How long should you keep resale certificates?
TL;DR: keep every resale certificate for at least 7 years after the last transaction it covered. That’s longer than any individual state requires, but it’s the only retention policy that survives every US state’s audit window without surprises.
Each state sets its own sales-tax audit lookback period — the number of years into the past an auditor can examine. Your resale certs are audit-response evidence, so you need them for at least as long as the lookback. Miss one and the default assumption during audit is “you owe tax on that sale.”
State-by-state lookback windows (sales-tax audits)
| State | Standard lookback | Extended (fraud) |
|---|---|---|
| California | 3 years | 8+ years |
| Florida | 3 years | Unlimited |
| Illinois | 3 years | Unlimited |
| New York | 3 years | Unlimited |
| Texas | 4 years | Unlimited |
| Pennsylvania | 3 years | Unlimited |
| Ohio | 4 years | Unlimited |
| Michigan | 4 years | Unlimited |
| Georgia | 3 years | Unlimited |
| North Carolina | 3 years | Unlimited |
Every state extends the lookback indefinitely when fraud or willful tax evasion is suspected. Practically: honest bookkeeping + 7 years of retention = safe in every state.
Why 7 years (not just the longest state’s window)
Three reasons:
- IRS alignment. Federal income-tax records generally need to be kept for 7 years. Resale certs often double as backup for a business-expense deduction. Same retention window = one rule to remember.
- Audit-trail chain. An auditor who finds a questionable exemption on year 3 will often look at subsequent years to see if the pattern repeated. Keeping 7 years lets you respond to the whole chain without scrambling.
- Customer relationship continuity. A wholesale buyer who bought from you 5 years ago may still have an active blanket certificate on file. Retaining the cert means you don’t re-ask them every time.
What counts as “keeping” a certificate
Accepted by every state’s Department of Revenue:
- Original signed paper, stored in a locked physical file.
- Electronic image (PDF scan of the original), stored with reasonable access controls.
Not accepted as standalone:
- An email or text saying “I’m tax exempt” with no formal certificate attached.
- A generic “tax ID number” without the full certificate content (name, address, permit number, signature, date, description of goods).
- A screenshot of a buyer’s seller’s-permit-number lookup page.
What ResaleProof does
- Stores every cert PDF in Shopify Files with the full signed form + audit metadata (IP, user agent, timestamp, digital signature).
- Default retention policy: active certs kept indefinitely while the shop is active; expired certs kept 7 years past expiration.
- One-click audit-ready PDF bundle export at
/app/audit-export— includes a cover sheet, TOC grouped by state, and every cert concatenated. Hand this to your auditor and you’re done.
Related
- What happens if I get audited and can’t find a cert?
- How to verify a resale certificate is valid
- Single-purchase vs blanket resale certificates
Sources
- State DOR audit manuals (various). Retention windows verified against each state’s latest published audit-procedures guide as of April 2026. If you’re operating in a state not listed above, check your state’s DOR site for the “statute of limitations — sales and use tax” section before relying on the 7-year rule of thumb.