IBRAVRA Media Network
Taxes • 12 min read

Wayfair Audit Defense: How to Price, Disclose, and Survive a Multi-State Sales Tax Audit

South Dakota v. Wayfair ended the physical-presence shield in 2018, and the audit wave it created is still arriving. This playbook prices historical exposure state by state, sequences voluntary disclosure against registration-first filing, and sets the record protocol auditors actually test.

By Enow A. Jovial • Published 2026-11-04

The letter that ends the argument about nexus

A sales tax audit notice does not ask whether you knew about economic nexus. It asks for three things: your sales by ship-to state, your exemption certificates, and your marketplace facilitator reports. If those three records do not reconcile, the auditor does not need your opinion on the law — the assessment writes itself from your own data.

That is the practical legacy of South Dakota v. Wayfair, Inc., 585 U.S. 162 (2018). Before Wayfair, the physical-presence rule from Quill Corp. v. North Dakota let a remote seller argue that no warehouse, no employee, and no office in a state meant no collection duty. The Court overruled that rule as unsound and incorrect, holding that a seller with no physical presence can still have the substantial nexus the Commerce Clause requires. The South Dakota statute at issue covered only sellers delivering more than $100,000 of goods or services into the state, or engaging in 200 or more separate delivery transactions — and the syllabus notes South Dakota estimated it was losing $48 to $58 million a year to non-collection under the old rule.

> [!KEY TAKEAWAY]

> Wayfair did not create a single national threshold. It licensed every state to set its own, and the states did — with different dollar tests, different measurement periods, and different treatment of marketplace sales. Audit defense is therefore a state-by-state computation, not a single compliance switch.

!The Texas Comptroller remote-seller page: the $500,000 safe harbor for the preceding twelve months, and the single local use tax rate of 1.75 percent

Who this playbook is for, and who should stop here

This playbook is for founders, controllers, and CPAs of remote sellers — B2B SaaS vendors, e-commerce stores, and marketplace sellers — who have unregistered historical sales in one or more states, or who are about to cross a threshold and want the sequencing right. It assumes you sell tangible goods or taxable services into the United States; it is written for a seller whose records live in a POS system, a payment processor, and a spreadsheet, not for a seller with a dedicated tax engine already reconciling every order.

Do not use this playbook as a substitute for state-specific advice if any of these apply: you have already received an audit notice or assessment from a state (that state is now in defense mode, and disclosure strategy changes completely); you sell alcohol, tobacco, motor fuel, or another excise-controlled category with its own registration regime; or your sales include resale or exempt-organization transactions that turn on certificate validity rather than thresholds. Those cases need a CPA or tax attorney before you file anything, because a voluntary disclosure filed with wrong numbers is worse than no disclosure at all.

The threshold table auditors actually apply

Four states illustrate why a single rule of thumb fails. California measures the preceding or current calendar year; Texas measures the preceding twelve calendar months on a rolling basis; Florida measures the prior calendar year; South Dakota, the Wayfair state itself, uses a dollar-or-transactions test. The measurement period decides the answer as often as the dollar figure does.

| State | Economic nexus test | Measurement period | Authority |

| :--- | :--- | :--- | :--- |

| California | More than $500,000 of total combined sales for delivery in California, including sales by related persons | Preceding or current calendar year | CDTFA Publication 109; Cal. Rev. & Tax. Code § 6203, Regulation 1684 |

| Texas | Total Texas revenue of $500,000 or more; below that is a safe harbor | Preceding twelve calendar months, rolling | Texas Comptroller, Remote Sellers |

| Florida | Total sales over $100,000 into Florida, any number of transactions | Prior calendar year | Florida Department of Revenue, sales tax registration guidance |

| South Dakota | More than $100,000 of goods or services delivered, or 200 or more separate delivery transactions | Annual basis | South Dakota v. Wayfair, 585 U.S. 162 (2018), syllabus |

Two timing traps sit inside that table. First, California has no transaction-count test and no grace period after crossing: once the $500,000 line is passed, registration and collection follow immediately, and a seller with no California place of business registers for a Certificate of Registration - Use Tax rather than a seller permit. Second, Texas gives the most generous runway in the table and sellers still miss it: collection must begin no later than the first day of the fourth month after the month the safe harbor was exceeded. Cross in March, collect by July 1. The Comptroller illustrates the rule with a seller exceeding the safe harbor in a July-to-June period and obtaining a permit by October 1 — the first day of the fourth month after June.

!The Wayfair syllabus: the Court held the physical-presence rule of Quill unsound and incorrect, and overruled Quill and National Bellas Hess

Pricing the exposure before the auditor does

An auditor prices exposure the same way you should: taxable sales by state, multiplied by the applicable rate, for every unregistered period, plus penalties and interest on top. Run that computation yourself, state by state, before any filing decision. The formula is deliberately simple, because the auditor version is too:

$

\text{Exposure}_s = \sum_{y} \left( \text{Taxable Sales}_{s,y} \times \tau_s \right) + \text{Penalties}_s + \text{Interest}_s

$

Where $s$ is the state, $y$ is each unregistered year, and $\tau_s$ is the applicable state-and-local rate. Our editorial analysis uses the state base rate for the first pass and treats district or local taxes, penalties, and interest as additions, because the base-rate figure is the one every state publishes and the one an auditor never disputes.

Worked example A: California, three unregistered years

A B2B SaaS and hardware seller with $800,000 of California taxable sales per year, unregistered for three years, at the California statewide base rate of 7.25 percent:

$

\text{Base Tax} = 3 \times (\$800{,}000 \times 7.25\%) = 3 \times \$58{,}000 = \$174{,}000

$

That $174,000 is the floor, not the bill. District taxes in many California jurisdictions lift the combined rate well above 7.25 percent, and penalties and interest accrue on top of the tax for each year. A seller that quotes itself $174,000 and budgets $174,000 has budgeted for the smallest number in the assessment. The honest budget line is base tax, plus district-tax uplift on the same sales, plus penalties, plus interest — computed year by year, because interest compounds with time and the oldest year is always the most expensive.

Worked example B: Texas timing changes the bill

A remote seller crosses the Texas $500,000 safe harbor in March with $90,000 of Texas taxable sales in each following month. If it registers and collects from July 1, as the Comptroller requires, its uncollected Texas exposure is limited to the April-to-June gap only if it also resolves those months — and the gap months are taxable sales it should have collected on once the obligation attached. At the Texas state rate of 6.25 percent, three gap months at $90,000 produce:

$

\text{Gap Tax} = 3 \times (\$90{,}000 \times 6.25\%) = 3 \times \$5{,}625 = \$16{,}875

$

Before local tax, penalties, and interest. The lesson is not the $16,875 — it is that the Texas fourth-month rule converts a timing delay into a fixed, computable liability. Every month of delay after the deadline adds another month of sales to the same formula. Sellers that treat the deadline as advisory are not saving the tax; they are financing it at penalty rates.

The marketplace facilitator trap

Marketplace facilitator laws shifted collection duty to the platform for facilitated sales, and many sellers read that as a full exemption. It is not. Three distinctions decide whether the facilitator shield holds:

1. Facilitated sales still count toward thresholds. California counts total combined sales for delivery in the state, and marketplace-facilitated sales are part of that total even when the facilitator remits the tax. A seller can cross $500,000 entirely through a marketplace and still need its own registration the moment it makes a direct sale.

2. The shield covers facilitated sales only. The first direct sale — your own checkout, a phone order, a wholesale order shipped direct — creates a collection duty on that sale and, in California, ends the all-facilitated position. Sellers that add a direct channel months after building a marketplace business routinely discover the registration duty retroactively.

3. The facilitator report is your evidence, not your filing. Auditors accept facilitator collection reports as proof for facilitated sales, but they test them against your own order records. A mismatch between your POS export and the facilitator report becomes a sampling population: the auditor extrapolates the gap across the audit period instead of accepting either figure.

Keep facilitator reports by state and by month, in CSV form, with the facilitator name, the collection amount, and the order identifiers. An auditor who cannot tie your report to your orders will treat the un-tied portion as uncollected.

Voluntary disclosure versus registration-first

When historical exposure exists and no state has made contact, the seller faces a genuine fork. Registration-first is faster: register, begin collecting, and file prospectively. Its cost is that historical years remain fully exposed — the state can still audit them, with its full lookback, full penalties, and full interest, and your own registration just told the state where to look.

A voluntary disclosure reverses the order: the seller approaches the state (usually anonymously through a CPA at first), discloses the historical period, files the back returns, and pays the tax, in exchange for a limited lookback and penalty relief. The disclosure is valuable precisely because it is made before contact. The sequence matters more than the label — a disclosure filed after an audit notice is not a disclosure, it is a late filing inside an audit.

> [!WARNING]

> Never file a voluntary disclosure with estimated numbers, and never let a disclosure identify you before the terms are agreed. A disclosure that understates a year by a material amount can be treated as a false filing, and a disclosure that names the seller before the state agrees to penalty relief surrenders the only leverage the program offers. Run the state-by-state exposure computation first, have a CPA review it, and disclose through counsel or a CPA under the program rules.

The decision rule our editorial analysis recommends: if unregistered years exist in a state and the exposure exceeds one month of that state's sales, price a disclosure before registering there. If the exposure is a single partial year and the state has a short lookback, registration-first with back returns for the known period can be cheaper than a formal program — but that call belongs to a CPA who has seen the actual sales data, not to a founder estimating from memory.

The audit defense record protocol

Auditors test records, not intentions. The protocol below is the minimum set that survives sampling, and every item should exist before any disclosure or registration filing, because records created after an audit notice carry less weight than records kept in the ordinary course.

  • [x] Step 1: Freeze the sales ledger. Export POS and payment-processor sales by ship-to state and month, in CSV, and lock the export with a date stamp. Do not edit historical orders after the freeze; corrections go in a separate adjustment log.
  • [x] Step 2: Reconcile the three populations. Tie POS sales, payment-processor settlements, and marketplace facilitator reports to each other by state and month. Document every break in a reconciliation note — an unexplained break is the auditor sampling population.
  • [x] Step 3: Validate exemption certificates. Pull every resale and exempt-organization certificate relied on, check names, dates, and state validity, and discard any certificate that does not match the purchaser on the order. An invalid certificate converts an exempt sale into a taxable one.
  • [x] Step 4: Map nexus dates. For each state, record the date the threshold was crossed, the measurement period that applies, and the registration date. The gap between crossing and registration is the exposure period — never leave it blank.
  • [x] Step 5: Preserve the facilitator evidence. Keep facilitator collection reports, remittance confirmations, and platform tax settings by state and month. If the facilitator collected, the report is the defense; if it is missing, the sale is undefended.
  • [x] Step 6: Route all state contact through one owner. Every letter, email, and phone call from a state tax agency goes to the CPA or attorney of record, logged with a date. A casual reply from operations can concede a nexus date the records do not support.
  • Operator boundaries: who should not self-file this

    A seller with under $100,000 of annual remote sales in every state, no marketplace complication, and no historical gap can usually register prospectively without a program. A seller with multi-year gaps in five or more states, a mix of facilitated and direct sales, or any prior state contact should not self-file a disclosure. The reason is arithmetic, not caution: each state has its own lookback, its own penalty structure, and its own facilitator rules, and a filing that is correct in Texas can be wrong in California on the same facts. The CPA fee for a multi-state disclosure is small against a single state assessment computed the way Worked Example A computes it.

    > [!FOUNDER]

    > "Founders treat a sales tax audit as a legal event. It is an accounting event with a legal wrapper — the auditor multiplies your own sales by the state's rate, and the only negotiation is over which sales count and how many years back. Price the exposure yourself, state by state, before any state prices it for you. That single computation decides whether disclosure, registration, or defense is the right move."

    > — Enow A. Jovial, Founder & Chief Executive Officer

    > [!TIP]

    > Set the nexus tracker to the strictest measurement period you sell into, not the most familiar one. A tracker that resets every January 1 will miss a Texas rolling-twelve-month crossing in June and a Florida prior-year test that looks backward, not forward. Track rolling twelve months, current calendar year, and prior calendar year simultaneously, per state, from the same POS export.

    Related reading on this site: the US state economic nexus guide for digital goods for the threshold landscape this playbook defends against, the Stripe Tax nexus guide for 2026 for automating collection once registered, and the quarterly estimated tax guide for the income-tax calendar that runs beside the sales-tax one. To model how an assessment lands on your margin before you choose a path, run the numbers through the break-even calculator.