CPA trust account rules require you to hold client money in a separately titled fiduciary account, keep it entirely apart from firm funds, deposit receipts promptly, disburse only for the client’s benefit, and prove it all through per-client ledgers and monthly reconciliations. State boards of accountancy and the AICPA Code of Professional Conduct enforce these duties, and violations can end a career or send a CPA to federal prison.
What Counts as a Trust Account
A trust account is a separate bank account used exclusively to hold money that belongs to clients. The money inside is the client’s until it is properly earned or disbursed. Mixing it with the firm’s operating funds is commingling, and state boards treat commingling as a serious ethical violation regardless of intent. They do not have to prove any client was harmed. The act itself is enough.
The AICPA Code of Professional Conduct addresses custody of client assets under its Acts Discreditable Rule, which prohibits using those assets for any purpose other than the client’s benefit. Even temporarily borrowing client money for firm expenses and replacing it later is conversion, which boards treat the same as outright theft.
Segregation also shields clients from risks they would never see coming. If the firm faces a lawsuit, bankruptcy, or creditor claims, funds in the firm’s operating account are fair game. Funds in a properly titled trust account are not.
Titling and Bank Setup
The account must be titled in a way that makes its fiduciary nature obvious: “Client Trust Account,” “Client Funds Account,” or “Escrow Account” are common designations. Bank documents should identify the firm as fiduciary or custodian, not owner. That naming puts the bank and any future creditor on notice.
Many state boards require the bank to agree in writing that it will not exercise any right of setoff against the trust account to cover debts the firm owes on other accounts. Without that agreement, a bank could sweep client funds to cover an overdue firm line of credit. Overdraft protection, credit lines, and similar features should never be linked to a trust account, because they effectively pledge client funds as collateral for firm borrowing. Some state boards require the bank to notify the board directly if the account is ever overdrawn. Even a momentary negative balance signals a serious problem.
Deposits and Disbursements
Client funds must be deposited promptly after receipt. Most state boards define promptly as within one to three business days, though the exact window varies. Every deposit needs documentation showing which client the money belongs to and what it is for. A check that arrives without a clear notation of its purpose should be clarified before deposit, not guessed at.
Disbursements may only go toward the client’s benefit: payments to taxing authorities, settlement distributions to third parties, refunds of unearned retainer fees, or similar purposes. One client’s funds can never cover another client’s obligations, even temporarily. Each transaction must trace back to a specific client ledger, and you should be able to reconstruct the complete history of any client’s money at any time.
Transferring earned fees to the firm’s operating account requires a specific sequence. The fees must actually be earned under the engagement letter, the client must be billed, and the authorization should be documented before the money moves. Pulling fees before they are earned is conversion, even if you plan to do the work next week. When in doubt, leave the money in the trust account until the work is done and the invoice sent.
The trust account must never pay firm operating expenses like rent, payroll, or utilities. If the bank charges service fees against the trust account, the firm must reimburse those fees immediately from its operating account so no client’s balance is reduced by the firm’s banking costs.
Interest on Client Balances
Interest earned on client money generally belongs to the client. When you hold a substantial amount for a single client over an extended period, place those funds in a separate interest-bearing account and credit the interest to the client. You cannot pocket it.
For smaller or short-term balances pooled across multiple clients, the interest question depends on state law and the terms of the engagement letter. Some states have specific rules for pooled interest; others leave it to the engagement agreement. Address it in writing before any money changes hands.
One boundary worth noting: IOLTA programs, which route interest from pooled trust accounts to state legal aid foundations, are designed for attorneys. CPAs should not assume IOLTA rules apply to their accounts.
Records and Reconciliation
A trust account only works if the records behind it are meticulous. At minimum, keep bank statements, deposit slips, disbursement records, and written client authorization for every transaction. Every client with money in the account needs a separate ledger showing each deposit, each disbursement, and the running balance for their specific matter.
State boards set their own retention periods, and requirements vary. Some states mandate as few as three or four years; others require longer. The seven-year retention figure sometimes cited in this context actually comes from an SEC regulation covering audit documentation for public companies, which is a different obligation. Check your state board’s specific requirement, and when in doubt keep records longer rather than shorter. A destroyed record can never be reconstructed.
The Monthly Three-Way Reconciliation
The most important compliance habit is the monthly three-way reconciliation. It compares three figures that must agree:
- The bank statement balance for the trust account, adjusted for outstanding checks and deposits in transit.
- The firm’s general ledger balance for the trust account.
- The sum of every individual client ledger added together.
When all three match, no client’s money has been misapplied. When they do not, something has gone wrong and needs to be found immediately. A discrepancy could be as innocent as a data entry error or as serious as an unauthorized disbursement. The reconciliation catches problems within weeks rather than letting them compound over months.
The reconciliation should be performed by someone other than the person who handles day-to-day deposits and disbursements, or at least reviewed by a firm principal who was not involved in the month’s transactions. In small firms where full separation of duties is not practical, requiring dual signatures on disbursements above a set threshold, sometimes $5,000 or $10,000, provides a reasonable safeguard.
FDIC Pass-Through Insurance
A trust account holding funds for multiple clients can qualify for FDIC pass-through insurance, meaning each client’s share is insured up to $250,000 individually rather than the whole account sharing a single $250,000 limit.1FDIC.gov. Understanding Deposit Insurance This matters enormously during tax season or when escrow funds are involved.
Pass-through coverage requires that the fiduciary relationship be expressly disclosed in the bank’s deposit account records, and that the identity and interest of each beneficial owner be ascertainable either from the bank’s records or from records the CPA maintains in good faith and in the regular course of business.2eCFR. 12 CFR Part 330 – Deposit Insurance Coverage If your records cannot establish individual ownership, the FDIC treats the entire account as belonging to the firm and applies the $250,000 limit to the whole balance.3FDIC.gov. Pass-Through Deposit Insurance Coverage
Accurate per-client ledgers are what turn a single $250,000 cap into $250,000 for every client. The record-keeping is not busywork.
Electronic Transfers and Fraud Prevention
Most trust account transactions now move electronically, and the rules have caught up. As of 2026, any business that sends payments through the ACH network must have documented, risk-based procedures for detecting and preventing fraudulent transactions. The requirement applies to all corporate end users regardless of volume, with full compliance required by June 2026.4Nacha. The New Nacha Rules: New Fraud Compliance Responsibilities for All Organizations Sending ACH Payments
A firm’s fraud prevention procedures should include a written plan for handling requests to change payment information, which is a common vector for business email compromise fraud, along with steps for detecting and recovering from fraudulent transactions that slip through and a process for spotting similar attempts later. Noncompliance can lead to fines, liability for fraud losses, and reputational damage.
Basic cybersecurity hygiene applies with special force to trust accounts. Multi-factor authentication on all banking access, callback verification for wire transfer requests, and restricted access to online banking credentials are the bare minimum. A CPA who loses client funds to a phishing attack faces the same disciplinary exposure as one who deliberately misuses the money. The duty to safeguard client assets has no negligence exception.
Unclaimed Funds and Escheatment
Client funds sometimes sit in the account long after an engagement ends. A client moves without a forwarding address, stops responding, or forgets a small balance. These dormant funds do not belong to the CPA, but they cannot stay in the trust account forever either.
Every state has unclaimed property laws requiring holders of dormant funds to turn them over to the state after a set dormancy period. For most financial accounts the period runs three to five years depending on the state, with five years being the most common for trust-type accounts. You must make a good-faith effort to contact the client before the dormancy period expires, and most states require specific notice procedures.
Once the dormancy period passes without a claim, report and remit the balance to the state’s unclaimed property division. The client can still claim the money from the state later. Failing to comply with escheatment laws can trigger penalties separate from any state board discipline.
State Board Oversight and Penalties
State boards of accountancy have broad authority to investigate, audit, and discipline CPAs who handle client funds. Many boards require CPAs with trust accounts to file periodic reports confirming the account’s existence and attesting to compliance with segregation and record-keeping rules. Some require notification when a new trust account is opened.
Boards can conduct random or targeted compliance reviews. During a review, you must produce the full set of records: bank statements, client ledgers, monthly reconciliations, and authorization documentation. Incomplete or missing records are treated nearly as seriously as actual misuse. If you cannot prove the money was handled correctly, the board has no reason to assume it was.
Disciplinary and Criminal Consequences
For fiscal dishonesty or breach of fiduciary responsibility, state boards can impose penalties ranging from a stayed revocation with suspension and multi-year probation at the low end to permanent license revocation at the high end. Individual CPAs may face administrative fines in the tens of thousands of dollars per violation, and in some states firms can face penalties of up to $1 million or more for serious breaches. As a condition of probation, a CPA may be prohibited from handling any client funds during the probation period.
Discipline is not the worst-case outcome. Misappropriating client funds is a crime. Federal prosecutors have secured multi-year prison sentences against CPAs who stole from trust accounts. In one case a Tennessee CPA received a nine-year federal prison sentence and was ordered to pay approximately $4.5 million in restitution after stealing from clients’ accounts and filing false tax returns.5IRS.gov. Franklin CPA Sentenced to Nine Years in Prison for Stealing Clients Funds and Tax Fraud State boards can also refer cases to local district attorneys for prosecution under state law.
Closing the Account
When you retire, close the practice, or simply stop handling client funds, wind the account down through a formal process. Every remaining client balance must be disbursed to the rightful owner or transferred to a designated successor. Document each final disbursement, confirm the balance reaches zero, and notify the state board that the account has been closed and all client obligations satisfied.
Closing the account without properly returning all client funds is itself a violation. If a client cannot be located, follow the state’s unclaimed property procedures rather than withdrawing the balance. The state board notification keeps its records accurate about which CPAs still hold fiduciary obligations and which do not.