A CTAPP compliance review is a records check: the State Bar’s approved reviewer verifies your client trust ledgers, bank statements, and monthly reconciliations against the standards in Rule 1.15, not your billing judgment or case outcomes.
This article is educational and is not tax, legal, or investment advice. Consult your CPA, attorney, or licensed adviser about your specific situation.
The State Bar of California selected 400 attorneys for compliance review in 2026, following 100 reviewed in 2025 and a 21-firm pilot in 2024. The State Bar’s invitation to reviewer firms says it intends to complete hundreds of compliance reviews annually. California attorneys collectively hold more than $14 billion in client trust funds, and the Bar’s own reporting shows the direction that money is trending: reportable NSF (non-sufficient funds) actions on trust accounts fell from 1,402 in fiscal year 2023 to 1,017 in fiscal year 2024, and to 738 in fiscal year 2025. Also new for this cycle: under Business and Professions Code section 6091.3, banks now report every attorney trust account to the Bar annually, whether or not that attorney is ever selected for review.
None of this is a surprise checklist. The records standard has existed for years under Rule 1.15, and the Bar publishes the review process, the timeline, and the outcomes ladder on its own site. This article walks through what the review actually asks for, why 2026 changes the trust-account reporting landscape even for attorneys never selected, and what a firm can check this week against its own books.
What a CTAPP compliance review is (and what it isn’t)
Selection for a CTAPP compliance review is random. It is drawn from the population of attorneys who maintain California client trust accounts, and selection carries no implication of suspected misconduct. The legal basis is Rule 9.8.5(a)(2)(B) of the California Rules of Court, which authorizes the State Bar to require a compliance review of a licensee’s trust account records as part of its client protection program, per the State Bar’s CTAPP compliance review page.
The review itself is an agreed-upon-procedures engagement performed by a CPA firm the State Bar has pre-approved for this work, at the selected attorney’s expense. The attorney picks which approved firm to engage from the Bar’s list, and has 30 days from the notice to engage one. The review covers at least one full calendar year of trust records; for the 2026 selection cycle, that means 2025 records. The Bar expects the engagement to take about four months from start to finished report, per the same State Bar page.
An agreed-upon-procedures engagement is not an audit. The reviewing firm is not rendering an opinion on whether your financial statements are fairly presented. It is testing your trust records against a fixed set of procedures the Bar specifies and reporting what it finds. It is not a forensic investigation, it is not triggered by a complaint, and it does not examine the merits of your legal work. There is no pass or fail grade. The output is a findings report, and what happens next depends on what the report contains: no issues yields simple feedback, minor issues typically produce a mandatory corrective action plan with a deadline, and significant issues can escalate to an investigative audit or a referral to the Office of Chief Trial Counsel, the Bar’s discipline-prosecuting arm. The reports themselves are confidential under Business and Professions Code section 6091.4, not part of an attorney’s public disciplinary record. The Bar has been explicit that education is a primary goal of the program, per the State Bar’s CTAPP program page.
The State Bar estimates a standard compliance review at 20 to 40 CPA hours, with most reviews costing between $5,000 and $10,000, and it is explicit that poor recordkeeping, slow turnaround on document requests, and unclear communication require more CPA time and raise the cost.
Why 2026 feels different: the bank now files a report too
Through 2025, CTAPP ran on self-reporting: attorneys registered their trust accounts, completed a self-assessment, and certified compliance. Effective January 1, 2026, section 6091.3, added by AB 3279, closed the loop from the other side. Banks holding attorney trust accounts must collect State Bar license numbers on those accounts and electronically report to the Bar each year by March 1. The report includes the institution’s name, the attorney or firm name, the account number, the license number, and the December 31 balance.
That single change converts the annual CTAPP registration from an honor-system filing into a matched dataset. An account the bank reports but the attorney did not register is now visible. So is the reverse.
The statute’s companion framework in the Rules of the State Bar introduces the designated licensee under Rule 2.5. Every trust account must have exactly one. The designated licensee must be a primary account holder or a signatory on the account, and must perform or supervise the monthly reconciliation. Solo practitioners default to themselves. If the designee leaves the firm, a replacement must be designated within 30 days. This is worth pausing on: the rule attaches the monthly reconciliation duty to a named individual per account. When a compliance review later asks who supervised the reconciliations, the answer is already on file.
The paperwork that makes the bank reporting work is the Notice to Financial Institutions form. For trust accounts opened on or after January 1, 2026, the form is served on the bank at opening. For accounts that already existed, the service window ran January 1 through July 1, 2026. If you are reading this after the window and did not serve the form, the fix is mechanical: serve it now, and update your trust account information in My State Bar Profile, which must reflect changes within 30 days.
The annual CTAPP duties themselves continue unchanged: register your trust accounts, complete the self-assessment, and certify compliance with your license renewal, due March 30 in the 2026 cycle. The difference is that the Bar can now check parts of your answers against the bank’s filing.
The records a review asks you to produce (the Rule 1.15 checklist)
A compliance review opens with a document request: the reviewer asks you to upload foundational records through a secure portal, starting with bank statements for the review period, the trust ledgers, and reconciliation records. From there, the engagement works down the recordkeeping standards of Rule 1.15(d)(3), which the State Bar’s Handbook on Client Trust Accounting lays out in detail. Read as a checklist, the required records look like this:
| Record | What it shows | Common failure |
|---|---|---|
| Client ledger (one per client or matter) | Every receipt and disbursement for that client, with a running balance | No per-client breakdown; balances tracked only at the account level |
| Account journal | A chronological register of every transaction in the trust account | Journal reconstructed after the fact from bank statements instead of kept contemporaneously |
| Bank statements and canceled checks | The bank’s independent record of account activity | Statements not retained; check images never downloaded before online access expired |
| Monthly reconciliation records | Written proof the three-way reconciliation was completed each month, retained on file | Reconciliation performed mentally or in software but never saved as a written record |
| Journal of other property | Securities and other client valuables held, logged in and out | Non-cash property held with no written log at all |
Retention is part of the standard: these records must be kept for five years after final disbursement of the funds, not five years from the date the record was created. A review of 2025 activity can legitimately reach records tied to matters that closed years earlier if funds moved in the covered year.
Two adjacent items also get examined. Rule 1.15 requires timely notification to the client when funds are received on their behalf, within 14 days, and reviewers check whether that notification actually happened, not just whether the money was correctly recorded. And the answers you gave on the annual CTAPP self-assessment may be compared against your actual records. Certifying that monthly reconciliations were performed, and then producing none, is a worse position than an honest gap.
Three-way reconciliation: the test your books either pass or fail
Everything in the review converges on one procedure. A three-way reconciliation proves that three independent views of the same money agree: what your client ledgers say each client is owed, what your account journal says the account holds, and what the bank says is actually there. We cover the concept on its own in What is a three-way trust reconciliation?; here is how it functions inside a review.
The State Bar’s Handbook describes it as a three-step monthly process:
- Reconcile the account journal to the individual client ledgers: the sum of all client ledger balances must equal the journal balance.
- Reconcile the account journal to the bank statement, adjusting for deposits in transit and outstanding checks.
- Complete a written reconciliation report and retain it. The written record is itself a required record, not an optional byproduct.
When all three match, your books are in balance. When any pair diverges, something specific is wrong, and the reconciliation exists to surface it while the trail is fresh. Where it breaks in practice:
- Stale outstanding checks. A settlement check issued eleven months ago and never cashed sits as a permanent reconciling item until someone chases it down or voids and reissues it.
- A client ledger going negative. A disbursement posts for a client whose funds have not cleared, which means another client’s money covered it. This is the single finding reviewers treat most seriously, because a negative client balance is, by definition, use of one client’s funds for another’s benefit.
- Earned fees left in trust. Fees that became the firm’s property but were never transferred out, commingling firm funds with client funds.
- Transposition errors. A $1,540 deposit journaled as $1,450 that stays hidden until the three-way comparison forces it into view.
Monthly is the cadence. A reconciliation performed quarterly, or reconstructed annually before the CTAPP certification deadline, does not meet the standard the review tests against, and the dates on your written reconciliations show exactly when the work was done.
A self-check you can run this week
The review’s document request is predictable, so you can run it against yourself now. Seven items, each with a concrete pass criterion:
- Client ledgers. Pick three active matters with trust activity in 2025. Can you produce a per-matter ledger showing every receipt, every disbursement, and a running balance? Pass: all three ledgers exist and each running balance is current.
- Account journal. Open your trust account journal for any 2025 month. Pass: every transaction on that month’s bank statement appears in the journal with date, amount, payee or payor, and client identification.
- Written monthly reconciliations. Pick any month of 2025. Can you produce that month’s written three-way reconciliation within a day? Pass: a dated, retained document exists showing all three balances agreeing, for that month and the eleven others.
- Bank records. Pass: you hold statements and canceled check images for all of 2025 in your own files, not just behind the bank’s online portal, which typically limits history and will not honor a five-year retention duty for you.
- Zero and negative balance scan. List every client ledger balance as of December 31, 2025. Pass: no ledger is negative, and any balance that has sat unchanged for over a year has a documented reason.
- Client notifications. For a sample of 2025 trust deposits, compare the date funds were received against the date the client was notified. Pass: the gap is 14 days or fewer in every sampled case, and you can show both dates.
- Registration and designation match. Compare your My State Bar Profile trust account list against your actual open accounts, confirm each has a designated licensee, and confirm the Notice to Financial Institutions was served. Pass: all three match with nothing missing.
Seven passes means the records a review requests already exist in producible form. Any failure identifies exactly what to fix, and the fix is cheaper now than under a review clock.
If your books are behind: fixing them before a review vs. during one
The State Bar’s own review page makes the economics explicit: poor recordkeeping and slow responses raise the cost and duration of a review. The reviewer bills agreed-upon procedures; every record that has to be requested twice, reconstructed, or explained adds procedures. Most reviews cost $5,000 to $10,000, and the figure climbs for the same reason a clean close costs less than a messy one anywhere in accounting: reconstruction is the expensive part.
The timing difference is just as concrete. Rebuilding a year of client ledgers inside a roughly four-month review window, while responding to a State Bar-approved CPA firm’s document requests, is catch-up work on someone else’s clock. Doing the same rebuild on your own schedule, before a selection notice arrives, is routine bookkeeping.
Mechanically, a legal-specialist bookkeeping engagement does three things. First, it rebuilds per-client ledgers from the bank record: every deposit and disbursement gets matched to a matter, and the running balances get restated. Second, it establishes the monthly three-way cycle going forward, so each month closes with a written reconciliation on file instead of a reconstruction project waiting to happen. Third, it prepares and organizes exactly the records a review requests, in the format the request asks for, so a selection notice triggers an upload rather than a scramble. That is the substance of law firm bookkeeping done to the Rule 1.15 standard rather than to a generic small-business standard.
One boundary matters and should be stated plainly: the duty is the attorney’s and it is non-delegable. A legal bookkeeper maintains the records; the designated licensee supervises the monthly reconciliation and signs the annual certification. Outsourcing the labor does not outsource the responsibility, and any question about how a rule applies to your specific facts routes to your attorney adviser or the State Bar, not to your bookkeeper.
FAQ
What is CTAPP?
The Client Trust Account Protection Program is the State Bar of California’s framework for trust account oversight. It requires attorneys to register trust accounts, complete an annual self-assessment, and certify Rule 1.15 compliance each license renewal, and it authorizes random compliance reviews of selected licensees.
Who gets selected for a CTAPP compliance review, and does selection mean I am suspected of misconduct?
Selection is random under Rule of Court 9.8.5(a)(2)(B) and is not an accusation. The Bar selected 400 attorneys in 2026, up from 100 in 2025, and intends to complete hundreds of reviews annually. The Bar describes education as a primary goal of the program, and most reviews of maintained records end in feedback.
What records does the State Bar require for client trust accounts?
Rule 1.15(d)(3), detailed in the Handbook on Client Trust Accounting, requires a ledger per client or matter, a chronological account journal, bank statements and canceled checks, written monthly reconciliation records, and a journal of other client property, all retained five years after final disbursement.
What is three-way trust reconciliation?
It is the monthly procedure proving three balances agree: the sum of all client ledger balances, the account journal balance, and the adjusted bank statement balance. The Handbook prescribes the three steps and requires a written, retained record of each month’s reconciliation.
How much does a CTAPP compliance review cost?
The licensee pays the State Bar-approved CPA firm directly. The State Bar estimates 20 to 40 CPA hours, with most reviews costing between $5,000 and $10,000, and says poor recordkeeping and slow responses raise the cost, since reconstruction adds billable procedures to the engagement.
Booxmax is an accounting, consulting, and reporting firm, not a CPA firm, and does not prepare income tax returns, represent clients before the IRS, or provide tax, legal, or investment advice.