Delaware's $554M Audit Letter: Unclaimed Property's Mid-Market Crackdown
Every year, American companies lose track of money they owe people: uncashed payroll checks, vendor payments never deposited, customer credits never claimed. After a state-specific dormancy period, the company is supposed to find the owner, and failing that, hand the money to the state. Most mid-market companies do neither. Delaware has built a $554-million-a-year revenue machine on that failure, and it mails invitations to come clean roughly twice a year.
The Problem
Unclaimed property, legally called escheatment, is one of the oldest and least understood compliance obligations in American business. The mechanics are simple. A company holds money that belongs to someone else: a final paycheck for an employee who moved, a rebate check a customer never cashed, a vendor payment that sat unclaimed, a utility deposit, an insurance proceed, a dividend. Every state sets a dormancy period, commonly one to five years depending on the property type. When the clock runs out, the holder must make a documented effort to find the owner, called due diligence, and if that fails, remit the property to the state of the owner's last known address. The state then holds it as custodian until the owner claims it.
Few compliance obligations touch this much money. State programs returned $4.49 billion to rightful owners in fiscal 2024, per National Association of Unclaimed Property Administrators data analyzed by Doeren Mayhew. Industry estimates put the total sitting in state custody near $70 billion, roughly $200 for every person in the country, growing every year because more property goes dormant than gets reunited with owners.
"The only thing uniform about unclaimed property compliance is that there's nothing uniform."
That line, from an industry executive interviewed by PYMNTS, is the entire business case in one sentence. More than fifty jurisdictions each set their own dormancy periods, due diligence thresholds, reporting deadlines, exemptions, and filing formats. That fragmentation is the moat for whoever builds the system of record.
Delaware operates the enforcement engine that makes this urgent. The state collected $554 million in abandoned property in fiscal 2024, netting about $410.5 million after owner refunds, making it one of Delaware's largest revenue sources after personal income and franchise taxes and worth roughly 7 to 8 percent of the state budget. Delaware's position as the incorporation capital of America, home to more than two million legal entities and two-thirds of the Fortune 500, is what makes this possible. Under the federal common-law priority rules from Texas v. New Jersey, when the owner's address is unknown or incomplete, the property goes to the state of the holder's incorporation. For companies that never tracked owner addresses carefully, which is most of them, that means Delaware.
Delaware enforces this on a schedule. The state sends voluntary disclosure agreement (VDA) invitations roughly twice a year to companies it has identified as likely noncompliant, with recent waves going out in the spring and late summer. Invitees get 60 days to enroll in the VDA program by filing Form VDA-1 with the Secretary of State. Companies that ignore the letter are referred to the State Escheator for a full examination. Delaware also runs compliance reviews: a company gets 30 days to acknowledge a verified-report request, with the state expecting completion within 180 days, and refusal triggers an audit.
The 60-day enrollment clock starts at mailing, not at your awareness. Invitations go by postal mail and get lost in the shuffle.
Audits supply the stick that makes the VDA work. Delaware examinations carry a 15-year lookback period and routinely last three to seven years. Since 2021 reforms, third-party contract auditors work on an hourly basis rather than contingent fees (customer-account, securities, and life-insurance examinations excepted), and Delaware records cannot be shared with another state's examination without the holder's written consent. Interest on unreported amounts in an audit starts at a statutory minimum of 20 percent of the past-due liability for examinations noticed after August 2021, while VDA participants get interest and penalties waived. Those penalty schedules, summarized below, show why the VDA's waiver matters so much.
| Jurisdiction | Failure-to-file penalty | Interest on late property | Notes |
|---|---|---|---|
| Delaware | 5% of property per month (50% aggregate cap) or $100/day (max $5,000); the lesser applies | Minimum 20% of past-due liability per incident for audits noticed after Aug 1, 2021 (one-time floor, not annualized) | Interest and penalties waived under VDA; 15-year audit lookback |
| Nevada | $200 per day, up to $5,000 maximum | 18% per annum | Late filing also raises audit red flags |
| Texas | At least 5% of the late-reported property, scaling with lateness | 10% per annum | Penalty floor applies even to small amounts |
Sources: Delaware figures per 12 Del.C. § 1183 (failure-to-file penalties under § 1183(b); failure-to-pay penalties of 0.5% per month up to 25% under § 1183(c)) and RSM's analysis of the 2021 reforms; Nevada and Texas figures per the Unclaimed Property Professionals Organization.
Note the detail that matters most for the target customer. Delaware's failure-to-file penalty is the lesser of the percentage formula or $100 per day capped at $5,000, so for a mid-market company the $5,000 cap is the binding number on the filing penalty. But the failure-to-pay penalty is separate and scales: 0.5 percent per month up to 25 percent of the underlying property, with no flat cap. On a $200,000 liability that second penalty alone can reach $50,000, which is why the all-in audit math below looks the way it does.
Here is the market gap. At the top, large enterprises hire specialist firms: Ryan, PwC, and MarketSphere (now part of Ryan) sell consulting-led compliance, audit defense, and VDA management, with engagements that run into six figures. At the bottom, Sovos sells ReportMyUP, a self-serve filing tool starting under $20 a month that generates NAUPA-format reports and e-files to more than 30 states. In the middle sit roughly 200,000 American companies with $10 million to $1 billion in revenue that run multi-state payroll, vendor, and customer disbursements, are Delaware-incorporated in many cases, employ no in-house unclaimed property expertise, and have no product built for them. They manage escheatment in spreadsheets, which is to say they do not manage it. Delaware's targeting criteria overlap almost exactly with the segment least equipped to respond: BDO's analysis of the invitation program notes that middle-market companies with at least $100 million in annual revenue that are incorporated in Delaware sit among the highest-risk audit targets.
Market Size
TAM calculation: Start with the holder universe. NAICS Association revenue-band counts (December 2024) put roughly 176,000 US firms in the $10 million to $100 million band, 23,700 in the $100 million to $500 million band, and 4,100 in the $500 million to $1 billion band: about 204,000 mid-market firms, essentially all of which run payroll and payables and therefore generate potentially escheatable property. (Census Bureau business-size data corroborates the order of magnitude, counting roughly 104,000 employer firms with 100 or more employees.) All-in annual compliance spend per holder has three components, with illustrative ranges drawn from observed market pricing (Sovos's self-serve tier near $20 a month at the low end; specialist advisory engagements at $50,000-plus, amortized, at the high end):
| Cost component | Annual range | Midpoint |
|---|---|---|
| Reporting software | $2,000 – $8,000 | $5,000 |
| Due diligence owner mailings | $1,000 – $5,000 | $3,000 |
| Amortized advisory and VDA-readiness work | $2,000 – $10,000 | $6,000 |
| Total per holder | $5,000 – $23,000 | $14,000 |
Those midpoints sum to $14,000 per holder per year, which across 204,000 firms yields a $2.9 billion total addressable market in annual compliance spend. Note that this TAM counts all-in spend, including advisory dollars the platform displaces but does not itself capture.
SAM: Narrow to the firms most exposed and least served: Delaware-incorporated or multi-state operators in the $10 million to $1 billion band with no dedicated unclaimed property function. Industry targeting descriptions suggest 10 to 20 percent of the mid-market universe fits this profile; at the midpoint, about 30,000 firms. SAM prices the software subscription the startup actually sells (platform plus exposure analytics plus paid modules), averaging $9,000 a year, which is why the per-firm figure differs from TAM's all-in spend: $270 million in serviceable annual revenue. This excludes the enterprise consulting market (captured by Ryan, PwC, and MarketSphere) and the micro-business filing market (captured by Sovos's self-serve tier).
Beachhead: The VDA-invitation target profile is unusually precise: privately held, Delaware-incorporated companies with little or no prior reporting history. An estimated 5,000 to 8,000 companies fit this profile at any given time; taking a conservative 6,000 of that range at a $9,000 annual contract for the platform plus a VDA-readiness module, the beachhead is $54 million. Adjacent beachhead: the few hundred crypto custodians and exchanges facing brand-new digital-asset escheatment duties. Industry counts of US custodial platforms run in the low hundreds; at a $25,000 premium ACV, even 200 adopters is a $5 million wedge that funds the roadmap while buying the only purpose-built workflow in the category.
The Product
A compliance intelligence platform that sits between a company's disbursement systems (payroll, AP, AR, customer refunds) and the fifty-plus state reporting regimes. As the acquisition wedge, the VDA-readiness module converts a panicked 60-day scramble after a Delaware invitation letter into a guided workflow, and every company that survives its VDA inside the platform becomes a long-term annual-filing subscriber. Around that wedge, the platform builds the full system of record.
- Exposure radar (the core view): Ingests disbursement data from NetSuite, QuickBooks, Sage, ADP, and major payroll providers. Flags every check, credit, and account balance approaching dormancy under each relevant state's rules, and quantifies the company's total audit exposure as property plus state-by-state interest and penalty schedules. It answers the question no controller can currently answer: "If Delaware audited us tomorrow, what is the number?"
- VDA readiness module (the wedge): For companies holding a Delaware invitation letter, the platform assembles the self-review workpapers the VDA program requires: lookback-period scoping, sampling methodology documentation, entity inclusion lists, and policies-and-procedures templates. Enrollment windows are short and the documentation burden is the reason companies overpay for advisory; the module productizes both.
- Reporting and e-filing: Produces NAUPA-format reports for all 50-plus jurisdictions and files electronically wherever states accept it, extending one-click e-filing to every state and to the report types generic tools skip (negative reports, verified reports for Delaware compliance reviews).
- Due diligence automation: Generates and tracks the owner outreach each state requires before property can be escheated: first-class and certified mailings, statutory notice language per jurisdiction, response handling by mail, web, and IVR, and documented proof of contact attempts. Missed or defective due diligence is itself a penalty trigger in many states; the system makes the paper trail automatic. Better outreach also means more property reunited with owners before escheatment, which is the point of the law.
- Audit defense file: Maintains a continuously updated documentation package mirroring what examiners request: disbursement records, dormancy analyses, due diligence proofs, filing history, and methodology memos. When the audit notice arrives, the company hands over a file instead of starting a three-year fire drill.
- Digital-asset escheatment module: A purpose-built workflow for crypto as unclaimed property. Tracks custodial account dormancy under each state's digital-asset rules, manages the 6-to-12-month owner notification windows, and executes in-kind delivery to state-appointed custodians, including private-key handoff procedures and chain-of-custody documentation. California's SB 822 requires holders to deliver the exact digital asset, unliquidated, within 30 days of the reporting deadline, and bars both holder liquidation and immediate state sale; the Controller may then convert holdings to fiat between 18 and 20 months after reporting. That 18-month window is a reclaim period the module is built to exploit for the owner.
Unit Economics
| Metric | Value |
|---|---|
| Average contract value | $9,000/year ($750/month) |
| Customer acquisition cost | $6,500 |
| Expected LTV (48-month avg retention) | $36,000 |
| LTV:CAC ratio | 5.5:1 |
| Gross margin | 80% |
| Startup cost (18-month runway) | $3.2M |
| Break-even | ~27 months (~400 customers) |
Methodology note: We set CAC at $6,500 because the buyer is unusually reachable: outbound targets controllers and VPs of tax at mid-market firms, timed to the public rhythm of Delaware's invitation waves, reinforced by partnerships with regional CPA firms that field panicked client calls and by content marketing around each enforcement event. The mid-market buyer community concentrates in a small channel set: state CPA societies, the Unclaimed Property Professionals Organization, and the regional accounting firms that already sell VDA advisory. We estimate 48-month retention because a system-of-record product holding the company's filing history and audit-defense documentation is painful to rip out; once the exposure radar and defense file live in the platform, switching means rebuilding both. The $9,000 ACV blends a $6,000 base platform tier with paid modules (VDA readiness, digital-asset escheatment) that roughly a third of customers adopt. We model 80 percent gross margin, standard for vertical SaaS with automated mail fulfillment passed through at cost.
Go-to-Market
Phase 1 (months 1-8): Build the exposure radar and NAUPA reporting engine first; the digital-asset module follows. Integrate with NetSuite and QuickBooks for disbursement ingestion, since those two systems cover the large majority of the mid-market target. Recruit 10 to 15 design partners from the precise VDA-invitation profile: privately held, Delaware-incorporated, $50 million to $500 million in revenue, no prior unclaimed property filings. Offer the platform free during design partnership in exchange for data access and case-study rights. In parallel, sign channel agreements with 3 to 5 regional CPA firms; they already sell VDA advisory at $50,000-plus per engagement and need a software layer to productize it.
Phase 2 (months 9-16): Launch paid tiers timed to Delaware's invitation cycle. This is the rare B2B product where the government runs the demand-generation campaign: each mailing wave creates a fresh cohort of companies with a 60-day deadline and no internal expertise. Market directly to each wave with deadline-driven messaging that converts enforcement pressure into trials. Publish the first "State of Escheatment Enforcement" index, ranking states by audit aggressiveness, penalty collections, and property-type expansion, and pitch it to CFO and tax media. Every data point in the index is a backlink and a demo request.
Phase 3 (months 17-30): Launch the digital-asset escheatment module against SB 822's in-kind delivery requirements, now in effect, targeting exchanges, custodial wallet providers, and fintechs holding customer crypto balances. Open a vetted VDA attorney marketplace inside the platform, taking a referral fee on engagements the software surfaces. Expand the audit-defense file into a standalone product for companies already under examination, priced as a project fee plus conversion to annual subscription.
Competitors
| Company | What It Does | Mid-Market Self-Serve? | Exposure Analytics? | Crypto In-Kind Workflow? |
|---|---|---|---|---|
| Sovos | Compliance Cloud plus ReportMyUP: NAUPA-format reporting, due diligence letters, e-filing to 30+ states; self-serve tier from ~$20/month | Partial: the self-serve tier is a filing tool, not an exposure radar; the full Compliance Cloud is enterprise-priced | No: dormancy analysis without quantified audit-exposure modeling | No |
| MarketSphere (Ryan) | Consulting-led compliance, VDA management, and audit defense; proprietary MOD tools for dormancy analysis and outreach | No: MOD is operated by MarketSphere consultants, not sold as self-serve software | Yes, but delivered as consulting, not product | No |
| Ryan, LLC | Tax advisory giant; unclaimed property practice with Tracker PRO software and asset recovery services | No: enterprise advisory engagements | Yes, inside advisory engagements | No |
| PwC | Enterprise unclaimed property compliance, VDA strategy, and audit support with CARS recovery technology | No: Big Four procurement cycles only | Yes, inside advisory engagements | No |
| UPCR / regional consultants | UPCR (Unclaimed Property Consulting & Reporting) and similar regional consulting shops | Partial: affordable but human-delivered, not software | Varies by firm | No |
| This startup | Exposure radar plus VDA readiness, due diligence automation, e-filing, and digital-asset escheatment for the mid-market | Yes: self-serve SaaS priced for $10M-$1B firms | Yes: quantified audit-exposure dashboard as the core view | Yes: in-kind delivery and private-key handoff workflows |
The structural gap is visible in how the incumbents are organized. That market is fragmented, with the top five players holding less than half the market combined, and every scaled player sells either enterprise software suites (Sovos Compliance Cloud), consultant-operated tools (MarketSphere's MOD, Ryan's Tracker PRO), or human advisory by the hour. Nobody sells the mid-market controller a product that answers the one question keeping them up at night after the Delaware letter arrives: what is our number, and what do we do in the next 60 days. The crypto dimension sharpens the gap further. Every incumbent's data model assumes property is dollars in a bank account. California now requires holders to deliver the exact digital asset, unliquidated, with private keys, to a state-appointed custodian within 30 days. That is a custody workflow, not a reporting workflow, and none of the existing tools were built for it.
Why Now
Four developments make 2026 the year to build this. First, Delaware's enforcement runs on a predictable cadence. The state sends VDA invitations roughly twice a year, runs compliance reviews with 30-day acknowledgment and 180-day completion clocks under its 2022 statutory amendments, and each mailing wave explicitly targets middle-market Delaware-incorporated companies. A startup can calendar its demand generation around the Secretary of State's mailing schedule.
Second, cryptocurrency has become a new property type with compliance workflows that legacy software cannot handle. California's SB 822, signed in October 2025, classifies digital financial assets as intangible property subject to escheatment after three years of custodial-account inactivity, requires in-kind delivery to state-appointed licensed custodians within 30 days of the reporting deadline, and bars both holder liquidation and immediate state sale. This nuance matters: the Controller may convert escheated digital assets to fiat between 18 and 20 months after reporting, so the owner's upside is delayed rather than destroyed on day one, and anyone who reclaims within the window gets the asset back in kind. Virginia's HB 798, signed in April 2026 and effective that July, sets a five-year dormancy period with the same in-kind requirement. Arizona and Maine have passed parallel laws. More than two dozen states have enacted statutes applying unclaimed property laws to cryptocurrency, per an Eversheds Sutherland analysis, and in states without crypto-specific statutes many treasuries still default to liquidating the holdings and remitting dollars. Every exchange, custodial wallet, and fintech holding customer balances needs a dormancy-tracking and in-kind delivery workflow that did not need to exist three years ago.
Third, the state budget math makes enforcement countercyclical and durable. Delaware's $554 million in abandoned-property collections is about 7 percent of its budget, and the state has every incentive to expand the base: shorter dormancy periods, new property types, and estimation methods that holder advocates argue inflate assessments when records are incomplete. Unclaimed property enforcement grows when state budgets tighten, which is exactly when mid-market companies cut the compliance staff that would have managed it.
Fourth, the advisory market has priced out the segment under enforcement pressure. A VDA engagement with a specialist firm runs $50,000 to $150,000-plus; a Big Four relationship costs more. Most of the 200,000 mid-market firms Delaware is now targeting cannot buy that, and Sovos's self-serve tier gives them a filing tool without telling them their exposure. The price umbrella is wide open for a $6,000-to-$12,000 annual platform that does both.
Original Contribution: The Delaware Audit Multiplier, Worked Example
An illustrative worked example: Take a representative mid-market company, Delaware-incorporated, $300 million in revenue, that has never filed unclaimed property reports and has accumulated $200,000 in unreported property over ten years of uncashed checks and dormant credits. Model two paths.
| Component | Path A: Ignore the letter (audit) | Path B: Enroll in VDA |
|---|---|---|
| Underlying property remitted | $200,000 | $200,000 |
| Interest | $40,000 (20% statutory minimum per incident for post-2021 audit notices) | $0 (waived under VDA) |
| Penalties | $25,000 ($5,000 filing penalty, where the $100/day cap binds under § 1183(b); plus $20,000 payment penalty at an assumed 10% effective rate, inside the 0.5%-per-month-up-to-25% range in § 1183(c)) | $0 (waived under VDA) |
| Professional fees | $150,000 (assumed; 4-year examination) | $60,000 (assumed; 2-year guided self-review) |
| All-in cost | $415,000 | $260,000 |
| Multiplier on underlying property | 2.1x | 1.3x |
That $155,000 difference, the audit premium for ignoring the letter, is about 78 percent of the underlying property itself. Against a $9,000 annual subscription, a platform that moves a company from Path A to Path B returns roughly 17-to-1 on compliance spend. And because the VDA path includes a full dormancy review with documented owner outreach, more of the underlying property reaches rightful owners before escheatment, which is the outcome the law was written to produce.
Limitations
The audit multiplier is an illustrative model, not a prediction. Interest here uses the statutory 20-percent-per-incident minimum for post-2021 Delaware audit notices, but actual assessments run higher in many cases and the minimum does not bind every fact pattern. Penalty figures blend a binding statutory cap (the $5,000 filing cap) with an assumed effective payment-penalty rate; real outcomes depend on cooperation, examiner discretion, and the company's facts. Professional fees vary enormously with company complexity; a clean single-entity company costs far less to defend than a multi-entity group with incomplete records, and both fee assumptions could be half or double in practice.
It also assumes the worst jurisdictional facts: Delaware incorporation, no filing history, and poor owner-address records, which routes the maximum property to Delaware under the Texas v. New Jersey priority rules. A company with complete owner addresses remits most property to the owners' states, many of which enforce less aggressively, and the multiplier shrinks accordingly. That $2.9 billion TAM assumes every mid-market firm is a holder with average compliance spend; in reality, a meaningful share of firms have negligible dormant property, and some already retain specialist advisors. Directional by design, the beachhead estimate of 6,000 VDA-profile companies derives from Delaware's targeting description rather than a published invitation count. One distributional caveat the model does not capture: dormancy fees and compliance costs ultimately fall hardest on small-balance owners, the low-wage workers and customers whose forgotten $40 checks erode to nothing while the system debates jurisdiction. Finally, the $9,000 ACV that looks trivial against a $300 million revenue base is a meaningful annual cost for a $10 million company; the product's pricing must tier down honestly for the smallest operators rather than taxing the firms least able to pay.
Strongest Counterargument
Start with the most serious case against this startup: it monetizes fear of a specific enforcement regime, and that regime has structural vulnerabilities. Delaware's unclaimed property program has faced repeated legal challenges over the past decade. Critics call its seizures aggressive, particularly when the state claims property with thin connection to Delaware beyond the holder's incorporation. The state was forced to pay Pennsylvania and 30 other states over $100 million over its claim to unused MoneyGram teller checks. A current federal lawsuit argues Delaware had no jurisdiction over a foreign citizen's shares and failed to give adequate notice before deeming them abandoned. If courts meaningfully constrain Delaware's reach, or if Congress ever standardizes priority rules, the enforcement premium that powers the VDA-readiness wedge deflates.
A retention problem is built into the product's best feature. The VDA-readiness module is a superb acquisition wedge, but a company that completes its VDA and implements clean annual filing has solved its emergency. Year-three renewal depends on the platform having become the system of record for annual reporting and the audit-defense file, not on continued fear. Products that sell the crisis often churn when the crisis passes; the roadmap must earn the renewal with ongoing value, especially the exposure radar's year-over-year trend data and the digital-asset module's recurring dormancy monitoring.
Standardization is a slower but real threat. NAUPA's uniform reporting formats already reduce filing friction, and state adoption of shared platforms chips away at the "nothing uniform" fragmentation the product monetizes. And the incumbents are not blind: Sovos could extend its self-serve tier upmarket with exposure analytics, and Ryan could productize its consultant-operated tools as self-serve software. This startup's window is the period before either incumbent decides the mid-market is worth building for, which argues for speed and for the crypto module as a differentiator neither incumbent is positioned to copy quickly.
The Bottom Line
Unclaimed property is a $2.9 billion mid-market compliance market hiding inside a system most controllers have never heard of. Delaware's twice-yearly VDA invitation mailings, its 15-year-lookback audits, and its interest and penalty schedules create a quantified, scheduled, and growing enforcement threat aimed directly at the 200,000 companies least equipped to handle it. Crypto escheatment adds a brand-new property type with custody workflows no existing tool supports. Winning here does not mean building another filing tool. It means building the exposure radar that tells a controller their number, the guided workflow that converts a 60-day VDA scramble into a subscription, and the audit-defense file that makes the next examination a handoff instead of a fire drill. That worked example puts the return on choosing the VDA path at roughly 17-to-1 on the subscription, and every owner found by the due-diligence engine is money reunited instead of warehoused. That is the kind of return that sells itself to a CFO.
What You Can Do
If you are a controller or VP of tax at a Delaware-incorporated mid-market company
Check whether your company has ever filed unclaimed property reports in any state. If the answer is no, or "I think our old AP manager handled it," assume you sit in the VDA-invitation target population and start a dormancy analysis now, before the letter arrives. The enrollment clock starts at mailing, not at your awareness.
If you run a regional CPA firm
Your clients are receiving these letters, and the advisory engagement is high-margin recurring work once the annual filing relationship is established. A software layer that productizes the dormancy analysis turns a bespoke project into a repeatable service line.
If you operate a crypto exchange or custodial wallet
Map your dormant-account population against California's three-year clock and Virginia's five-year clock today. The in-kind delivery and private-key handoff procedures cannot be improvised in the 30 days after the reporting deadline, and in states without crypto-specific statutes many treasuries still default to liquidating your users' holdings.
Related
📰 MSB BSA/AML Compliance SaaS: another RegTech vertical where fragmented state and federal obligations crush mid-market operators that enterprise vendors ignore
📰 Commercial Property Tax Appeal Orchestration SaaS: adjacent compliance arbitrage where systematic process beats the spreadsheet-driven status quo
📰 Surplus Lines Filing Compliance SaaS: multi-state filing complexity with non-uniform deadlines, the same structural pattern in insurance