Summary. Sales tax is the liability most likely to appear unannounced in a diligence report and most likely to be personal to the owner. This article covers what changed when the Supreme Court overruled the physical presence requirement, how economic nexus thresholds work, and the marketplace facilitator laws that shifted platform collection. It works through the four questions every transaction raises — nexus, taxability, sourcing, and exemption documentation — then software and digital products, drop shipments, and the personal liability attaching to trust fund taxes, followed by voluntary disclosure, audits, and remediation.

A software company with 60 employees in one state signs a letter of intent to sell for $28 million. Diligence produces a quality of earnings report, a benefits review, an IP audit, and one line item nobody expected: $1.9 million of estimated uncollected sales tax, plus interest and penalties, across nineteen states.

The company sells a subscription product. It never shipped anything, never had an office outside its home state, and never had an employee anywhere else. Its CFO understood sales tax to apply to goods, not services, and its home state does not tax software as a service.

Every one of those beliefs was wrong in at least nineteen places. Roughly half the states tax SaaS. Economic nexus attaches on revenue or transaction counts with no physical presence at all. And because the company never registered, the statute of limitations never began to run in most of those states — meaning the exposure reaches back to the first year the thresholds were crossed, not three or four years.

The deal closed with $2.4 million in escrow and an indemnity that outlived the founders' patience. All of it was avoidable, and none of it required a tax department — only someone asking, once a year, where the company's customers were.

The short answer

Sales tax is a transaction tax imposed on retail sales of tangible personal property and enumerated services. In most states the legal incidence is on the buyer and the seller is obligated to collect and remit; in a few it is on the seller directly.

Use tax is the complement: a buyer that acquires taxable property without paying sales tax owes use tax to its own state. This is how states reach purchases from out-of-state vendors, and it is the most commonly ignored tax in American business.

Four questions, per state, per transaction:

  1. Nexus — does the business have an obligation to register and collect there?
  2. Taxability — is the item or service taxable in that state?
  3. Sourcing — which state's (and locality's) rate applies?
  4. Exemption — if the sale is exempt, is there valid documentation?

The two facts that create most exposure: economic nexus thresholds are low, and an unregistered seller usually has no statute of limitations running in its favor.

What Wayfair changed

Quill Corp. v. North Dakota, 504 U.S. 298 (1992), held that the dormant Commerce Clause required a seller's physical presence in a state before the state could require it to collect sales tax. For 26 years, a mail-order or internet seller with no property or people in a state had no collection obligation there.

South Dakota v. Wayfair, Inc., 585 U.S. 162 (2018), overruled Quill. The Court held that physical presence was not required and that the correct standard is substantial nexus under Complete Auto Transit, Inc. v. Brady, 430 U.S. 274 (1977) — satisfied where the seller "avails itself of the substantial privilege of carrying on business" in the state.

The South Dakota law upheld had three features the Court noted approvingly, and which most states copied:

  • A safe harbor for sellers below a threshold — in that statute, $100,000 in sales or 200 separate transactions annually.
  • No retroactive application.
  • Membership in the Streamlined Sales and Use Tax Agreement, with its single state-level administration, uniform definitions, and state-funded compliance software.

Where things stand now. Every state imposing a sales tax has enacted an economic nexus standard. The thresholds vary — $100,000 is the most common, with some states at $250,000 or $500,000 — and many states have eliminated the transaction-count prong, having found that it captured small sellers with many low-value sales. Measurement periods differ (current or prior calendar year, or a rolling twelve months), and states differ on whether exempt and wholesale sales count toward the threshold, which frequently determines whether a distributor is over it.

Physical presence still creates nexus. Wayfair added a basis; it removed none. Physical presence includes an office, employees, inventory, contractors, and — importantly — inventory stored in a fulfillment center, which is how many small sellers acquire nexus in a dozen states without ever making a decision.

Trailing nexus. Several states provide that nexus continues for a period after the activity creating it ceases, so closing an office does not end the obligation immediately.

Public Law 86-272 protects sellers of tangible personal property from net income tax where in-state activity is limited to solicitation of orders approved and filled outside the state. It has never applied to sales tax, and states have taken increasingly aggressive positions that internet activities exceed its protection for income tax purposes.

Marketplace facilitator laws

Every sales tax state now imposes collection responsibility on marketplace facilitators — platforms that facilitate sales for third-party sellers and process payment.

The practical effect for a seller on a platform:

  • The facilitator collects and remits on marketplace sales, and the seller generally does not.
  • The seller remains responsible for its direct sales (its own website, phone orders, trade shows).
  • States differ on whether marketplace sales count toward the seller's economic nexus threshold for its direct sales. In several they do, which means a seller with modest direct sales can be pushed over a threshold by platform volume it never touched.
  • The seller may still be required to register and file — sometimes reporting marketplace sales as exempt — even where it owes nothing.

For a business that operates a platform, the definitions are broad enough to capture arrangements that do not feel like marketplaces: booking sites, delivery apps, ticketing platforms, and some payment-integrated software. The threshold question is whether the business facilitates the sale and collects payment.

Taxability: what is actually taxed

Tangible personal property is presumptively taxable in every sales tax state, subject to exemptions.

Services are the opposite: presumptively exempt, except where enumerated. States range from taxing almost no services to taxing broad categories. Commonly enumerated: repair and installation services, fabrication, telecommunications, lodging, admissions, data processing, information services, security services, cleaning, landscaping, and personal services.

Software and digital products are where most modern exposure lives:

  • Prewritten (canned) software delivered on physical media is tangible personal property nearly everywhere.
  • Electronically delivered prewritten software is taxable in a majority of states, exempt in others.
  • Custom software is more often exempt, but the line between custom and prewritten-with-modifications is contested.
  • Software as a service is taxable in roughly half the states, sometimes as software, sometimes as a data processing or information service, and sometimes only for business (not personal) use. Several states tax SaaS only if the customer receives a license to use software located on the vendor's servers, and a few have reached inconsistent results within the same state over time.
  • Digital goods — downloaded music, video, e-books, and games — are taxable in many states under specific statutes.
  • Cloud infrastructure, data storage, and API access each have their own treatment, and the analysis frequently turns on how the contract describes the service rather than on what the technology does.

Bundled transactions. Where taxable and non-taxable items are sold for a single price, most states apply a true object test or a statutory bundling rule that makes the whole bundle taxable unless the non-taxable portion is separately stated and predominant. The practical consequence is that invoice design changes tax liability: separately stating implementation services, training, and support can move a substantial portion of revenue out of the tax base in some states, and the ability to do so is lost once the contract is signed with a single all-in price.

Exemptions commonly available: sales for resale; sales to exempt organizations; manufacturing machinery and equipment; agricultural inputs; research and development equipment; certain medical items; groceries and prescription drugs; and occasional sales. Each requires documentation.

Sourcing

Sourcing determines which state and locality's rate applies.

  • Destination sourcing — the sale is sourced to where the customer receives the property or service. This is the majority rule for interstate sales and for intrastate sales in most states.
  • Origin sourcing — a minority of states source intrastate sales to the seller's location.
  • Services are generally sourced to where the benefit is received, which for a multi-location customer can require multiple points of use allocation, supported by a certificate from the customer.
  • Digital products and SaaS are typically sourced to the customer's location, determined by a hierarchy: the location of receipt if known, then the customer's address in the seller's records, then the billing address, then the address from which the item was delivered.

Local rates. More than ten thousand taxing jurisdictions exist in the United States. Some states administer local tax centrally; home rule states — Colorado, Alabama, Louisiana, and Arizona in particular — permit local jurisdictions to administer their own tax with separate registration, filing, and audit. A seller compliant at the state level in Colorado may be non-compliant in dozens of municipalities, though each of those states has built centralized filing portals to reduce the burden.

Rate determination must be by address or geocode, not by ZIP code. ZIP code boundaries do not align with taxing jurisdiction boundaries, and reliance on them is a recurring audit finding.

Exemption certificates and drop shipments

The rule. A sale that would otherwise be taxable is exempt only if the seller obtains and retains a valid exemption certificate. Without it, the seller — not the buyer — owes the tax.

Practical requirements:

  • Collect the certificate at or before the sale, not at audit.
  • Verify it is complete: correct seller and buyer names, a valid permit number, the basis for exemption, a description of the property, and a signature and date.
  • Confirm the certificate is valid in the state where the sale is sourced. Some states accept multistate forms (the SST Certificate of Exemption or the MTC Uniform Sales and Use Tax Certificate); others require their own form and some require registration in that state.
  • Track expiration where applicable, and refresh blanket certificates periodically.
  • Accept in good faith — a certificate accepted in good faith generally shifts liability to the buyer, but good faith is lost where the certificate is facially deficient or the seller knows the claimed use is false.

Drop shipments create the hardest certificate problem in the field. The pattern: a customer in State C orders from a retailer in State B, which instructs a manufacturer in State A to ship directly to the customer.

The manufacturer is making a sale for resale to the retailer, so it needs a resale certificate. But the sale is sourced to State C, and States divide on whether the manufacturer may accept the retailer's home-state resale certificate or must have one issued by State C — which the retailer cannot obtain unless it registers there, which it may have no other reason to do. A minority of states accept any state's certificate or a statement of the retailer's registration number in any state; others insist on their own.

The consequence: manufacturers routinely charge tax on drop shipments to unregistered retailers, and the retailer absorbs it as a cost. The workaround is registration in the destination state, or negotiating with the supplier on the basis of the destination state's specific rule.

Personal liability: trust fund taxes

This is the reason sales tax deserves more attention than its dollar amount suggests.

Sales tax collected from customers is held in trust for the state. Nearly every state imposes personal liability on responsible persons for failure to remit — officers, directors, members, and any employee with authority over the collection, accounting, or payment of the tax.

Features that make this exposure unusual:

  • It is personal, so the corporate form provides no protection.
  • It generally survives bankruptcy — trust fund taxes are excepted from discharge.
  • It attaches to persons with authority, whether or not they exercised it. A CFO who did not know is frequently liable; a controller who was told not to pay is frequently liable.
  • Willfulness in most states means voluntarily and consciously paying other creditors while knowing the tax was unpaid — not an intent to defraud.

Successor liability. In an asset purchase, most states impose liability on the buyer for the seller's unpaid sales tax, up to the purchase price, unless the buyer follows the state's bulk sale notice procedure and obtains a tax clearance certificate. That procedure typically requires notice to the department a stated number of days before closing and withholding of funds pending clearance. Skipping it is one of the most common and most avoidable diligence failures in small-company M&A.

Remediation: voluntary disclosure and amnesty

The core problem with waiting. In most states, the statute of limitations does not run where no return was filed. A seller that has been collecting nothing for six years does not have a three-year exposure; it has a six-year exposure, growing.

Voluntary disclosure agreements (VDAs) are the standard remedy. A taxpayer that has not been contacted by the state approaches it — usually anonymously, through counsel or an advisor, as "Taxpayer A" — and negotiates:

  • A limited look-back period, commonly three or four years, instead of the full period of exposure.
  • Waiver of penalties, which can be substantial.
  • Sometimes partial interest relief, though interest is more often required.
  • Prospective registration and compliance.

Requirements and traps:

  • The taxpayer must not have been contacted by the state. A single nexus questionnaire in the mail can disqualify a VDA in that state, which is why the questionnaires are sent.
  • Tax actually collected from customers but not remitted is generally not eligible for look-back limitation — the state will want all of it, because the money was never the seller's.
  • The identity is disclosed only when terms are agreed.
  • The Multistate Tax Commission administers a multistate voluntary disclosure program allowing a single application to many states at once, which is efficient for a company with exposure in fifteen or twenty jurisdictions.

Amnesty programs appear periodically, offering penalty and sometimes interest waiver on a fixed timetable. They are less flexible than a VDA but occasionally more generous.

Managed audits allow a taxpayer to perform the audit itself under department supervision, often with penalty and interest concessions, and are worth considering where the taxpayer's records are good and the issues are quantifiable.

Sequencing a cleanup. Quantify the exposure by state before contacting anyone. Prioritize states with the largest exposure and the shortest VDA look-back. Register prospectively where exposure is minimal and the state's rules make a VDA unnecessary. Do not simply register and begin filing in a state with historical exposure — registration frequently prompts the question of when nexus began, and answering it truthfully on a registration application starts a conversation about back periods with none of the VDA's protections.

Audits

How they start. A nexus questionnaire; a referral from another state or from a federal audit; an industry sweep; a customer's use tax audit that identifies the seller; or a whistleblower. Several states run data-matching programs against federal filings and against marketplace reporting.

The process. Notice, an opening conference, a document request, sampling, a preliminary assessment, an exit conference, a formal assessment, then an administrative protest and, if unresolved, an appeal to a tax tribunal or court. Deadlines to protest are short — frequently 30 to 60 days — and missing one can make the assessment final.

What auditors look for, in rough order of frequency:

  1. Missing or invalid exemption certificates — usually the single largest adjustment.
  2. Use tax on purchases: fixed assets, supplies, software, promotional items, and anything bought from an out-of-state vendor that did not charge tax.
  3. Untaxed services that the state enumerates.
  4. Sourcing and local rate errors.
  5. Bundled transactions taxed as if unbundled.
  6. Items withdrawn from inventory for the seller's own use.
  7. Shipping and handling charges, which are taxable in many states when the underlying sale is taxable.
  8. Intercompany transactions between affiliates.

Managing the audit. Designate a single point of contact. Produce what is requested and no more. Negotiate the sampling methodology in writing before the sample is drawn — a badly designed sample extrapolated across three years produces most of the surprise in a large assessment. Perform a reverse audit simultaneously to identify tax overpaid on exempt purchases, which can offset the assessment. And obtain missing exemption certificates during the audit; most states permit a period to cure certificate deficiencies.

A worked example

Larkspur Analytics sells a subscription analytics platform. Home state: Georgia. Revenue: $14 million. No offices or employees outside Georgia.

The assessment. Counsel and a state tax advisor run a nexus and taxability study.

  • Nexus. Revenue by customer billing address shows economic nexus thresholds exceeded in 22 states, the earliest crossings four to five years earlier.
  • Taxability. SaaS is taxable in 12 of those 22. In 3 more it is taxable as a data processing or information service. In 7 it is not taxable at all.
  • Exposure. Roughly $1.6 million of tax plus interest and penalties across 15 states.
  • Customer contracts. Most contain a standard clause making the customer responsible for applicable taxes, which means Larkspur can, in principle, bill customers for the tax. In practice it can do so for current customers and not for churned ones.

The plan.

  1. Register prospectively and begin collecting in all 15 taxable states within 60 days, which stops the bleeding — the single highest-value step.
  2. File VDAs in the 9 states with exposure above $50,000, through the MTC's multistate program where eligible, negotiating three-to-four year look-backs and penalty waiver.
  3. Register and file limited back returns in the 6 smaller states where the exposure is under the cost of a VDA process.
  4. Restructure invoicing to separately state implementation, training, and support, which are exempt in several of the taxable states, reducing the go-forward tax base by roughly 18 percent.
  5. Implement tax determination software integrated with billing, with exemption certificate management.
  6. Collect exemption certificates from the 140 customers claiming exempt status, of which 38 had never provided one.
  7. Add a tax gross-up clause to the standard order form and confirm the existing clause's enforceability.

Result. Total cost of remediation, including tax, interest, professional fees, and software: about $940,000 against an unremediated exposure exceeding $2.2 million and growing. More importantly, the following year's sale process produced no sales tax escrow, because the diligence question had a documented answer.

A compliance checklist

Annually, and on any material change

  • Run a nexus study: revenue and transaction counts by state, plus physical presence (employees, contractors, inventory, offices, trade shows, installation or repair visits).
  • Confirm current thresholds and measurement periods, and whether exempt and marketplace sales count.
  • Confirm taxability of each product and service line in each nexus state, including SaaS and digital products.
  • Review invoice structure for separately stated non-taxable components.
  • Reconcile exemption certificates against exempt sales; obtain missing ones.
  • Verify rate determination is by address or geocode, and that home rule localities are addressed.
  • Accrue use tax on purchases where no tax was charged — this is the most commonly skipped compliance step.
  • Confirm filing calendars and that returns are filed even for zero-tax periods, since failure to file is often penalized independently.

On expansion

  • Before hiring in a new state, storing inventory there, or attending a trade show, check the nexus consequences.
  • Before launching on a marketplace, confirm which sales the facilitator will collect on and whether they count toward your thresholds.

On a transaction

  • Sell side: conduct the nexus and taxability study before diligence, and remediate through VDAs — the exposure will otherwise be found and escrowed.
  • Buy side: request registration status, returns, exemption certificate practices, and audit history in every state, and follow the bulk sale notice procedure to obtain tax clearance.

Governance

  • Assign a named owner for indirect tax.
  • Confirm who is a responsible person and make sure they know it.
  • Never permit sales tax collected from customers to be used for operating cash. It is not the company's money, and the person who authorizes it is personally liable.

Frequently asked questions

We only sell services. Does sales tax apply? Possibly. Services are exempt unless enumerated, but many states enumerate broadly, and SaaS and digital products are taxable in roughly half of them.

We use Amazon or another marketplace. Are we covered? For marketplace sales, generally yes. For your direct sales, no — and in several states marketplace volume counts toward your economic nexus threshold.

How far back can they go? If you never filed, in most states there is no limitations period. That is the central risk.

Our contract says the customer pays applicable taxes. Doesn't that solve it? It gives you a contractual claim against current customers. The state's claim is against you, and churned customers are unrecoverable in practice.

We store inventory in a fulfillment center in another state. Does that create nexus? Physical presence nexus, yes, in essentially every state — and it is the most common way small sellers acquire obligations they never chose.

Should we just register everywhere? No. Registration creates filing obligations and can invite questions about prior periods. Register where you have nexus, and remediate historical exposure through a VDA before registering in a state with a back-period problem.

Is a resale certificate from our home state good in other states? Sometimes. Drop shipment rules vary, and several states require their own certificate or registration in that state.

Can the state come after me personally? Yes, for collected-but-unremitted tax, under responsible person statutes, and the liability generally survives bankruptcy.

Conclusion

Sales tax is not a complicated tax. It is a high-frequency tax, applied across many jurisdictions with inconsistent rules, and the compliance obligation attaches quietly the moment a threshold is crossed in a state nobody was watching.

Three habits eliminate nearly all of the exposure. Run a nexus study once a year against actual revenue by state. Understand whether what you sell is taxable in the states where you sell it — the answer for software is different in half of them. And treat collected tax as money you are holding for someone else, because that is exactly what it is, and because the person who forgets it is personally on the hook.

Everything after that is remediation, and remediation is always available. It is simply more expensive than the annual study, by roughly an order of magnitude.

Income tax nexus, and why the answer differs

Sales tax nexus is not the only nexus, and a company that solves the sales tax problem sometimes discovers a second one behind it.

State income and franchise tax nexus follows its own rules. Wayfair addressed sales tax, but its reasoning has been applied by states to income tax as well, and most states now assert economic nexus for income tax based on receipts thresholds — commonly $500,000 to $1,000,000 of in-state receipts, sometimes with property and payroll alternatives. Several states also impose factor presence standards adopted from the Multistate Tax Commission's model.

Public Law 86-272, 15 U.S.C. §§ 381-384, is the one federal protection, and it is narrow. It bars a state from imposing a net income tax where the only in-state activity is solicitation of orders for sales of tangible personal property, with orders approved and filled outside the state. It does not protect sellers of services, licensors of software, or anyone whose in-state activity exceeds solicitation — and states now take the position that a range of internet activities exceed it, including providing post-sale chat support, placing cookies that gather information for non-solicitation purposes, and offering job applications on a website. It also does not protect against franchise, gross receipts, or margin taxes, which is why a company protected from Texas franchise tax by 86-272 is protected by nothing at all — Texas's margin tax is not a net income tax.

Apportionment. Once nexus exists, income is apportioned. Most states have moved to single sales factor apportionment, with market-based sourcing for services and intangibles — sourcing receipts to where the customer receives the benefit rather than where the cost of performance occurred. The shift means a software or services company with no physical presence anywhere but its home state can owe income tax in every state where its customers are.

Gross receipts taxes — Ohio's commercial activity tax, Washington's business and occupation tax, Oregon's corporate activity tax, Nevada's commerce tax, and Texas's margin tax — apply without regard to profitability and without the protection of P.L. 86-272. A company with losses can owe them.

Pass-through entities add another layer: composite returns, nonresident withholding on distributive shares, and pass-through entity tax elections enacted by most states in response to the federal deduction limitation on state and local taxes, which shift the tax to the entity level and can produce a meaningful federal benefit for owners.

The practical point. A nexus study should cover all state taxes, not sales tax alone. The states where a company owes income tax and the states where it owes sales tax overlap substantially but are not the same set, the thresholds are different, and the remediation paths — including VDAs — are usually negotiated together.

Technology and process: what actually works

Nobody complies with fifty states' sales tax rules by hand, and the choice of tooling determines whether compliance is a background process or a monthly crisis.

Tax determination engines integrate with the billing or e-commerce system and calculate rate and taxability at the transaction level, using address-level geocoding and maintained taxability matrices by product code. The value is not the rate lookup — that part is easy — but the product taxability mapping, which must be built once, carefully, for each SKU or revenue line and reviewed when a product changes. A determination engine configured with a generic product code produces confidently wrong answers in every state at once.

Exemption certificate management is the module most companies skip and most auditors examine first. What it should do: collect certificates at onboarding through a customer-facing workflow, validate completeness and permit numbers, tie each certificate to the customer record so exempt transactions cannot post without one, flag expirations, and produce an audit-ready package by state. The manual alternative — a shared drive of PDFs — fails at audit predictably.

Return preparation and filing can be outsourced or automated. The economics favor automation above roughly ten filing jurisdictions. Confirm that the service handles home rule localities, prepayment requirements in high-volume states, and zero-dollar returns, which are separately penalized if missed.

Use tax accrual on the purchasing side is the most commonly missing control. The workable design flags purchases from vendors that did not charge tax, routes them for a taxability decision, and accrues automatically for recurring categories — software, supplies, promotional items, and fixed assets bought out of state.

Governance that keeps it working:

  • A quarterly nexus refresh run against actual revenue by state, not against last year's assumptions.
  • A change control step so that launching a product, entering a state, or signing a marketplace agreement triggers a tax review before, not after.
  • Reconciliation of tax collected to tax remitted every month. A gap means either an unremitted liability or an over-collection, and both are problems.
  • An owner, named, who is accountable — and who understands that the collected tax is trust money.

The tooling is not expensive relative to the exposure. The single most common failure is not the absence of software; it is a correct system fed a product taxability mapping that nobody has revisited since implementation.

Related articles

This article is provided for general informational purposes and does not constitute legal or tax advice. Nexus thresholds, taxability of software and services, sourcing rules, and voluntary disclosure terms vary by state and change frequently. Consult qualified state and local tax counsel before registering, filing back returns, or responding to a nexus questionnaire.