US Resale Certificate Verification on Shopify: Why a Manual Glance Isn't Enough
A wholesale buyer uploads a resale certificate during registration. It's a PDF, it has the right state header, it looks official. You mark the customer tax exempt and move on to the next application.
Two years later, an auditor looks at that same certificate and notices it was issued to a different company. Or that it expired the year before the customer used it. Or that it's for a state where the exemption doesn't apply the way you assumed. The sales tax you didn't collect on every one of that customer's orders is now assessed against your business, with penalties.
TL;DR: In the US, the seller — not the buyer — is liable for exempting a sale on an invalid resale certificate. Reading the document isn't the hard part; confirming that the details on it match the buyer's actual business is. Shopify will mark a customer tax exempt but does nothing to check the certificate. The real value is cross-referencing the certificate against the registration data and flagging what doesn't match — so you can decide, because the decision is legally yours.
If you sell wholesale to US businesses, resale certificates are part of the job. And how you handle them is a bigger liability than most merchants treat it as.
Who's Actually on the Hook
US sales tax is collected on the final retail sale. A business that buys your products to resell them doesn't pay sales tax on the wholesale purchase — the tax gets collected when they sell to the end customer. To document that exemption, the buyer gives you a resale or exemption certificate.
Here's the part that matters: once you accept that certificate and stop charging tax, you are responsible for it being valid. If a state audits you and the certificate doesn't hold up, the uncollected tax is your liability, not the buyer's. "They gave me a certificate" is not a defense if the certificate was for the wrong entity or long expired. Accepting one in good faith only protects you if you actually exercised that good faith — which means looking at it properly.
Certificates Are Harder Than They Look
A resale certificate seems simple. It's a form. But the details are where the risk lives.
There are different forms for different states. There are multi-state certificates like the MTC and SST forms. Certificates expire, and the rules around expiry vary. And critically, the certificate has to actually correspond to the business in front of you — the legal business name, the state, and the tax or registration number on it need to match the company that's applying for your wholesale account.
That last point is the one a manual glance almost always misses. A certificate can be perfectly real and still be wrong for this customer: issued to a related but different legal entity, for a different state than the one they operate in, or simply out of date. The document looks fine. It's the cross-check that fails.
What Shopify Does, and What It Leaves to You
Shopify can mark a customer or a B2B company tax exempt, using the appropriate state reseller exemption codes. That part works.
What Shopify does not do is tell you anything about the certificate itself. The uploaded document is just a file. Shopify won't read it, won't check whether the business name on it matches the applicant, won't notice that it expired, and won't flag that it's for the wrong state. Whether that certificate is worth anything is entirely on you to determine — and to defend later if anyone asks.
Reading the Document Is the Easy Part
It's tempting to think the answer is OCR: software that reads the certificate. And reading a certificate with AI is genuinely useful — but on its own it's table stakes. Plenty of tools can pull text out of a document.
The part that actually reduces your risk is the cross-check. Does the business name on the certificate match the name the customer entered on their application? Does the state match? Does the tax ID line up? Is it still in date? Those mismatches — wrong entity, wrong state, stale certificate — are exactly the failures that cost merchants in audits, and they're invisible if you only read the certificate in isolation.
This is also why a standalone certificate tool can only get you so far. It has the certificate, but it doesn't have the registration data to compare it against. A system that owns both halves — the application the customer filled out and the certificate they uploaded — can put them side by side and surface every field that disagrees. That comparison is the whole point.
Flag, Don't Decide
This is the part worth being deliberate about, because it's where the liability lives.
A verification feature should help you review a certificate. It should not pretend to make the decision for you. So the right behavior is: read the certificate, cross-check it against the application, flag anything that doesn't match — and then stop. It should never auto-approve a customer on the strength of a document. It should never tell you a certificate is "valid" or that you're "compliant." Because it can't actually know that, and more to the point, it isn't the one who answers to the auditor. You are.
The honest version is: surface what lines up and what doesn't, in plain terms, and let you make the call. That's not caution for its own sake — it's an accurate description of where the responsibility sits. Any tool that claims it "verifies" your certificates and keeps you "compliant" is quietly taking credit for a judgment that's still legally yours.
What This Actually Buys You
Done this way, certificate review stops being a nervous glance and a hope. You see immediately whether the certificate matches the business — name, state, tax ID, and expiry, checked against what the customer told you. The mismatches that would have slipped through get put in front of you before you grant the exemption, not discovered in an audit afterward. And the cases that genuinely line up move faster, because you're not squinting at a PDF trying to remember what the applicant typed three screens ago.
For the European version of this problem — VAT reverse charge, a different mechanism with the same "the liability is yours" principle — see EU VAT on Shopify. And because resale certificates are sensitive business documents, how they're stored and deleted matters too; see GDPR Compliance for Shopify B2B Apps.
None of this is tax advice, and exemption rules vary by state — confirm your obligations with your accountant. But the workflow above is the difference between accepting certificates and actually verifying them.
B2B Onboard reads uploaded resale and exemption certificates and cross-checks the business name, state, and tax ID against the customer's registration — then flags any mismatch for your review. It helps you evaluate certificates faster and with more confidence. The final decision stays yours. See how it works.
Peer Jakobsen is the founder of Mentilead. He builds Shopify B2B apps from Denmark with a focus on clean architecture and EU compliance.