Collecting tax exemption certificates without letting them go stale

A tax exemption certificate feels like paperwork nobody thinks about until a state tax audit asks to see every one of them at once, at which point missing or outdated certificates become a direct liability, not a filing inconvenience. The business that failed to collect proper documentation, not the customer who claimed the exemption, is usually the one on the hook for the uncollected tax.

What to collect, and why it matters

In the US, sales tax exemption generally falls into a few common categories: resale (the buyer is purchasing to resell, so tax applies at the final sale instead), nonprofit or government exemption, and manufacturing or agricultural exemptions in states that offer them. Each state has its own specific form or accepted documentation, and some states accept a multi-state uniform certificate while others require their own state-specific form regardless. Because this varies meaningfully by state, and because exemption rules do get updated over time, confirm the current requirement for each state you actually sell into, through that state's department of revenue, rather than assuming a certificate format that worked in one state is automatically valid in another.

What you're actually collecting, regardless of exact form, is typically: the buyer's legal business name and address, their tax ID or resale permit number, the specific reason for the exemption, and a signature from someone authorized to make that claim on behalf of the business. The signature matters because it's what shifts at least some practical accountability for a false claim onto the business making it, even though the selling business still generally bears responsibility for having collected a facially valid certificate in the first place. The same signed-form approach works for other attachments, as in collecting an ID copy or insurance certificate with a signed form.

Request flow

Collect the certificate as part of new customer onboarding, before the first tax-exempt order ships, not as a follow-up once an order is already in progress. Build it into whatever packet or form a new business customer completes at signup, alongside any credit application or terms of sale, rather than as a separate, easy-to-forget step that depends on someone remembering to ask. A signed, dated certificate collected at signup, through any standard e-signature or document collection tool, is both faster for the customer and creates a clearer record than a scanned paper form emailed in and manually filed somewhere. The wider setup is covered in how distributors can onboard new customers without paper.

When a certificate is unclear, missing a required field, using a form from the wrong state, or claiming an exemption category that doesn't obviously match the buyer's stated business, follow up before shipping the order tax-free rather than accepting it as a formality to be sorted out later. This single habit, actually reading what you're collecting rather than filing it unread, is what separates a defensible compliance process from one that just looks like it exists on paper.

Verifying a certificate, not just collecting it

Collecting a signed form is the first step, not the last one. A number of states offer a free online lookup where you can confirm a resale permit or tax ID number is actually active and belongs to the business claiming it, rather than taking the number on the form at face value. Whether this lookup exists, and how reliable it is, varies by state, so this is worth doing selectively rather than assuming it's available everywhere, but for a new customer claiming a meaningful exemption on a large order, the few minutes it takes to check is cheap insurance against a certificate that's outdated, mismatched to a different business, or outright fabricated.

Also worth a quick sanity check: does the stated exemption reason plausibly match the business. A certificate claiming a manufacturing exemption from a business that is clearly a retail storefront, based on their own business name or the products they're ordering, is worth a direct follow-up question before you accept it, rather than filing it unread because the signature line is filled in. None of this requires turning your onboarding team into tax investigators, it just means treating the certificate as a document worth actually reading, the same way you'd read a credit application rather than just checking that a signature exists somewhere on the page.

If you sell into multiple states

A business selling into many states carries a meaningfully larger version of this problem, since the same customer buying from several of your locations or shipping addresses across state lines may need a different certificate for each state where you have a tax collection obligation, known as nexus. Treat each state separately in your records rather than assuming one certificate from a customer's home state covers every state you ship their orders to, since that assumption is one of the more common ways multi-state sellers end up with real exposure discovered only during an audit that looks at sales by destination state rather than by customer.

Keeping them current

Certificates lapse. Some states require periodic renewal, and even in states that don't formally expire a certificate, a business can change its exemption status, lose a resale permit, or change its legal entity entirely, making an old certificate no longer accurate even though nothing about the document itself technically expired. Build a simple recurring review into your process, a spreadsheet or report flagging certificates by age, checked at least annually, so a certificate collected three years ago for a customer who may have since restructured their business doesn't sit quietly on file as if it were still accurate.

Keep a copy of every tax-exempt sale's certificate retrievable for as long as your state's audit lookback period requires, which commonly runs three to four years but varies by state, so confirm the specific period that applies to you. Being able to produce the matching certificate for every tax-exempt invoice during an audit, quickly and without a scramble, is the entire purpose of collecting these in the first place. General retention rules for signed documents are in how long to keep signed contracts.

A worked example

A wholesale distributor is audited by a state tax authority and asked to produce exemption certificates for every tax-exempt sale made to in-state customers over the past three years. For most accounts, a certificate collected at onboarding and filed against the customer's record comes up in minutes, a clean, defensible answer for each transaction examined. For a handful of older accounts onboarded before the business had a consistent collection process, scattered across a period when whoever handled onboarding simply didn't always ask for one, no certificate exists at all, just a sales record showing no tax was charged and nothing to back up why. The state treats those specific sales as taxable, since there's no valid exemption documentation on file, and the distributor owes the uncollected tax on those transactions directly, regardless of whether the customer's exemption claim would have actually held up if it had been properly documented at the time.

How I'd approach this

The businesses that get into real trouble here aren't usually the ones selling to customers who falsely claim exemption, they're the ones with a collection process that was inconsistent for a stretch of years, good for some customers, forgotten for others, with no reliable way to tell which is which until an audit forces a full review. Fixing this is less about any individual certificate and more about making collection a non-skippable step at onboarding, verifying what comes in rather than filing it unread, and building a periodic review habit on top of both. If you're managing exemption documentation across a real customer base and it currently lives in scattered folders rather than tied cleanly to each customer record, bringing that into one connected system is exactly the kind of work I do. Get in touch if that's useful to you.