Sales Tax Exemption Certificates | Resale, Nonprofit & Government Rules

Part 1 covered how you end up with sales tax obligations in states you never planned for. Part 2 covered the returns. This one covers the piece that actually decides audits, and the piece companies are most often wrong about.

Three certificate record cards, a resale certificate and a government exemption marked VALID in green and a nonprofit E number marked EXPIRED in red, beside the headline Exemption certificates: where audits are won and lost.

Here is the rule, and everything else in this article follows from it:

In an audit, an exempt sale you cannot document will generally be assessed as a taxable sale.

If you cannot produce a valid exemption certificate for a sale you billed without tax, the auditor assesses the tax — plus penalties and interest — against you, the seller. It does not matter that the customer really was a reseller, a church, or a school district. It does not matter that everyone involved knew it was exempt. The certificate is the evidence, and without evidence the exemption is very hard to sustain. (There is a partial reprieve, covered at the end of this article: most states will let you go collect the missing certificates once an audit has started. Do not count on that as a filing system.)

That is the whole game. Companies lose sales tax audits over filing cabinets, not over tax law.

The three exemptions that matter to most businesses

Resale. Your customer is buying to resell, so tax is deferred to the eventual retail sale. This is the big one for distributors and manufacturers. In Illinois the document is Form CRT-61, Certificate of Resale, and the state's instructions put an obligation squarely on you as the seller: verify that the purchaser's Illinois retailer or reseller account ID is valid and active, which you can do through the Verify a Registered Business tool at MyTax Illinois. Accepting a form with a made-up or lapsed number is not a defense.

Nonprofit. Charitable, religious, educational, and governmental organizations can be exempt on their purchases in many states — but exemption is not automatic just because an organization holds federal 501(c)(3) status. States run their own programs. In Illinois, a qualifying organization applies on Form STAX-1 and receives a tax-exempt "E" number, which begins with the prefix E99. Under 35 ILCS 120/1g that number is valid for five years from the first day of the month following issuance, and the organization is expected to apply for renewal at least three months before it expires — the duty sits with the nonprofit, not with a courtesy reminder from the state. Expiration is a real and recurring problem: the nonprofit forgets, the number lapses, and the vendor keeps billing tax-free against a certificate that is no longer valid.

Government. Federal, state, and local government purchases are commonly exempt, with documentation rules that vary by state and often depend on whether payment comes directly from the government entity. A purchase by a government employee on a personal card and expensed back is frequently not exempt, which is a distinction that catches sellers regularly.

There are others — manufacturing equipment and inputs, agriculture, R&D, enterprise zones, direct pay permits — and they are worth knowing if you sell into those markets, because they are frequently underclaimed. But resale, nonprofit, and government cover the great majority of the exempt volume most companies handle.

Where companies actually get hurt

Almost never on the law. Nearly always on one of these.

The certificate does not exist. A salesperson was told "we're tax exempt," took it at face value, and set the customer up as non-taxable in the ERP. Nobody ever collected paper. This is the single most common finding.

The certificate expired. Blanket resale certificates are not permanent. Illinois's CRT-61 instructions say a blanket certificate should be updated at least once every three years, and immediately if a specified resale percentage changes. Illinois E numbers renew every five years. Multiply across hundreds of customers and you need a system, not a memory.

The certificate is incomplete. Missing signature, missing date, missing account number, missing description of the property, wrong form for the state. Auditors read these carefully, and an incomplete certificate is often treated as no certificate.

The certificate is for the wrong state. The customer sent you their home-state certificate for a shipment into a different state. Some states accept out-of-state resale certificates; several do not.

Nobody can find it. It exists — scanned in an email, filed under a former employee's name, in a drawer at the old office. In an audit sampling exercise, "we have it somewhere" produces exactly the same result as not having it.

The drop-ship trap. You ship on behalf of a reseller directly to their customer in a state where you have nexus and the reseller does not. Whose certificate do you need, and will that state accept it? The answer varies by state, and drop-shipping is one of the most reliably mishandled areas in the entire subject.

The retention rule nobody plans for

Certificates have to survive longer than the sale. Illinois requires a seller to keep a Certificate of Resale in its records for not less than three and one-half years. Other states run three to four, and the clock generally runs from the filing of the return, not the date of the sale.

Which means: the certificate covering a 2023 shipment needs to be producible in 2027, by whoever is doing your accounting then, in whatever system you are running then. If your certificate management strategy is a shared mailbox and institutional memory, that is a bet you will eventually lose — usually during a migration or a staff change.

Streamlined gives you one form for many states

If you sell into Streamlined Sales and Use Tax member states, there is a genuine simplification available. Under the agreement, purchasers may use the Streamlined Exemption Certificate in all member states, in paper or electronic form, and states no longer punish a seller who accepted a completed certificate in good faith — provided the seller did not solicit an improper exemption and no fraud was involved. Responsibility for an incorrectly claimed exemption shifts to the purchaser, who owes the tax, interest, and penalties.

That last point is worth reading twice. A properly completed certificate does not just document the exemption; it moves the liability off you. That is what you are actually buying with the administrative effort.

The Multistate Tax Commission's Uniform Sales & Use Tax Resale Certificate — Multijurisdiction offers comparable multi-state coverage for resale claims, and the MTC lists 36 states as accepting it. Read its caveats before you rely on it: the MTC states it cannot guarantee any state will accept the certificate; California, Connecticut, Kentucky, Maryland, Nevada, North Carolina, and Pennsylvania do not treat it as a general exemption certificate; Colorado, Hawaii, Illinois, and New Mexico do not allow it for taxable services; and Illinois requires an Illinois registration number specifically, with no good-faith safe harbor. Neither form is universal — always check the specific state.

Managing this in your ERP

Every accounting system I work in — Sage 300, Sage 50, Sage Pro, QuickBooks Enterprise, and custom FoxPro applications — can be set up to handle this properly. Most of them are not, because the setup was done years ago by someone solving a different problem. What good looks like:

Exempt status lives on the customer record, with the reason. Not just a "non-taxable" flag. Which exemption, under which state's authority, evidenced by which certificate.

The certificate number and expiration date are stored fields. If your system has customer user-defined fields, this is what they are for. If it does not, this is worth a small customization — I have added exactly this to more than one aging system, and it pays for itself the first time somebody asks.

Expiring certificates produce a report somebody actually reads. A monthly list of certificates expiring in the next 90 days, routed to whoever can chase the customer. Three-year blanket refreshes and five-year nonprofit renewals are predictable events; treat them like preventive maintenance.

The document itself is stored where the record points to it. A scanned PDF attached to the customer record, or a path to a document management system. The goal is that an auditor's request produces a file in under a minute.

Exempt sales are flagged by exemption type, not just zeroed out. If a user manually deletes the tax line on an invoice, the transaction becomes indistinguishable from a taxable sale that was undercharged. Your returns need exempt sales broken out by state anyway, as we covered in Part 2, and your audit defense needs them tied to a reason code.

New customer setup requires the certificate before the non-taxable flag is set. This is a process control, not a software feature, and it is the highest-value change most companies can make. The moment to obtain a certificate is while the customer wants something from you.

If you are running high exempt volume, the dedicated certificate management products — Avalara's exemption module and its competitors — automate collection, validation, storage, and renewal chasing. One note from Part 2 applies directly here: under the Streamlined CSP contract, a certified provider may charge to process non-taxable transactions once they exceed 30% of your annual transactions in a member state. Heavy resale and nonprofit sellers should raise that clause during pricing rather than after the first invoice.

If an audit notice arrives

Do not start by arguing. Start by counting.

Pull every exempt sale in the audit period, by customer and by state. Match each to a certificate. Sort into three piles: documented and clean, documented but defective, and undocumented. Then go get the missing ones. Many customers will provide a certificate after the fact, and many states will accept a certificate obtained during the audit — the rules, the form of proof, and the deadline all vary by state, so confirm what the specific state allows before relying on it. Where that window does exist it is usually the cheapest exposure reduction available to you, because every certificate you collect inside it is tax you do not pay.

Then fix the intake process, because auditors come back.

Frequently asked questions

A customer says they are tax exempt. Is their word enough?
No. You need a properly completed certificate for the correct state, with the required identifying numbers, kept in your records. In Illinois you are also expected to verify that the purchaser's account ID is valid and active. A verbal assurance is worth nothing in an audit.

Does a 501(c)(3) letter make an organization exempt from sales tax?
Not by itself. Federal income tax exemption and state sales tax exemption are separate regimes. Illinois issues its own "E" number on application, valid five years from the first day of the month after issuance and renewable on the organization's initiative. Some states do not exempt nonprofit purchases at all. Ask for the state document, not the IRS letter.

How long do we have to keep exemption certificates?
Illinois requires at least three and a half years for a Certificate of Resale; other states are broadly similar, generally running from the return filing date rather than the sale. Practically, keep them for as long as any state can audit the period, and make sure they survive your next system change.

Do blanket certificates ever expire?
Functionally, yes. Illinois's instructions call for updating blanket certificates at least every three years, and immediately if a stated resale percentage changes. Other states set their own intervals. Treat "blanket" as meaning "covers many transactions," not "lasts forever."

We ship on behalf of resellers to their customers. Whose certificate do we need?
It depends on the ship-to state, and drop-shipping is genuinely one of the trickiest areas in sales tax. Some states will accept your customer's home-state resale certificate; others require registration in the ship-to state. Get state-specific guidance before you rely on a blanket assumption.

Can we go back and collect certificates for old sales?
Yes, and you should. Many states accept certificates obtained after the sale, including during an audit, subject to their own timing and documentation rules — check what the state in question allows. Where it is permitted it is ordinary practice, and usually the fastest way to shrink a proposed assessment.

This article is general information, not tax or legal advice. Exemption rules and documentation requirements vary by state and change frequently — confirm your own situation with your CPA or a state and local tax specialist.

That closes the series. Nexus tells you where you owe. Returns are the recurring work. Certificates are the evidence that keeps exempt sales exempt. The companies that handle all three well are rarely the ones with the biggest accounting departments — they are the ones whose systems were set up to capture the right information at the moment of the transaction, so that nobody has to reconstruct it two years later under pressure.

Frankly, most of the fix is unglamorous: right fields on the customer record, right flags on the invoice, right report on somebody's calendar. It is exactly the sort of thing that gets deferred until it becomes an emergency.

If you would like a review of how your accounting system handles exempt customers, tax detail, and multistate reporting — or help connecting it to a tax engine — get in touch. We work in Sage 300, Sage 50, Sage Pro, QuickBooks Enterprise, and custom FoxPro systems nationwide.

📅 Book a call · 📧 peter.heinicke@pcmethods.com · 📞 630-208-8000

Read the rest of the series: Part 1 — Why Sales Tax Became Your Problem · Part 2 — Sales Tax Returns: The Work Nobody Budgets For.

Exemption Certificates: Where Sales Tax Audits Are Won and Lost