the piece most businesses skip and it is the piece everything else depends on.
- Determine taxability. Crossing a threshold creates a registration obligation; it does not automatically mean your product is taxable there. For software, that answer differs state by state.
- Quantify the exposure. Uncollected tax, penalties and interest, by state, with dates. Frequently smaller than feared - and in states where the product is not taxable, sometimes zero.
- Choose the disclosure route. Most states operate voluntary disclosure agreements that limit the look-back period and commonly abate penalties. That option is available until the state contacts you first, at which point it generally is not.
- Register, then automate. Once registered, rate determination is a solved problem - Avalara or TaxJar handle it well. What automation does not do is monitor thresholds in states where you are not yet registered, which is how the original gap opened.
Keeping it from happening again
Threshold monitoring is a monthly report, not a project: revenue and transaction counts by state against current thresholds, with a flag when any state reaches a set percentage of its limit. That gives you a decision point before the obligation rather than an exposure after it.
It is also, bluntly, the cheapest thing on this page. Quantifying and disclosing three years of unregistered exposure costs many multiples of monitoring it monthly for those three years.
If you suspect you have crossed thresholds and do not know where, a nexus review is a well-bounded piece of work - the kind we would normally run inside the 14-hour pilot so you can see the exposure before deciding what to do about it.