CPA trust account requirements center on one idea: money a client hands a CPA for taxes, escrow, retainers, or third-party payments stays legally the client’s, and it has to sit in a separately titled fiduciary account that never mixes with the firm’s own funds. Every other rule that follows, from how the account is titled to how it is reconciled to how leftover balances are eventually turned over to the state, exists to keep that separation intact and provable.
What Counts as a Trust Account
A CPA trust account is a bank account used exclusively to hold money that belongs to clients. State boards of accountancy require the separation whenever a CPA holds client money, and the AICPA Code of Professional Conduct backs it up through the Acts Discreditable Rule, which covers custody of client assets and bars using them for any purpose other than the client’s benefit.
Mixing client money with the firm’s operating money is commingling. Boards treat it as a serious ethical violation regardless of intent, and they do not need to prove the client was harmed to bring a case. Borrowing from the account and replacing the money later is treated the same as outright theft for disciplinary purposes. Separation also shields client money from the firm’s creditors: funds in the operating account are fair game in a lawsuit or bankruptcy, funds in a properly titled trust account are not.
Titling the Account and Choosing the Bank
The account has to be titled so its fiduciary nature is obvious on the face of the bank documents. Common designations are “Client Trust Account,” “Client Funds Account,” or “Escrow Account,” with the CPA firm identified as fiduciary or custodian rather than owner. That naming puts both the bank and any future creditor on notice that the money inside is not the firm’s.
Many state boards require the bank to agree in writing that it will not exercise a right of setoff against the trust account for debts the firm owes on other accounts. Without that agreement, a bank could theoretically sweep client funds to cover a firm’s overdue line of credit. Overdraft protection, lines of credit, and similar features should never be attached to the account, because they effectively create a personal loan secured by client money. Some states require the bank to notify the board directly if the trust account is ever overdrawn, since even a momentary negative balance signals that either a disbursement exceeded the balance or the reconciliation has broken down.
Who Can Sign, and Who Reconciles
The person authorized to sign checks or approve transfers should not be the same person who reconciles the account or processes incoming payments. That separation of duties is the single most effective internal control against both honest errors and embezzlement. In small firms where full separation is not practical, requiring dual signatures on disbursements above a set threshold, such as $5,000 or $10,000, offers a workable substitute. A firm principal should keep ultimate disbursement authority and personally review the monthly reconciliation even when someone else prepares it.
Handling Deposits and Disbursements
Client funds have to be deposited promptly after receipt. Most state boards define “promptly” as one to three business days, though the exact window varies. Every deposit needs documentation identifying which client the money belongs to and what it is for. A check that arrives without a clear purpose should be clarified before deposit, not guessed at.
Disbursements may only go toward the client’s benefit: payments to taxing authorities, distributions to third parties, refunds of unearned retainers, and similar purposes. One client’s funds can never cover another client’s obligations, even briefly. Each transaction has to trace back to a specific client, and the CPA must be able to reconstruct the complete history of any client’s money on demand.
Moving earned fees from the trust account to the operating account follows a fixed sequence. The fees must actually be earned under the engagement letter, the client must be billed, and the authorization must be documented before the money moves. Pulling fees out before they are earned is conversion even if the CPA plans to do the work the following week. When in doubt, the money stays in the trust account until the work is done and the invoice is sent.
The trust account cannot be used to pay firm expenses like rent, payroll, or utilities. If the bank charges service fees to the account, the firm reimburses those fees immediately from its operating account so no client’s balance is reduced by the firm’s banking costs.
Interest on Client Balances
Interest earned on trust balances belongs to the client, not the CPA. When a CPA holds a substantial sum for a single client over an extended period, that money generally belongs in a separate interest-bearing account with the interest credited to the client. For smaller or short-term balances pooled across multiple clients, treatment depends on state law and the terms of the engagement letter; some states have specific rules, others leave it to the engagement agreement.
IOLTA programs, which route interest from pooled trust accounts to state legal aid foundations, are designed for attorneys. CPAs should not assume IOLTA rules apply to their accounts. Whatever the arrangement, the engagement letter should spell out how interest will be handled before any money changes hands.
Records and Monthly Reconciliation
The account only works if the records behind it are meticulous. A CPA must keep bank statements, deposit slips, disbursement records, and written client authorization for every transaction. Every client with money in the account needs a separate ledger showing each deposit, each disbursement, and the running balance for that client’s matter.
Retention periods are set by each state board and vary. Some states require as few as three or four years; others require longer. The seven-year retention figure sometimes cited in this context actually comes from an SEC regulation covering audit documentation for public companies, which is a different obligation. Check the specific state board requirement, and when in doubt, keep records longer rather than shorter.
The Three-Way Reconciliation
Once a month, three figures have to be compared and agree:
- The bank statement balance, adjusted for outstanding checks and deposits in transit.
- The firm’s general ledger balance for the trust account.
- The sum of every individual client ledger.
When all three match, no client’s money has been misapplied. When they do not, something has gone wrong and needs to be found immediately, whether a data entry error or an unauthorized disbursement. The reconciliation catches problems within weeks instead of letting them compound over months. Whoever performs it should not be the person handling day-to-day deposits and disbursements, or at minimum a firm principal who was not involved in the month’s transactions should review it.
FDIC Pass-Through Insurance
A trust account holding funds for multiple clients can qualify for FDIC pass-through insurance, meaning each client’s share is insured up to $250,000 individually rather than the whole account sharing a single $250,000 cap. 1FDIC.gov. Understanding Deposit Insurance The difference matters during tax season and any time large escrow balances are involved.
Pass-through coverage requires specific record-keeping. The fiduciary relationship must be expressly disclosed in the bank’s deposit account records, and the identity and interest of each beneficial owner must be ascertainable either from the bank’s records or from records the CPA maintains in good faith in the regular course of business. 2eCFR. 12 CFR Part 330 – Deposit Insurance Coverage If those records cannot establish individual ownership, the FDIC treats the whole account as belonging to the CPA firm and applies the $250,000 limit to the entire balance. 3FDIC.gov. Pass-Through Deposit Insurance Coverage Accurate client ledgers are what stand between full per-client coverage and a single shared cap.
Electronic Payments and Fraud Controls
Most trust account transactions now move electronically. As of 2026, any business sending payments through the ACH network must have documented, risk-based procedures for detecting and preventing fraudulent transactions. The requirement applies to all corporate end users regardless of volume, with full compliance required by June 2026. 4Nacha. The New Nacha Rules: New Fraud Compliance Responsibilities for All Organizations Sending ACH Payments A firm’s plan should cover what to do when someone requests a change to payment information (a common vector for business email compromise), how to detect and recover from fraudulent transactions that slip through, and how to spot similar attempts afterward. Noncompliance can bring fines and liability for fraud losses.
Basic controls apply with extra force here: multi-factor authentication on all banking access, callback verification for wire requests, and tight limits on who holds online banking credentials. The duty to safeguard client assets has no negligence exception, so a CPA who loses client funds to a phishing attack faces the same disciplinary exposure as one who deliberately misused the money.
Dormant Balances and Escheatment
Sometimes client funds sit in the trust account long after the engagement ends. A client moves without a forwarding address, stops responding, or forgets about a small balance. That money does not belong to the CPA, and it cannot stay in the account forever.
Every state has unclaimed property laws requiring holders of dormant funds to turn them over to the state after a set dormancy period. For most financial accounts, the period runs three to five years, with five years the most common for trust-type accounts. The CPA has to make a good-faith effort to contact the client before the dormancy period expires, following the state’s specific notice procedures. Once the period passes without a claim, the CPA reports and remits the balance to the state’s unclaimed property division. The client can still recover the money from the state later. Failing to comply with escheatment carries penalties separate from any state board discipline.
State Board Oversight and Penalties
State boards of accountancy enforce these rules and have broad authority to investigate, audit, and discipline. Many boards require CPAs with trust accounts to file periodic reports confirming the account’s existence and attesting to compliance, and some require notification when a new trust account is opened. Boards can conduct random or targeted reviews, and during a review the CPA must produce the complete file: bank statements, client ledgers, monthly reconciliations, and authorization documentation. Missing or incomplete records are treated nearly as seriously as actual misuse, because if the handling cannot be proven correct, the board has no reason to assume it was.
What the Penalties Look Like
For fiscal dishonesty or breach of fiduciary responsibility, sanctions range from a stayed revocation with suspension and multi-year probation at the low end to permanent license revocation at the high end. Individual CPAs may face administrative fines reaching tens of thousands of dollars per violation, and in some states firms can face penalties of up to $1 million or more for serious breaches. As a condition of probation, a CPA may be prohibited from handling any client funds at all.
Criminal prosecution is the other track. Misappropriating client funds is a crime, and federal prosecutors have secured multi-year prison sentences against CPAs who stole from trust accounts. In one case, a Tennessee CPA received a nine-year federal prison sentence and was ordered to pay roughly $4.5 million in restitution after stealing from client accounts and filing false tax returns. 5IRS.gov. Franklin CPA Sentenced to Nine Years in Prison for Stealing Clients Funds and Tax Fraud State boards can also refer cases to local prosecutors for charges under state law.
Closing the Account
When a CPA retires, closes a practice, or stops handling client funds, the account is wound down through a formal process. Every remaining balance is disbursed to the rightful owner or transferred to a designated successor. Each final disbursement is documented, the account balance is confirmed at zero, and the state board is notified that the account has been closed and all client obligations satisfied. Closing the account without properly returning client funds is itself a violation. If a client cannot be located, the balance goes through the state’s unclaimed property process rather than back to the firm.