The Sales Tax Compliance Framework DTC Brands Actually Need

The Sales Tax Compliance Framework DTC Brands Actually Need

Most physical product operators learn about economic nexus the same way: a compliance officer from California, Washington, or Texas sends an envelope, and the spreadsheet inside says you owed sales tax in fourteen states for the past three years. By that point you are not negotiating compliance. You are negotiating penalty interest.

Sales tax is not a bookkeeping problem. It is a nexus-detection problem disguised as a checkbox. The brands that treat it like a checkbox are the ones writing six-figure cheques to states they did not know they were operating in.

The $2M Trap: Why Shopify Tax Quietly Builds a Five-Year Liability

Walk into any Shopify backend at $1.5M revenue and you will see Shopify Tax switched on, calculating destination-based rates, and reporting clean-looking numbers each month. The operator believes the platform is handling tax. The platform is calculating tax. Those two sentences are not the same.

The 2018 Wayfair Supreme Court ruling ended the old physical-presence rule and replaced it with revenue and transaction thresholds set by each state. Forty-five states plus DC now look at how much you sell, not where your warehouse sits. Most thresholds land at $100,000 in revenue or 200 transactions in a calendar year, with variations that punish brands assuming a single national rule applies. The Avalara nexus tracker keeps a state-by-state ledger because the state legislatures keep moving the bars.

Here is the part that destroys margin. Crossing a state's threshold creates a registration obligation, not just a collection one. If you cross the threshold in Texas in March and notice it in October, you owe Texas sales tax on every order shipped into Texas from March forward, regardless of whether you collected it from the customer. The state does not care that Shopify did not flag it. The state cares that you sold $103,000 of product into its borders and never registered.

A physical product brand hitting $2M in US revenue typically crosses economic nexus in 15 to 25 states inside the first 12 months of that revenue. The Sales Tax Institute guide lists every threshold and every effective date, and the math is harder than it looks because state thresholds use different lookback periods, prior calendar year, current year to date, or rolling twelve months. A brand crossing in March 2025 might be liable from April 1 in one state and from January 1 the following year in another.

Now layer on the marketplace facilitator trap. Amazon, Walmart Marketplace, eBay, and Etsy collect and remit on your behalf in most states. Your DTC Shopify orders do not. Operators reading their tax dashboard see "covered" totals from the marketplaces and assume they are fully covered. They are not. Their brand-website orders sit naked and exposed in every state where they have crossed a threshold, accruing penalty interest at rates that range from 10% to 25% per year depending on the jurisdiction.

The pattern I see most often: a $4M skincare brand confident their Shopify Tax setup is current, with three years of unregistered DTC collection in 11 states, sitting on a back-assessment liability of roughly $240,000 in tax plus penalties. They never knew. The platform never told them. That is the lie.

The Nexus Exposure Protocol

I call this The Nexus Exposure Protocol. It is a continuously monitored map of three things: where you have crossed economic nexus thresholds, what your registration and remediation status is in each of those states, and what your current month's exposure trajectory looks like for states you have not yet triggered. The Protocol replaces the set-and-forget Shopify default with a state-by-state ledger that an operator owns.

Three principles drive The Nexus Exposure Protocol.

First, treat each state as a separate compliance entity. There is no national US sales tax. There is no single threshold. Texas, California, and Pennsylvania each run independent regimes with independent revenue triggers, registration windows, return cadences, and remediation programs. Shopify's tax engine knows the rates. It does not know your historical revenue against each state's lookback rule.

Second, separate platform-collected sales from facilitator-collected sales in your reporting. Marketplace facilitator laws are strong shields for Amazon and Walmart channels, but those laws say nothing about your DTC store. The Shopify US tax docs confirm Shopify is not a marketplace facilitator for your own store. Your Shopify orders are your liability. Run two columns: facilitator-covered revenue and DTC revenue. Only the DTC column counts toward your nexus calculation in most states.

Third, anchor remediation to voluntary disclosure rather than back-filing. The MTC voluntary disclosure program lets a brand approach a state through an intermediary, anonymously, and negotiate a limited lookback period in exchange for prospective registration and payment. States typically waive penalties and limit lookback to three or four years. Walking in cold and registering today, with no VDA, exposes you to seven-year lookbacks plus full penalty stacks.

I have deployed this Protocol with more than a dozen DTC brands in the $1M to $10M band. The pattern is consistent: discovery shows nexus crossings in twice as many states as the founder believed, and the VDA route reduces total liability by 40% to 70% versus straight-up registration.

The framework also forces a clean separation between strategy and execution. The strategic question is "where are we exposed and what is the cheapest legal path to clean." The execution question is "who runs the monthly monitoring and which tax engine collects." Brands that conflate the two end up either overpaying for a tax engine that does not solve their exposure problem, or under-investing in monitoring while assuming the engine handles it.

Phase 1: The Nexus Audit (Days 1-30)

The first 30 days are diagnostic, not corrective. You are not registering anything yet. You are mapping the exposure.

Week 1: Pull your full historical Shopify revenue export, by state, by month, going back four full calendar years. Do this from Shopify Admin under Analytics, then Reports, then Sales by billing or shipping state. Most state nexus rules use destination, so use shipping state. Strip out marketplace orders if your store is mixed channel; those need a separate column. Save the file as nexus-audit-{brand}-{date}.csv. This is the operating document.

Week 2: Build your threshold map. Take the TaxJar nexus resource or an equivalent tracker and create a spreadsheet with one row per state, columns for revenue threshold, transaction threshold, lookback period (prior calendar year, current calendar year, or rolling 12 months), and effective date of the state's economic-nexus law. Forty-five states plus DC means 46 rows. Skip the five states with no general sales tax: Alaska, Delaware, Montana, New Hampshire, Oregon. Note that Alaska now permits municipal sales tax, so a sub-row may apply.

Week 3: Run the threshold check. For each state, against your DTC revenue history, find the first month and year where you crossed the revenue or transaction threshold under that state's lookback rule. Mark it. This is your nexus crossing date for that state. The output looks like a 46-row table where roughly 15 to 25 rows have a crossing date and 21 to 31 rows say "not yet crossed."

Week 4: Quantify the exposure. For each crossed state, sum your DTC revenue from the crossing date to today. Apply the state's average combined sales tax rate (state plus local average, found in the same trackers). The result is your gross uncollected tax liability, before penalties and interest. This number is the size of the problem. It is also the budget ceiling for Phase 2.

Phase 1 deliverables: a state map, a revenue history file, a list of crossed states with crossing dates, and a gross exposure number. Hand this packet to your tax advisor or specialist sales-tax provider before moving to Phase 2.

Phase 2: Registration and Voluntary Disclosure (Months 2-4)

The second phase is remediation. You are converting an undocumented liability into a registered, paid, and contained one. The shape of this work depends on whether you go state-by-state direct or through the MTC's multistate program.

The MTC route works best when you have crossed nexus in 5 or more states and want to compress timeline and negotiation. The Multistate Voluntary Disclosure Program lets you approach states anonymously through the MTC, propose a lookback period of three or four years, agree to register going forward, and settle the historical liability with reduced or waived penalties. Process timeline runs 60 to 120 days from initial filing to closed settlement.

Direct VDA, state by state, makes sense when the crossings are concentrated in two or three large states with strong direct programs. California, Texas, and Florida all run their own programs with terms broadly similar to the MTC's. The trade-off is more administrative work in exchange for tighter control over the lookback negotiation.

Month 2: File the VDA applications. Anonymously through the MTC for the multistate package, or directly with each state's department of revenue for the state-by-state route. Do not start collecting tax yet in unregistered states. Collecting before registration creates a separate violation in many jurisdictions because you are holding tax that was never authorised.

Month 3: Negotiate the lookback. State revenue departments will counter on lookback periods, typically pushing to four years where you proposed three. Hold the line on what your data supports. If you crossed nexus 22 months ago, a three-year lookback is the maximum honest position. Your lookback ends at your crossing date, not at an arbitrary number.

Month 4: Close the settlements and switch on collection. Once a VDA is signed, register, file the agreed historical returns, pay the negotiated tax (usually with waived or reduced penalties), and switch on collection in your tax engine for that state going forward. Shopify Tax or Avalara can flip the switch per state.

For the not-yet-crossed states, set monitoring alerts at 80% of each threshold so you can register proactively rather than retroactively. Proactive registration costs you a registration fee and one filing per period. Retroactive registration costs you back tax, interest, and a VDA.

A practical aside on cash. Phase 2 is the only part of the Protocol where you spend real money. Budget 1% to 3% of trailing-twelve-month US revenue for combined VDA negotiation, back-tax settlement, and registration costs. A $4M brand should expect a $40,000 to $120,000 outflow concentrated across months 2 to 4, which is why running Phase 1 first matters; the diagnostic gives you a defensible number to put in front of your board, not a guess. Brands that skip the diagnostic and start registering blind almost always overpay because the lookback positions are not negotiated against documented data.

Phase 3: The Monthly Monitoring Rhythm (Ongoing)

The Nexus Exposure Protocol does not end when registrations are clean. The states keep moving thresholds. Your revenue keeps moving across states. A clean compliance position in May becomes a nexus crossing in August.

Monthly cadence, run on or before the 5th of each month for the prior month:

Pull DTC revenue by state for the trailing 12 months and year to date. The monitoring view runs both windows because state thresholds split between lookback rules. Compare each state's running totals against the threshold map.

Flag any state above 80% of either threshold. This is your alert list. Add a state to the alert list before it crosses, not after.

For any state that crossed in the prior month, register, file the period return, and switch on collection. Crossing-month-to-collection-on should run inside 30 days. Anything longer accrues exposure.

Reconcile facilitator and DTC revenue. If marketplace mix shifts, your DTC nexus calculation shifts with it. A brand whose Amazon channel grew faster than its Shopify channel may suddenly look under-threshold even if total revenue grew. That can be a real reduction in DTC nexus or an artefact of channel mix. Read the underlying numbers, not just the totals.

This monthly rhythm needs an owner. In a brand under $5M, the controller or external accountant carries it as a 90-minute discipline each month. Above $5M, fold it into a weekly accounting close so the alert list is never older than a week. Tie the operating control to your broader accounting hygiene; the principles in financial controls apply directly here, because nexus monitoring without segregation of duties between revenue reporting and tax filing is a control gap.

The New North Star Metric: Days Since Threshold Crossed

Most operators chase a binary: are we compliant or not? That is the wrong frame. Compliance is a continuous state, and the metric that reveals the truth is "days since threshold crossed without registration" for any state on the map.

Zero is the goal. Anything above 30 days without registration in a crossed state is unacceptable risk because the penalty math compounds monthly. The Avalara nexus tracker and equivalent state pages publish penalty schedules in plain English; assume 10% to 25% annualised on uncollected tax for any unregistered period.

Track this metric on a single dashboard line per state. The colour coding writes itself: green for registered and current, amber for crossed but inside the 30-day registration window, red for crossed and past 30 days. Brands operating The Nexus Exposure Protocol should have zero red, almost no amber, and a long line of green.

The brands that publish a quarterly board report with this dashboard line stop being surprised by compliance letters. The brands that do not are the ones answering certified mail from a state they did not know they were operating in. Sales tax, properly run, is a quiet ledger. Run quietly is the goal.

The deeper shift is cultural. Sales tax stops being a finance problem the bookkeeper handles in the background and becomes a growth-readiness signal the operator owns. When you start a new wholesale partnership, when you turn on a new sales channel, when you cross $5M and start fielding inbound from acquirers, the first question every counter-party asks about your back office is some version of "are you clean on sales tax?" A green dashboard answers that question in seconds. A vague "we use Shopify Tax" stalls the conversation and shaves valuation. The Protocol gives you the artefact that closes the question.