Wayfair Audit Defense: How to Price, Disclose, and Survive a Multi-State Sales Tax Audit

The letter that ends the argument about nexus

A sales tax audit notice does not ask whether you knew about economic nexus. It asks for three things: your sales by ship-to state, your exemption certificates, and your marketplace facilitator reports. If those three records do not reconcile, the auditor does not need your opinion on the law — the assessment writes itself from your own data.

That is the practical legacy of South Dakota v. Wayfair, Inc., 585 U.S. 162 (2018). Before Wayfair, the physical-presence rule from Quill Corp. v. North Dakota let a remote seller argue that no warehouse, no employee, and no office in a state meant no collection duty. The Court overruled that rule as unsound and incorrect, holding that a seller with no physical presence can still have the substantial nexus the Commerce Clause requires. The South Dakota statute at issue covered only sellers delivering more than $100,000 of goods or services into the state, or engaging in 200 or more separate delivery transactions — and the syllabus notes South Dakota estimated it was losing $48 to $58 million a year to non-collection under the old rule.

Who this playbook is for, and who should stop here

This playbook is for founders, controllers, and CPAs of remote sellers — B2B SaaS vendors, e-commerce stores, and marketplace sellers — who have unregistered historical sales in one or more states, or who are about to cross a threshold and want the sequencing right. It assumes you sell tangible goods or taxable services into the United States; it is written for a seller whose records live in a POS system, a payment processor, and a spreadsheet, not for a seller with a dedicated tax engine already reconciling every order.

Do not use this playbook as a substitute for state-specific advice if any of these apply: you have already received an audit notice or assessment from a state (that state is now in defense mode, and disclosure strategy changes completely); you sell alcohol, tobacco, motor fuel, or another excise-controlled category with its own registration regime; or your sales include resale or exempt-organization transactions that turn on certificate validity rather than thresholds. Those cases need a CPA or tax attorney before you file anything, because a voluntary disclosure filed with wrong numbers is worse than no disclosure at all.

The threshold table auditors actually apply

Four states illustrate why a single rule of thumb fails. California measures the preceding or current calendar year; Texas measures the preceding twelve calendar months on a rolling basis; Florida measures the prior calendar year; South Dakota, the Wayfair state itself, uses a dollar-or-transactions test. The measurement period decides the answer as often as the dollar figure does.

Two timing traps sit inside that table. First, California has no transaction-count test and no grace period after crossing: once the $500,000 line is passed, registration and collection follow immediately, and a seller with no California place of business registers for a Certificate of Registration - Use Tax rather than a seller permit. Second, Texas gives the most generous runway in the table and sellers still miss it: collection must begin no later than the first day of the fourth month after the month the safe harbor was exceeded. Cross in March, collect by July 1. The Comptroller illustrates the rule with a seller exceeding the safe harbor in a July-to-June period and obtaining a permit by October 1 — the first day of the fourth month after June.

Pricing the exposure before the auditor does

An auditor prices exposure the same way you should: taxable sales by state, multiplied by the applicable rate, for every unregistered period, plus penalties and interest on top. Run that computation yourself, state by state, before any filing decision. The formula is deliberately simple, because the auditor version is too:

Where $s$ is the state, $y$ is each unregistered year, and $\tau_s$ is the applicable state-and-local rate. Our editorial analysis uses the state base rate for the first pass and treats district or local taxes, penalties, and interest as additions, because the base-rate figure is the one every state publishes and the one an auditor never disputes.

Worked example A: California, three unregistered years

A B2B SaaS and hardware seller with $800,000 of California taxable sales per year, unregistered for three years, at the California statewide base rate of 7.25 percent:

That $174,000 is the floor, not the bill. District taxes in many California jurisdictions lift the combined rate well above 7.25 percent, and penalties and interest accrue on top of the tax for each year. A seller that quotes itself $174,000 and budgets $174,000 has budgeted for the smallest number in the assessment. The honest budget line is base tax, plus district-tax uplift on the same sales, plus penalties, plus interest — computed year by year, because interest compounds with time and the oldest year is always the most expensive.

Worked example B: Texas timing changes the bill

A remote seller crosses the Texas $500,000 safe harbor in March with $90,000 of Texas taxable sales in each following month. If it registers and collects from July 1, as the Comptroller requires, its uncollected Texas exposure is limited to the April-to-June gap only if it also resolves those months — and the gap months are taxable sales it should have collected on once the obligation attached. At the Texas state rate of 6.25 percent, three gap months at $90,000 produce:

Before local tax, penalties, and interest. The lesson is not the $16,875 — it is that the Texas fourth-month rule converts a timing delay into a fixed, computable liability. Every month of delay after the deadline adds another month of sales to the same formula. Sellers that treat the deadline as advisory are not saving the tax; they are financing it at penalty rates.

The marketplace facilitator trap

Marketplace facilitator laws shifted collection duty to the platform for facilitated sales, and many sellers read that as a full exemption. It is not. Three distinctions decide whether the facilitator shield holds:

1. Facilitated sales still count toward thresholds. California counts total combined sales for delivery in the state, and marketplace-facilitated sales are part of that total even when the facilitator remits the tax. A seller can cross $500,000 entirely through a marketplace and still need its own registration the moment it makes a direct sale.
2. The shield covers facilitated sales only. The first direct sale — your own checkout, a phone order, a wholesale order shipped direct — creates a collection duty on that sale and, in California, ends the all-facilitated position. Sellers that add a direct channel months after building a marketplace business routinely discover the registration duty retroactively.
3. The facilitator report is your evidence, not your filing. Auditors accept facilitator collection reports as proof for facilitated sales, but they test them against your own order records. A mismatch between your POS export and the facilitator report becomes a sampling population: the auditor extrapolates the gap across the audit period instead of accepting either figure.

Keep facilitator reports by state and by month, in CSV form, with the facilitator name, the collection amount, and the order identifiers. An auditor who cannot tie your report to your orders will treat the un-tied portion as uncollected.

Voluntary disclosure versus registration-first

When historical exposure exists and no state has made contact, the seller faces a genuine fork. Registration-first is faster: register, begin collecting, and file prospectively. Its cost is that historical years remain fully exposed — the state can still audit them, with its full lookback, full penalties, and full interest, and your own registration just told the state where to look.

A voluntary disclosure reverses the order: the seller approaches the state (usually anonymously through a CPA at first), discloses the historical period, files the back returns, and pays the tax, in exchange for a limited lookback and penalty relief. The disclosure is valuable precisely because it is made before contact. The sequence matters more than the label — a disclosure filed after an audit notice is not a disclosure, it is a late filing inside an audit.

The decision rule our editorial analysis recommends: if unregistered years exist in a state and the exposure exceeds one month of that state's sales, price a disclosure before registering there. If the exposure is a single partial year and the state has a short lookback, registration-first with back returns for the known period can be cheaper than a formal program — but that call belongs to a CPA who has seen the actual sales data, not to a founder estimating from memory.

The audit defense record protocol

Auditors test records, not intentions. The protocol below is the minimum set that survives sampling, and every item should exist before any disclosure or registration filing, because records created after an audit notice carry less weight than records kept in the ordinary course.

• [x] Step 1: Freeze the sales ledger. Export POS and payment-processor sales by ship-to state and month, in CSV, and lock the export with a date stamp. Do not edit historical orders after the freeze; corrections go in a separate adjustment log.
• [x] Step 2: Reconcile the three populations. Tie POS sales, payment-processor settlements, and marketplace facilitator reports to each other by state and month. Document every break in a reconciliation note — an unexplained break is the auditor sampling population.
• [x] Step 3: Validate exemption certificates. Pull every resale and exempt-organization certificate relied on, check names, dates, and state validity, and discard any certificate that does not match the purchaser on the order. An invalid certificate converts an exempt sale into a taxable one.
• [x] Step 4: Map nexus dates. For each state, record the date the threshold was crossed, the measurement period that applies, and the registration date. The gap between crossing and registration is the exposure period — never leave it blank.
• [x] Step 5: Preserve the facilitator evidence. Keep facilitator collection reports, remittance confirmations, and platform tax settings by state and month. If the facilitator collected, the report is the defense; if it is missing, the sale is undefended.
• [x] Step 6: Route all state contact through one owner. Every letter, email, and phone call from a state tax agency goes to the CPA or attorney of record, logged with a date. A casual reply from operations can concede a nexus date the records do not support.

Operator boundaries: who should not self-file this

A seller with under $100,000 of annual remote sales in every state, no marketplace complication, and no historical gap can usually register prospectively without a program. A seller with multi-year gaps in five or more states, a mix of facilitated and direct sales, or any prior state contact should not self-file a disclosure. The reason is arithmetic, not caution: each state has its own lookback, its own penalty structure, and its own facilitator rules, and a filing that is correct in Texas can be wrong in California on the same facts. The CPA fee for a multi-state disclosure is small against a single state assessment computed the way Worked Example A computes it.

Related reading on this site: the US state economic nexus guide for digital goods for the threshold landscape this playbook defends against, the Stripe Tax nexus guide for 2026 for automating collection once registered, and the quarterly estimated tax guide for the income-tax calendar that runs beside the sales-tax one. To model how an assessment lands on your margin before you choose a path, run the numbers through the break-even calculator.

Compare the automation vendors in the Stripe Tax vs Avalara vs TaxJar sales-tax automation playbook.