Why attorneys must speak up about the proposed rules for implementing CTAPP

The State Bar will begin implementing reviews of client trust accounting starting in August. "Proposed Scope of Client Trust Account Protection Program Compliance Review Procedures," State Bar of California (July 10, 2025). These proposed changes will greatly impact how attorneys practice in California, and it is imperative that they educate themselves on the new requirements and voice their concerns with the State Bar.

Attorneys selected for the compliance reviews will have to pay hefty fees to State Bar-approved CPAs to audit their trust accounts, and the audits are not limited to reviewing whether the bank statements reflect the account journals maintained by the attorneys. Instead, these audits or compliance reviews will require attorneys -- on short notice -- to provide client communications as evidence that they notified clients and third parties of fund receipt within 14 days, and distributed undisputed funds within 45 days, as required by Rule of Professional Conduct 1.15(d).

The Client Trust Account Protection Program (CTAPP) was approved by the Supreme Court in January of 2023, pursuant to Rule 9.8.5. This rule provides that the State Bar must establish and administer CTAPP, ensuring that "client funds be held in trust by a licensee that facilitates the State Bar's detection and deterrence of client trust account misconduct." Cal. Rules of Court, rule 9.8.5. As a result, the State Bar is granted authority to conduct compliance reviews of client trust accounting. Id.

CTAPP reviews are broken up into four phases: Planning, Compliance, Accounting and Supervision. State Bar of Cal., "Proposed Scope of Client Trust Account Protection Program Compliance Review Procedures," (July 10, 2025). Each phase is governed by applicable statutes and rules. Id. As discussed below, Rule 2.6 with respect to compliance reviews and investigatory audits is outlined under the Planning phase of CTAPP. Id.

In February 2025, the State Bar adopted new rules regarding CTAPP, including Rule 2.6, which outlines compliance review and investigative audit procedures. Rules of State Bar of Cal., rule 2.6. Under Rule 2.6, if selected, a licensee must comply with the State Bar and complete a trust account compliance review, investigative audit and, subject to any findings, fulfill any requirements mandatory of a corrective action plan. Id. Licensees are responsible for designating a State Bar-approved Certified Public Accountant (CPA) to conduct the review at their own expense and provide any requested trust account records. Id. This expense will likely cost upwards of $10,000 and can even cost up to $25,000. Attorneys grossing under $150,000 and who qualify for financial relief can request an in-house audit by the auditors on the State Bar's payroll. If a licensee is selected, it not only affects the individual licensee but also may subject all licensees of their firm to "requests for information, requests for responses to questions and must comply with any mandatory corrective action plan." Rule 2.6.

Compliance review requirements: A compliance review will review no less than one year of trust account activity. Rule 2.6. If selected, the licensee must report the name of the State Bar-approved CPA selected following State Bar specifications within 30 days of receipt of notice. Id. If the selected individual is not the designated licensee per Rule 2.4, they must provide names, license numbers and contact information for the designated licensee. Id. If no designated licensee exists, they must provide names, license numbers and contact information for the account holder or signatory and the individual responsible for monthly trust account reconciliation. Id. Licensees must also fully comply with and respond to all questions and requests for additional documentation from the State Bar and State Bar-approved CPA. Id. After all records have been provided, the selected licensee must provide a signed statement of representation on a State Bar provided form. Id. Finally, within 14 days of completion of the compliance review, licensees must submit an acknowledgment of receipt of any findings. Id.

Investigative audit requirements: A licensee may be selected to participate in an investigative audit review based on findings during a compliance review. Rule 2.6. An investigative audit will review no less than three years of trust account activity. Id. If selected, a licensee has 14 days to submit any requested trust account records following State Bar specifications, cooperate with and respond to all questions and requests for additional information by the State Bar related to the safekeeping of client or third-party funds, produce records related to non-trust accounts if entrusted funds are held in an account other than a trust account, and provide a signed statement of representation on a State Bar provided form after all required records have been submitted. Id.

The requirement for licensees to provide evidence that notice of receipt of funds has been provided to clients and third parties within 14 days and that undisputed funds for identified clients be distributed within 45 days goes beyond ensuring trust records are in accordance with bank records. These communications will necessarily invade attorney-client privilege communications, and the rule changes attempt to abrogate the confidentiality and privileged status of such communications if the State Bar is to make such requests.

Additionally, there is a valid concern of the unlawful practice of law for a CPA to provide  expert legal opinion as to whether a lawyer has complied with a rule of professional conduct by notifying clients within 14 days without any rules or regulations as to the scope of work that the CPA is retained to do. Without any parameters governing CPA conduct, there is a potential for abuse and overreach.

The proposed set of rules on CTAPP compliance will disproportionally affect small firms and solo practitioners. All California attorneys are strongly encouraged to submit public comments using the State Bar's online Public Comment Form before the Aug. 4, 2025, deadline at 11:59 p.m.