How-to
How to Vet a Wholesale Application — a 10-Minute Routine That Beats 'They Seem Nice'
Vetting a wholesale application is a ten-minute routine, not a credit investigation: check the certificate against the state's lookup, run EU VAT numbers through VIES, confirm the business exists, catch duplicates, and call a reference only when the account is big enough to deserve it. A merchant setting up wholesale asked the Shopify Community exactly this in July 2026 — read the PDF, check the state site, approve, "seems like a lot of work as we grow" — and the honest answer is: the checks stay human, but a routine plus one enforcement trick keeps them at ten minutes. Here's the routine (facts checked 7 August 2026).
Check 1 — Is the resale or tax-exempt certificate real?
A resale certificate is the state paper that lets a shop buy from you without paying sales tax, because they'll charge the tax when they resell. If a buyer claims exemption, this check is the one you can't skip — Shopify's docs put the stakes plainly: "Tax is your responsibility."
- Complete: buyer's legal name matching the application, a permit/registration number, your state as issuer (or a multistate form naming it), signed and dated.
- In date: some states' permits expire, some don't. Whatever the document says, record the expiry date the day you approve — an approved-once-never-rechecked certificate is the classic audit finding. As one practitioner put it in that thread: a cert "approved once never gets re-checked, and a year later you're selling to someone whose license lapsed."
- Looked up: most US states offer an online verification of the permit number on their revenue site; a few don't, and there the completeness check plus a phone call is the standard. Search "[state] resale certificate verification" — the official site, not a blog.
Only after the certificate passes do you flip the tax-exempt setting on the buyer's company location in Shopify. Not before, not "while we sort the paperwork."
Check 2 — Does the EU VAT number pass VIES?
For EU buyers, VIES is the European Commission's free VAT-number checker: paste the number, get valid or invalid, often with the registered business name to compare against what the applicant typed. It's a 30-second check and the single highest-value signal on an EU application — merchants in the July 2026 apply-flow thread ranked fake wholesale applications as more common than expected.
The decision rule: a failed VIES check is a follow-up email, not an automatic rejection. Typo'd VAT numbers are the most common decline-then-reapply case; the second failure, on a number the buyer confirms, is the actual signal.
Check 3 — Does the business exist?
- Registry: the state's corporation/business search (Secretary of State site), Companies House for the UK, the local equivalent elsewhere. You're confirming the entity exists and isn't dissolved — not underwriting it.
- Shop: a website, a stocked Instagram, a Google Maps listing with photos. A reseller with no visible way to resell is the question to ask.
- Email domain: [email protected] matching thestore.com closes the loop. A personal Gmail isn't disqualifying for a small shop — it just moves weight onto the other checks.
Check 4 — Have you seen this buyer before?
Search the email and company name in your admin before approving: past declined applications, an existing retail customer, or — the ugly one — an email that's already a contact of a different company, which makes the approval error out mid-click. Developers building in this space report both collisions showing up as soon as real flows got tested; thirty seconds of searching is the manual version of that warning.
Check 5 — Trade references (only when the size justifies it)
For a starter account with modest volume, skip them — every field costs real applicants. For larger asks (big opening order, payment terms on top of wholesale prices), two references you actually phone beat five you don't: "How long have you supplied them? Do they pay on time?" is the whole call, five minutes each.
The enforcement trick: nothing sells while you check
The part of vetting you can make structural is making sure an unverified buyer can't order wholesale while the certificate sits in your inbox. Keep wholesale prices in a B2B catalog that only approved companies get, and don't grant ordering permission until the routine is done. The alternative is the 2024 cautionary tale that still circulates: a gated B2B store waking up to "two orders from unauthorized customers" because account creation and approval weren't the same gate. Approval must be the only door to wholesale prices; then a two-day vetting delay costs nothing.
The decision, in three sentences
- Approve when the certificate (if claimed) checks out, the business is real, and nothing collides.
- Ask for more when exactly one thing is off — VIES fail, blurry certificate, missing expiry. One specific question, same day: "Can you re-send the VAT number? This one isn't validating."
- Decline when the story doesn't hold together (no resale channel, certificate from the wrong entity, references that don't know them) — briefly, kindly, in writing. Silence is the only wrong answer.
That's the whole system. Done by hand it's ten minutes per application and a calendar entry per certificate; this routine is also, feature for feature, what ApprovePilot's review queue automates the advisory half of — the VIES badge, registry links, duplicate warnings, and expiry reminders arrive with the application, and the decision stays exactly where it belongs: with you.
Common follow-up questions
Am I legally required to verify resale certificates?
The exemption is your risk either way: Shopify's docs are blunt that "Tax is your responsibility," and if you don't charge sales tax on the strength of a bad certificate, the auditor's conversation is with you. Requirements vary by state — some expect good-faith acceptance of a complete certificate, others provide lookups they expect you to use. Checking the permit number takes minutes; do it.
What if a VAT number fails the VIES check?
Reply and ask, don't reject. Typos are the most common cause, some registrations take time to appear, and VIES itself has outages. Treat a red result as "ask the buyer to re-send the number," and only treat it as a warning sign when the corrected number fails too.
Can any of this be automated on Shopify?
Partly, with plan caveats (checked 7 August 2026): Shopify Flow can call external checkers via "Send HTTP request," but that action is limited to Grow, Advanced, and Plus — and someone still has to judge the result. Apps in this space run checks like VIES automatically and show the result beside the application; the decision stays yours everywhere.
How often should I re-check an approved buyer?
At certificate expiry, always — record the date the day you approve and let it interrupt you. Beyond that, an annual glance (does the business still exist, has the ship-to changed, are they buying what they projected?) catches drift. You don't need to re-run the whole routine unless something changed.
A buyer needs a professional license (cosmetology, medical) — same process?
Same shape, different lookup: completeness, expiry date recorded, and the number checked with the issuing state board instead of the revenue department. The catalog trick from this guide matters even more there — keep restricted products in a catalog only approved companies can see, so nothing sells while a license sits unverified.
If the missing front door is your problem: ApprovePilot puts the application form this guide describes on your storefront, shows the vetting signals next to each application, and sets up the approved company, payment terms, and tax settings in one click. The Free plan (5 applications a month, every feature included) is the trial — no card, no clock.