CDTFA-230 Resale Certificate: A San Francisco Business Guide
If you buy inventory to resell in San Francisco, the CDTFA-230 is the single form standing between you and paying sales tax twice. It looks like a five-minute task. That's exactly why it's dangerous. The mistakes owners make on this form don't surface at the register — they surface two or three years later, inside a CDTFA audit, when they've compounded into a five-figure use-tax bill plus penalties.
This guide breaks down what the CDTFA-230 actually does, how San Francisco's tax structure raises the stakes, how to complete it correctly, and the specific ways established businesses turn a routine certificate into audit exposure. If you'd rather have a CPA pressure-test your resale practices before the state does, book a consult with our San Francisco team.
What Is the CDTFA-230 (California Resale Certificate)?
The CDTFA-230, General Resale Certificate, is the standardized form a California business gives a supplier to buy tangible personal property for resale without paying sales tax at the point of purchase. It's administered by the California Department of Tax and Fee Administration (CDTFA) and was formerly known as the BOE-230, before the CDTFA took over sales and use tax duties from the Board of Equalization in 2017.
The mechanic is simple and often misunderstood. When you hand a valid CDTFA-230 to a vendor, you aren't erasing sales tax — you're shifting who collects it:
Your supplier collects no tax from you on that purchase.
You collect sales tax from your customer when you resell the goods.
The tax obligation moves down the chain to the final retail sale.
Per CDTFA Publication 103 (Sales for Resale), a seller who accepts a valid resale certificate in good faith and on time owes no tax on that sale. That "good faith and on time" language is not decorative — it's the exact standard auditors test against.
To use the form at all, you need a valid California seller's permit. No permit, no legitimate resale certificate. The form requires your seller's permit number, a description of the type of property your business sells, the vendor's name, a description of the specific property being purchased for resale, and your signature, title, and date. Miss or fumble any of these and the certificate can be treated as invalid — which is where the trouble starts.
Why San Francisco Businesses Can't Afford to Get This Wrong
The CDTFA-230 is a statewide form, but the financial exposure is local — and in San Francisco, the math is unforgiving.
San Francisco's combined sales tax rate is 8.625% as of 2026, made up of the 7.25% California state base plus 1.375% in district taxes. Because San Francisco is a consolidated city-county, there's a single, uniform rate across the entire city — no neighborhood-by-neighborhood variation. That's actually the lowest combined rate among major Bay Area cities (Oakland is 10.75%, San José 9.375%). The breakdown:
California state base: 7.25%
San Francisco district taxes: 1.375%
Combined SF rate (2026): 8.625%
Now apply it to a resale-certificate error. Say you used a resale certificate to buy $200,000 of goods you didn't actually resell — you used them in your operations, gave them away, or converted them to personal use. On audit, the CDTFA assesses use tax on that amount:
Use tax owed: $200,000 × 8.625% = $17,250
Misuse penalty: 10% of the tax or $500, whichever is greater = $1,725
Plus interest accruing from the original purchase date
That's roughly $19,000+ on a single mischaracterized purchase category — before your accountant's time to untangle it. Multiply that across three audit years and every "close enough" certificate you handed out, and you see why this form deserves real attention.
Two San Francisco-specific realities sharpen the point:
California is destination-based. You charge tax based on where your customer receives the goods, not where your store sits. An SF retailer shipping to a customer in Oakland charges Oakland's rate, not SF's. Resale certificates and rate sourcing get tangled together in audits constantly.
Economic nexus is $500,000. If your total California sales cross $500,000 — including sales made through marketplace facilitators like Amazon — you have a registration and filing obligation, even without a physical storefront. Established businesses scaling into e-commerce routinely trip this line without noticing.
How to Fill Out the CDTFA-230 Correctly
The form is one page. Completing it defensibly is the goal — every field should survive an auditor reading it years later.
Field 1 — Seller's permit number
Enter your valid California seller's permit number exactly. A wrong or expired number is the fastest way to invalidate the certificate. If you're the seller accepting a certificate from a buyer, verify their permit number using the CDTFA's online permit-verification tool. "I trusted them" is not a defense; documented verification is.
Field 2 — Type of property you sell
Describe the general category of goods your business sells. Be accurate, not vague. "Retail apparel and accessories" is defensible. "Various items" invites questions.
Field 3 — Vendor's name
Name the specific supplier you're buying from.
Field 4 — What you're purchasing
Describe the property you're buying for resale. For a single purchase, be specific. For an ongoing supplier relationship, this is where the blanket-vs-single decision lives (next section).
Field 5 — Signature, title, date
Unsigned certificates are invalid. This is one of the most common — and most avoidable — errors auditors flag.
The single biggest completion mistake isn't a typo. It's a mismatch between what you say you sell (Field 2) and what you're buying (Field 4). If your certificate says you sell apparel but you're buying office furniture and warehouse shelving on the same certificate, you've handed the auditor a flag. Those items aren't being resold — they're being used — and use tax applies.
Blanket vs. Single-Purchase: The Decision That Trips Owners Up
The CDTFA-230 can be issued two ways, and choosing wrong is a slow-burning liability.
Single-purchase certificate
Covers: one specific transaction
Expiration: self-limiting
Best for: rare or one-off buys
Main risk: admin overhead
Audit posture: cleanest
Blanket certificate
Covers: all future orders from one vendor
Expiration: none — active until you revoke it in writing
Best for: frequent, consistent resale buys
Main risk: outliving its purpose = use-tax exposure
Audit posture: requires active management
Per Publication 103 and Regulation 1668(b)(3), a blanket certificate replaces issuing a new form with every order. The convenience hides the trap: a blanket certificate has no expiration date. If your business pivots — you stop reselling the category it covers, or you start pulling some of those goods for your own operations — and you don't revoke it, every subsequent purchase under that certificate is exposed. This is one of the most common sources of surprise use-tax liability for established businesses that have evolved over time.
Use this quick logic to decide:
One-off purchase from this vendor? → Single-purchase certificate.
Recurring purchases, and you resell 100% of what you buy from them? → Blanket certificate — and calendar a review.
Recurring, but you use some of it yourself? → Single-purchase only; pay use tax on the items you use.
Any blanket certificate on file? → Revoke it in writing the moment the relationship changes.
The senior move: if you use blanket certificates, put a recurring calendar review on them — quarterly, or at minimum annually. Any time your product mix, sourcing, or use of goods changes, revisit every blanket certificate on file and revoke the ones that no longer apply.
The Audit Trap: How Misuse Creates Liability
The CDTFA doesn't need to prove you acted in bad faith to assess tax. It only needs to show the goods weren't resold as certified. Here's how established businesses walk into it:
Using resale-purchased goods internally. You bought display fixtures, shop supplies, or software "for resale" but consumed them in your own operations. That's a use-tax event, and the certificate you signed becomes the evidence against you.
Personal use. Pulling inventory for yourself, family, or gifts without accruing use tax. Auditors reconcile purchases against sales; the gap is where they look.
Stale blanket certificates. The certificate outlived the resale relationship.
Accepting invalid certificates from your customers. If you're the seller, accepting a certificate you didn't verify — wrong permit number, unsigned, mismatched goods — can shift the uncollected tax liability back onto you. Timely acceptance of a valid certificate protects you; an invalid one doesn't.
Poor recordkeeping. No certificate on file for an exempt sale means the burden flips to you to prove the sale qualified. CDTFA generally audits a multi-year lookback window, so a missing form from years ago still matters today.
The penalty for misusing a resale certificate is the greater of $500 or 10% of the tax due on the purchase — stacked on top of the use tax itself and interest. On a business with steady resale volume, the exposure scales fast.
Your San Francisco Resale-Certificate Compliance Checklist
Run your business against this. Every "no" is a gap worth closing before an auditor finds it.
Every resale purchase is backed by a completed CDTFA-230 on file
Field 2 (what you sell) and Field 4 (what you buy) match logically on every certificate
All certificates are signed and dated — no exceptions
For certificates you accept as a seller, permit numbers are verified via CDTFA's lookup tool
Blanket certificates are reviewed on a recurring schedule and revoked in writing when relationships change
Goods bought for resale but consumed internally have use tax accrued and reported
Certificates and supporting records are retained for the full audit lookback period (keep at least 4 years)
You're charging the correct destination-based rate — SF's 8.625% only applies when the customer receives goods in SF
If California sales exceed $500,000 (including marketplace sales), you're registered and filing
When to Bring in a CPA — Before the CDTFA Does
Here's the honest read for an established San Francisco business: the CDTFA-230 is easy to fill out and easy to misuse, and the cost of misuse compounds silently for years. Most owners don't discover a problem until an audit notice arrives — the most expensive possible moment to find out.
A CPA-led review does what a form can't: reconciles your purchases against your resale activity, flags stale blanket certificates, verifies your rate sourcing, confirms your nexus obligations, and builds a clean, defensible paper trail. If an audit does come, you walk in with documentation instead of explanations.
Get ahead of it. If you run a San Francisco business that relies on resale certificates, Mitch Levin CPA LLC— we'll review how you're using the CDTFA-230, close the gaps that create audit exposure, and keep your resale practices defensible year over year.
This article is for general informational purposes and does not constitute tax or legal advice. Sales and use tax rules change; verify current CDTFA rates and regulations for your specific situation, or consult a licensed CPA.