Taxing the Cloud.

Rackspace, a cloud hosting company headquartered in San Antonio, has been racking up sales at a torrid pace. Net revenue for the second quarter of 2011 was $247 million, a 32% increase over the previous quarter, beating analyst expectations and propelling the company to $1 billion in annualized run rate revenue. The company reported 10,000 new customers in its October earnings call, bringing its total count to 152,000. Gartner has placed Rackspace in the upper-right “visionary leader” square of its trademarked Magic Quadrant for hosting and infrastructure-as-a-service (IaaS)…


But this success doesn’t prevent Lew Moorman, Rackspace’s president, cloud and chief strategy officer, who otherwise brims with enthusiasm for his company and for the future of cloud computing (“It’s an irreversible trend!”), from getting a tad cranky when the subject turns to his company’s tax liabilities in its home state. Not only does Rackspace pay sales tax on each server it purchases and locates in Texas, it also pays a Texas margin tax based on every Rackspace customer hosted on a Texas server, whether or not the customer has a physical presence in Texas.

The company officially states that it believes the margin tax to be punitive, and Moorman says that as long as it’s applied, “We’ll never build another database in Texas.”

Texas isn’t the only state that taxes cloud providers. New York, for example, has treated cloud-computing transactions as a sale of tangible property subject to New York sales tax since 2008. In general, revenue-starved states, facing a projected 2012 budget shortfall of $102.9 billion, are powerfully motivated to collect tax on cloud computing, a market that Forrester Research estimates to be $41 billion this year, on its way to $241 billion by 2020. So far, however, “only a handful of states currently have specific language providing guidance on the taxability” of cloud and  SaaS, says Joel Waterfield, a senior manager at Grant Thornton.

The Metaphysics of Nexus
Sales and use tax boils down to nexus: where a business has a physical presence that opens it up to tax liability within that jurisdiction. But when it comes to the cloud — where services are sold to customers who may access them anywhere from servers located who-knows-where by companies that may be headquartered anyplace — determining nexus, and the liabilities that go with it, is anything but straightforward. 

The state of New York ruled that nexus is determined by where an application is used, not where it’s hosted. The location of the software code, according to the 2009 opinion of the New York Commissioner of Taxation and Finance, “was deemed irrelevant . . . because the software could be used just as effectively by the customer even though the customer never received the code on a tangible medium or by download.” (Meaning, the customer accessed the software through a browser, as is the case with cloud services.) The fact that the cloud contract “provided no grant of license to use software” was “not found controlling.” In other words, the cloud provider should be collecting sales and use tax just as if it were mailing disks to the customer, and the customer should be paying whether or not it receives a perpetual license.

Waterfield notes that many states are moving toward an “economic nexus” standard whereby out-of-state businesses establish nexus “when making sales through an agreement with a person located in that state and the in-state person refers customers to the out-of-state business through a Website link.”

Keeping track of a cloud provider’s tax liability among multiple states can get complicated. “If you have three servers in three states, software could be running in any one at any time, so you’d have to consider nexus in all three states,” notes Marc Linden, CFO of California-based Intacct, an accounting and financial management SaaS provider that, according to Linden, leases 14 third-party SaaS applications itself. For example, “We have disaster recovery [a back-up data center] in Pennsylvania, and that establishes nexus in that state. A third party runs it; we never have people going there and no one touches it, but we have a tax liability in that state. For customers who buy our services, even though they’re buying from us in California, they have to pay sales tax in Pennsylvania because we have nexus there.”

But how do purchasers find out that the services they think they’re buying in California are also taxable in Pennsylvania?

“They find out when they get the sales tax bill,” Linden says. “Do they like it? No. Does anyone ever argue? No. Do they have a choice? No.” Indeed, Waterfield points out that regardless of whether a cloud provider collects sales tax, “it is still the responsibility of the purchaser to determine whether the tax is due, or whether the tax was administered properly by the seller.”

This isn’t easy, so, according to Waterfield, under the Financial Accounting Standards Board’s Accounting Standards Codification (ASC 450) businesses are required “to accrue reserves for future losses that are likely to occur relating to sales or use taxes.” But, Waterfield stresses, they only have to do that if the amount of loss “can be reasonably estimated,” which, again, is not easy in today’s environment.

Another wrinkle, says John Barrie, a partner at law firm Bryan Cave whose practice focuses on federal and state tax controversies, is that when a company contracts for cloud services, it’s often buying a bundle that includes access to applications and platforms, data storage, support — essentially all the activities that used to be provided by a company’s internal IT department. This exposes the purchaser to the risk that a state’s taxing authority will calibrate the sales tax to the whole cost of the contract if any one of the services is deemed taxable. One part of the service bundle, say, storage, may not be taxable, but access to applications may be. But the tax will be applied to the whole contract, not just the access portion. “From a providers’ perspective,” says Barrie, “I’m giving you a, b, c, for one flat price, and I’m not collecting sales tax because it’s all over the Internet. The buyer is likely not paying tax to the state because he’s not sure what to pay until there’s an audit that comes across a line item that says you’ve paid x; you owe y.  It’s really a risk management issue.”

“As state budgets remain tight,” Waterfield says, “we anticipate that more states will attempt to include these new cloud service offerings within their tax base.”

Risk Mitigation for CFOs
If nexus arising from cloud services goes unrecognized, the consequences can be harsh.

“Do I worry about sales tax compliance at a CFO level?” Intacct finance chief Linden asks rhetorically. “Absolutely. It’s a significant enough compliance issue and potentially carries enough dollar liability that it’s high on my agenda.

“Where CFOs go most wrong [managing SaaS] is in not thinking about where they should be collecting sales tax early enough before facing a merger or acquisition or an IPO,” says Linden. “Because by that time you may have racked up millions in tax liabilities,” which would certainly affect the deal adversely.

Jim McGeever, COO of cloud ERP provider NetSuite, has said that when his company plans an acquisition, it may have to spend up to $1.5 million simply to clean up sales-tax disputes. “Just the third-party consulting costs and advisers, costs of filing all the back returns and negotiating with each agency, it’s a very substantial process . . . expensive in terms of time, expensive in terms of money.”

How can cloud providers and users protect themselves against sales-tax snafus? “There are various ways,” says Linden. “Do your own due diligence based on state regulations, especially where you know you’ve established nexus. Hire a third-party expert where it’s ambiguous or if you have a concern.” Linden recalls one Intaact customer who refused to pay sales tax, claiming the product wasn’t taxable in its state. “We jointly asked for a tax ruling from the tax authority in that state,” says Linden. “The customer was right.”

Waterfield advises companies to review the issue of nexus at a minimum of once every two years. “Companies should keep their information fresh in their key states, and a quick review should occur prior to any large sale or purchase of cloud services to ensure if further [state] guidance has been released,” he says.

Waterfield also suggests that purchasers of cloud services ask their providers if they plan to assess sales tax and explain the methodology they use to calculate it. He also believes that purchasers of cloud services must know in which states the provider plans to assess tax, as “the purchasing company’s nexus footprint may differ from the sellers’.” This opens the possibility that the purchaser may be receiving services in a state where the service is subject to tax but the seller doesn’t have responsibility to collect it. In that case, says Waterfield, the purchaser will have to figure out how to pay the tax itself, either by accruing for the tax liability or simply by writing a check.

In any case, one can imagine CFOs spending a lot more quality time with their tax experts in the coming months and years.