The month a voluntary disclosure did not cap the tax I had collected, at 79K MRR

That is what our accountant said on a Tuesday in March, about nine minutes into a call I had booked expecting good news. We were at 79K MRR, I had just finished what I thought was the responsible thing, and she was explaining that the responsible thing was the reason the number in front of us had a four in front of it instead of a seven.

Quick answer (2026)

A voluntary disclosure agreement usually caps how far back a state will reach, commonly around three years. That cap is the main reason people file one. It does not reliably apply to sales tax you actually collected from customers and did not remit. Georgia's published program says the look-back for sales and use tax is normally thirty-six months but will be extended as far back as necessary to recover tax a business collected and kept. The reason sits one layer down: collected tax is not your money. Washington's code deems it held in trust, makes conversion a crime, and imposes personal liability without regard to fault. This diary is a composite drawn from several operators' experiences, with figures reconstructed to be internally consistent rather than taken from one company's books.

The letter that started it

The letter was not dramatic. It was a nexus questionnaire from a state we had customers in, asking us to describe our activities and confirm whether we were registered. We were not registered there. We had never filed a return there.

What I did next felt like the textbook move. I had read enough to know that a voluntary disclosure agreement is the standard way to come in from the cold: you approach the state before it approaches you, you get penalties waived, and critically you get a look-back period instead of an open-ended reach into your whole history.

So I pulled our numbers to scope it. And that is when I found the thing that made the call go badly, which was not in the letter at all. It was in our own checkout configuration.

Modern tax calculation and tax registration are two separate jobs, and only one of them is automatic. The engine that decides whether to add tax to a cart can be switched on broadly in an afternoon. Registering in a state is a form, a filing obligation, and a return you then owe every period forever, state by state. We had done the first thing enthusiastically and the second thing four times.

What I thought a voluntary disclosure agreement bought me

My mental model was simple and it was half right.

I thought a VDA bought two things: forgiveness of penalties, and a wall. The wall was the important part. Somewhere around three years back, the state stops looking. Everything older than the wall is gone. That is what makes the arithmetic survivable for a company that has been quietly accruing an obligation it did not know about.

Georgia publishes this plainly in its voluntary disclosure program description, which says penalties will generally be waived for all periods included in the VDA agreement, and describes the look-back period as generally three years, longer or shorter depending on circumstances.

I had read that. I had budgeted against it. What I had not done was read the next sentence.

The sentence that moved the line

Here is the sentence, from Georgia's own voluntary disclosure program page.

Georgia Department of Revenue, verbatim: "the look-back period is usually thirty-six months but will be extended as far back as necessary to recover taxes that a taxpayer collected yet did not remit"

Read that twice, because the first time I read it I skimmed straight past the operative word, which is "collected".

The wall is real. It is just not built around everyone. It is built around the business that never charged the tax in the first place. For the business that did charge it, the wall is not shortened or negotiated. It is removed, and the phrase is "as far back as necessary". Some jurisdictions put that split straight into the paperwork: Denver publishes a voluntary disclosure form specifically for sales tax not collected.

And here is the part that took me a while to accept. We were the second business. About four years earlier, trying to be careful, we had switched the tax line on at checkout across a broad set of states. Registration is a separate, manual, state-by-state job, and we had only ever finished it in a handful. So for years we had been charging customers sales tax in states where we had never registered and never filed.

I had thought of that as being ahead. It was the opposite.

Why the money was never mine

The reason the cap disappears is not punitive. It follows from what the money legally is, and that is where I had the deepest misunderstanding.

Washington's sales tax collection statute puts it in operative text rather than in a brochure.

RCW 82.08.050(2), verbatim: "deemed to be held in trust by the seller until paid to the department"

That is not a metaphor about good stewardship. It is a custody rule. The tax a customer hands you at checkout never becomes revenue, never becomes working capital, and never becomes yours. You are holding it.

The same subsection goes further than I expected. A seller who appropriates or converts the collected tax to its own use, to the point that the money is not available on the due date, "is guilty of a gross misdemeanor" under that section.

I want to be careful here. The statute's text is one thing and how a revenue department actually treats an ordinary cash-flow failure is a different thing, and I have no basis to tell you how any particular case gets handled. What I can tell you is what the words say, and the words describe exactly what we had done. We had spent it. Not deliberately, not as a scheme. It arrived in the same bank account as everything else and it funded payroll like everything else.

That is the quiet mechanism in all of this. Nobody decides to convert trust money. The tax lands in the operating account because that is where the payment processor deposits, it is indistinguishable from revenue on a bank statement, and it gets spent in the ordinary course of running out of runway in month seven. By the time anybody asks where it is, it is in salaries paid two years ago.

The subsection next to it

The two adjacent subsections do different work, and reading only one of them is how I got this wrong for four years.

Subsection (2) is the criminal one, and it has a state of mind built in: it is about appropriating or converting. Subsection (3) has no such thing.

RCW 82.08.050(3), verbatim: "personally liable to the state for the amount of the tax"

And it attaches that liability "whether such failure is the result of the seller's own acts or the result of acts or conditions beyond the seller's control".

I went looking for the usual escape hatch. Most compliance regimes I had met by then had a tier somewhere: willful versus negligent, a good faith defence, a safe harbour for the operator who tried. I searched that section for one. There is not one. Being overwhelmed, badly advised, or genuinely unlucky changes nothing about the liability. It is strict, and it is personal, which means it does not stay inside the company.

The clock I thought was running

My last hope was the one everybody reaches for, which is that old periods eventually die of old age.

Washington does have a four year limit on assessments. It also has a short list of exceptions, and the first one is the one that mattered to us.

RCW 82.32.050(4), verbatim: "against a taxpayer who has not registered as required by this chapter"

The four year bar does not run in favour of an unregistered taxpayer. So the protection I had been quietly counting on had never started. There is no clock on a period for which you never registered and never filed, which means the oldest exposure is not the safest, it is simply the oldest.

Put the three together and the shape is clear. The cap does not cover collected tax, the money was never ours to begin with, and the limitation period was never running. Each of those alone is survivable. Stacked, they are why the call went the way it did.

The arithmetic

Our affected states carried roughly 30,000 dollars a month of taxable revenue, at a blended combined rate of about 7.2 percent. That is about 2,160 dollars a month of tax collected from customers in states where we were not registered. We had been doing it for 51 months.

If the thirty-six month cap had applied, the exposure would have been 36 times 2,160, or 77,760 dollars.

Because the tax had been collected, the period was all 51 months: 110,160 dollars.

The difference is 32,400 dollars, which is 15 months of collected tax that a cap would have absorbed and did not.

That total was not one frightening state. It was nine unremarkable ones, none individually large enough to have triggered a review of the registration list, which is precisely why it ran for four years without anybody noticing. The largest single state in the set was under 500 dollars a month. The problem was never the size of any one number. It was that the whole set sat in a category I did not know existed.

The comparison I keep coming back to is not that number though. It is the counterfactual. A company identical to ours that had never switched the tax line on would have owed the capped figure out of its own margin, painful and bounded. We owed the larger figure, we owed it as a custodian rather than a debtor, and we owed it personally. The act of collecting is what removed the cap.

What I got wrong

I thought the look-back cap was the whole benefit of a VDA. It is not, and this cuts in the reassuring direction. Georgia waives penalties for all periods included in the agreement, so when the look-back extends, the extended periods are included and the penalty waiver travels with them. Interest is still imposed on all amounts due. Filing was still clearly better than not filing. I had just mispriced what filing would buy.

I expected a fault tier and there is not one. I assumed that somewhere in the liability provision there would be a distinction between a business that schemed and a business that lost track. Subsection (3) says the opposite in as many words. That is the single assumption I would most want to go back and delete.

I assumed the trust language was rhetoric. I had seen "held in trust" in tax material before and filed it as the sort of thing legislatures say. It is operative text, it sits immediately beside a criminal subsection, and it is the reason the cap behaves differently for the two populations.

What actually happened

Limits

These are two states and two bodies of law. The carve-out language quoted here is Georgia's published program description; the trust, liability and limitation provisions are Washington's code. Programs and statutes vary considerably by state, and nothing here establishes that Washington's VDA program applies Georgia's carve-out or that Georgia's statute reads like Washington's. I have not quoted any state's assessment of our specific facts, because this account is a composite. Treat it as a map of where to look in your own states, not as advice about them.

The one thing I would tell you

Before you scope a voluntary disclosure, split your exposure into two columns: tax you should have collected and did not, and tax you did collect and did not send on. They are not the same liability and they do not get the same cap, and almost every article you will read about VDAs is quietly written about the first column.

If the second column has anything in it at all, that is the number to deal with first. It was never yours, the clock protecting it probably never started, and it is the one that follows you out of the company.