There are 3rd-party enforcement mechanisms. It's not as simple as the seller saying "We don't pollute, trust us"; there are actual government inspectors and NGO delegates that go out, visit factories, and fine them if their actual emissions don't match the declared permits:

https://ww2.arb.ca.gov/resources/documents/mrr-enforcement

The bigger issue, as mentioned above, is that there's often a time lag between when the seller receives the money and when the seller can actually put it to use to reduce carbon emissions. One of the biggest sellers of carbon credits, for instance, is CA high-speed rail, which is decades away from completion. If it doesn't actually complete, it's not going to take any cars off the road or planes out of the sky, and so all the carbon credits it sold would just allow fossil fuel emitters to maintain status-quo emissions.

But as a way of diverting private resources from CO2 emitters to greener alternatives, cap & trade has been pretty effective. Over half the cars in my Bay Area city are now EVs; Tesla was kept afloat for many years by selling carbon credits.