How do you verify an exemption certificate's registration number against the state?

How registration-number verification fits between collection and audit defense

The cert pool fails the good-faith test at the verification step, not the collection step. A brand can have a signed, complete, properly-formatted certificate that is still invalid because the buyer's registration number was bogus or lapsed, and the only way to know is to check it against the state's database at acceptance. Brands that collect but never verify discover this at audit, when the auditor pulls the buyer's registration history and finds the number was retired three years before the sale.

The legal framework that drives the verification step sits inside the good-faith standard. California (Cal. Rev. & Tax. Code §6092), New York (NY Tax Law §1132(c); 20 NYCRR §532.4), Texas (Tex. Tax Code §151.054; 34 TAC §3.287), Illinois (86 Ill. Adm. Code 130.1405), and Massachusetts (830 CMR 64H.8.1) each impose a seller-side knowledge floor: no actual, constructive, or reason-to-know knowledge of invalidity. A registration number that fails a public lookup is the cleanest path to constructive knowledge an auditor has. The argument writes itself: the lookup is free, public, designed for exactly this use, and the brand's order entry team could have checked it.

The properly-completed test and the verification test run in series. The certificate has to be properly completed first; that is the valid exemption certificate requirements check. Only then does the verification analysis matter, and only when verification fits inside the good-faith acceptance framework does the exempt sale survive contested review.

For a brand processing several hundred exempt orders a month across 20-plus states, the verification step is where infrastructure earns its place. TaxCloud's exemption certificate management performs state-specific verification at collection against the public registration database where one exists, stores the verification record with the certificate, and surfaces a flag when the lookup returns a closed or mismatched record before the order is processed as exempt.

State lookup tools and what each verifies

Roughly thirty states publish a public registration-verification tool. What each tool verifies, the URL pattern, and the buyer ID format vary materially. The eight tools that cover the highest mid-market B2B audit volume:

Three things to know when reading the table.

Each tool verifies a specific certificate type, not all exempt buyers. California's tool confirms the buyer holds an active seller's permit, which supports a resale certificate. It does not verify a separate manufacturing or government exemption. Texas's Sales Taxpayer Search confirms the buyer is a registered Texas sales tax permit holder; an out-of-state purchaser claiming a resale exemption through Form 01-339 will not appear in the Texas database, and the verification has to be done against the buyer's home-state lookup. Reading "we verified the buyer" without naming what was verified produces false confidence at audit.

Florida is the high-water mark of state-side protection. A seller who verifies a Florida DR-13 against the DOR portal at the time of sale is statutorily held harmless if the certificate is later found invalid, under Fla. Stat. §212.07(1)(b). No other state writes the protection that explicitly. The implication is operational: in Florida, the verification record at acceptance time is itself the defense. Skipping it forfeits the statute the brand otherwise has on its side.

The lookup is point-in-time. A buyer's seller's permit can be active when the certificate is accepted and closed before a renewal cycle six months later. The verification record at acceptance time covers the sale that happened at that moment. For multi-year blanket certificates, re-verification on a defined cadence is the next operational layer. The verification step at collection is necessary, not sufficient.

States beyond the eight above with public lookup tools include Pennsylvania (e-TIDES / myPATH Registered Business Search), Georgia (GTC license verification), Michigan (Michigan Treasury Online), Minnesota (Minnesota DOR Business Tax Inquiry), New Jersey (NJ Treasury Premier Business Services), Colorado (Revenue Online), Arizona (AZTaxes Sales Tax Permit Search), and Virginia (VATAX iReg). For brands writing a verification SOP, the first investment is a state-by-state map of which tool to use, what it verifies, and the buyer ID format the tool expects.

Re-verification cadence at scale

Re-verification cadence is where brands over- or under-do it. Verifying at first acceptance is mandatory. Re-verifying every blanket certificate annually is good practice for high-value buyers. Re-verifying on every transaction is wasted effort. The cadence should track the buyer's dollar volume and the state's validity rules.

Three operating bands apply across a $20-80M Shopify or Shopify Plus brand with a meaningful B2B exempt-buyer pool.

Band 1: First acceptance verification, mandatory in every state with a lookup. This is the verification record that carries the good-faith argument. Buyer ID is queried against the state lookup, the result is captured (screenshot of the active-permit confirmation, API response payload, or audit-log entry with date and method), and the record is stored with the certificate. No exempt sale should leave order entry without this record where the state publishes the tool.

Band 2: Annual re-verification for blanket certificates on high-value buyers. A blanket certificate covers all future purchases from the buyer until rescinded or until the certificate lapses under state rules (the exemption certificate validity period by state reference covers the state-by-state windows). For the buyers driving the top quintile of exempt volume, an annual re-verification against the state's lookup confirms the registration is still active. The re-verification record is stored alongside the original certificate, dated, and keyed to the lookup result. A buyer whose permit was closed in 2024 and whose certificate was accepted in 2022 generates a clear audit liability across 2024 sales unless an annual check would have caught it.

Band 3: No per-transaction verification for verified blankets in good standing. A blanket certificate that has been verified at acceptance and is on an active annual re-verification cycle does not need to be re-checked at every transaction. Per-transaction verification is operationally expensive, produces redundant records, and protects against nothing the annual cadence does not already cover. The cadence that holds is annual for high-value buyers, semi-annual at most for the top decile, and the original first-acceptance verification for everyone else.

A transaction-driven verification trigger sits inside Band 3. A new high-dollar order from a buyer whose last verification record is more than 12 months old should re-run the lookup. The trigger is the dollar threshold and the elapsed time, not the transaction itself. A brand running a $250,000 order through a buyer last verified 18 months ago should not process that order without a fresh check. The same brand running a $1,200 reorder through that buyer does not need to repeat the lookup.

The operational concern at this scale is not the cadence itself but the discipline of recording it. A brand running annual re-verification through manual reminders in a controller's calendar will miss certificates. A brand running re-verification as a scheduled task with expiration tracking surfaces lapses before they create exposure. TaxCloud's certificate management surfaces re-verification reminders before the cert lapses, runs the lookup against the state's database, and writes the new verification record back to the certificate without manual intervention.

The SST Central Registration System as a multi-state verification path

The Streamlined Sales Tax Registration System (SSTRS), administered by the Streamlined Sales Tax Governing Board, is a single registration portal that issues a sales tax registration across the full SST member-state footprint.^[9] A buyer registered through SSTRS has one record covering all member-state registrations, accessible to sellers through the SSTGB's verification framework.

For a seller, this collapses the verification problem in the SST member states from many separate lookups to one. When a buyer presents the SSTGB Form F0003 with their SSTRS-issued registration number, the seller can verify the registration through the Streamlined system rather than running individual state-by-state lookups. The verification record is the seller's confirmation that the buyer holds an active SST registration covering the state of sale.

Three things follow operationally.

SSTRS verification covers only the SST member states. The 23 full member states are: Arkansas, Georgia, Indiana, Iowa, Kansas, Kentucky, Michigan, Minnesota, Nebraska, Nevada, New Jersey, North Carolina, North Dakota, Ohio, Oklahoma, Rhode Island, South Dakota, Utah, Vermont, Washington, West Virginia, Wisconsin, and Wyoming, plus Tennessee as an associate member. A buyer registered through SSTRS and presenting Form F0003 with their SSTRS number is verified for those states. California, New York, Texas, Florida, Massachusetts, Illinois, and other non-SST states still require the buyer's own state-issued registration number and the appropriate state lookup.^[9]

The SSUTA good-faith floor applies in SST member states. SSUTA Section 317 sets the relief-from-liability standard for sellers who obtain a fully completed exemption certificate or capture the relevant data elements within 90 days of the sale, with no knowledge or reason to know the information was materially false.^[10] A seller in an SST member state who verifies an SSTRS registration and stores the verification record meets the SSUTA reason-to-know standard for that state. The verification is the affirmative act that establishes the seller did not have reason to know the registration was invalid.

Form F0003 plus SSTRS verification is not a universal exemption certificate. A few non-member states accept Form F0003 as a valid exemption certificate, but the SSTRS verification does not establish the buyer's registration in those non-member states. A brand selling into both SST and non-SST states needs a verification record per state where the buyer claims exemption, not a single SSTRS verification covering all 50.

For a mid-market brand with B2B volume spread across the country, the practical posture is a layered verification operating model: SSTRS for the SST member states where a Form F0003 buyer is registered through Streamlined, and state-by-state lookups for non-SST states and for SST member-state buyers who registered directly rather than through SSTRS.

The fallback for states without a public lookup tool

A dozen-plus states do not publish a public verification tool. The good-faith defense in those states rests on the certificate's facial completeness plus whatever corroboration the brand kept at acceptance time. The states without public verification (or with verification limited to internal-only DOR access) include Alabama, Mississippi, South Carolina, Louisiana, Hawaii, New Mexico, Wyoming, Idaho, and several others where the registration check requires a phone call to the DOR or a written request, not a portal lookup.

The verification gap in these states is not the brand's failure. It is the state's choice not to publish a tool. The good-faith argument shifts accordingly. The brand cannot be held to a constructive-knowledge standard that requires running a lookup the state does not make available. What the brand can be held to is the facial completeness of the certificate and any other diligence a reasonable seller would have applied.

The documentation fallback that supports a good-faith defense in no-public-tool states is four artifacts.

The buyer's registration receipt or confirmation. When the buyer provided the certificate, the brand asked for and stored the buyer's confirmation of registration in the state. A scan of the state-issued permit, a copy of the buyer's registration confirmation email from the DOR, or a screenshot of the DOR's confirmation page if the buyer's account is web-accessible. The artifact is the buyer's evidence of registration, captured at acceptance time, attached to the certificate.

Buyer correspondence at the time of acceptance. Email exchanges in which the buyer described their business, their resale activity in the state, or their exempt purpose. A controller documenting the cert acceptance with a brief internal note ("buyer is a registered retailer in Alabama; permit number on cert matches the registration confirmation provided by buyer") is producing the evidence the good-faith defense will hinge on later.

The brand's documented verification SOP applied uniformly. The SOP from the exemption certificate collection workflow defines the steps the order entry team runs at acceptance. In no-public-tool states, the SOP specifies the alternative diligence: buyer-supplied confirmation, named contact at the buyer for verification calls, and any third-party data the brand uses (Dun & Bradstreet entity confirmation, state corporate filings, business license verification). Running the SOP uniformly across no-public-tool states establishes that the brand was not making ad hoc judgments at acceptance time.

Periodic outreach to the buyer for renewal confirmations. For multi-year certificates in no-public-tool states, the brand cannot rely on its own lookup to confirm the buyer's registration is still active. The substitute is periodic outreach: an annual email asking the buyer to confirm the registration is still active, with the buyer's response stored alongside the certificate. The response is the buyer-supplied analog of the state lookup the brand cannot run.

Brands that treat no-public-tool states as un-verifiable produce a cert pool that fails uniformly across that subset at audit. Brands that build a defined fallback produce a defensible position state by state.

The operating model: verification record, expiration tracking, audit chain

The operating model that holds up across a 1,500 to 4,000 active certificate pool spans 20-plus states is built around three artifacts and the queries that retrieve them.

Artifact 1: the verification record, attached to each certificate at acceptance. Date of verification, lookup tool or method, buyer ID queried, result returned, and the team member who completed the check. Stored with the certificate, not in a separate log that has to be joined back at audit time. For SST member-state buyers registered through SSTRS, the verification record references the SSTRS confirmation. For non-public-tool states, the record references the buyer-supplied confirmation and the SOP version that was in effect.

Artifact 2: expiration tracking that surfaces re-verification before the cert lapses. The state-by-state validity period, the buyer's volume tier, and the elapsed time since the last verification together drive the re-verification schedule. A high-value buyer with a blanket certificate accepted 11 months ago in California should surface for re-verification before the 12-month anniversary, not after the next audit notice arrives.

Artifact 3: the audit-time evidence chain. When the assessment letter arrives, the controller pulls the certificates for the sample, the verification record for each, the SOP version that governed the acceptance, and the re-verification history. The retrieval is a query against the system of record, not a forensic exercise across Google Drive folders and email threads. The audit posture is the difference between what happens when an exemption certificate is missing or invalid during a sales tax audit and an exempt-sales sample that holds.

The retrieval test is the architectural specification. An auditor names 50 sampled exempt transactions and asks for the underlying certificate and the supporting validation evidence within 48 hours. A brand that built the operating model with verification records, expiration tracking, and audit-ready chain in mind retrieves the package as a query. A brand that stored certificates without that structure reconstructs the package under deadline pressure, with the validation evidence missing.

At a 2,000-certificate steady state across 20-plus states, the question is what the operating system actually looks like. TaxCloud is built for that: state-specific verification at collection against the public registration database where one exists, SSTRS lookup for SST member-state buyers, a documented fallback record for no-public-tool states, expiration tracking that surfaces re-verification before certificates lapse, and an audit-ready evidence chain retrievable through the system of record.