KYC for US Lawyers: AML & Verification

Lawyers in the United States occupy a unique position in the anti-money laundering (AML) landscape. Unlike most developed nations, the US has not yet imposed comprehensive, legally binding AML obligations on attorneys through the Bank Secrecy Act (BSA). However, lawyers face significant exposure to money laundering risk through the transactions they facilitate, and multiple overlapping obligations — from the American Bar Association (ABA) Model Rules of Professional Conduct to FinCEN's proposed regulations and the Corporate Transparency Act (CTA) — create a de facto KYC framework that prudent law firms must follow. This guide sets out the current AML landscape for US lawyers, the client verification process, and the consequences of non-compliance.

This article is for informational purposes only and does not constitute legal, financial, or regulatory advice. Consult a qualified compliance attorney for guidance specific to your situation.

KYC obligations for US lawyers — what the law and ethics rules require

US lawyers are subject to AML-related obligations through several parallel regimes: FinCEN regulations and proposed rules, the ABA Model Rules of Professional Conduct (adopted with variations by all 50 state bars), the Corporate Transparency Act, and federal criminal statutes including the Money Laundering Control Act, 18 U.S.C. § 1956 and the USA PATRIOT Act, Title III.

The ABA Standing Committee on Ethics and Professional Responsibility has issued formal opinions recognizing lawyers' vulnerability to being used as unwitting facilitators of money laundering. ABA Formal Opinion 463 (2013) provides detailed guidance on lawyers' obligations when handling client funds, and ABA Formal Opinion 491 (2020) addresses obligations regarding client trust accounts and suspicious activity.

Which activities create AML exposure

While the BSA does not currently classify lawyers as "financial institutions" subject to mandatory AML programs, certain legal activities carry significant money laundering risk and trigger obligations under other laws.

High-risk activities:

• Buying, selling, or transferring real property — lawyers acting as settlement agents may fall under FinCEN's Real Estate Geographic Targeting Orders (GTOs) and proposed real estate reporting rules.
• Managing client funds through IOLTA (Interest on Lawyers' Trust Accounts) and escrow accounts.
• Creating, operating, or managing companies, LLCs, trusts, or foundations — directly implicated by the Corporate Transparency Act's beneficial ownership reporting requirements.
• Acting as a registered agent or nominee director.
• Tax advisory services (outside litigation).
• Financial or investment advice connected to the above activities.

Lower-risk activities:

• Litigation and dispute resolution.
• Criminal defense.
• Employment law advice (not involving financial structuring).
• Family law matters not involving significant financial arrangements.
• General legal advice that does not involve the high-risk activities listed above.

The three tiers of client due diligence

Prudent US law firms adopt a risk-based approach to client due diligence, mirroring international standards even where not strictly mandated by statute:

Standard CDD. Identify the client (and any beneficial owner), verify identity using reliable sources, and understand the purpose and intended nature of the business relationship. The ABA's Formal Opinion 463 recommends that lawyers perform basic due diligence on all clients.

Simplified CDD. Appropriate for clearly low-risk engagements — for example, a publicly listed company or a government entity retaining the firm for routine corporate work.

Enhanced CDD. Required as a matter of risk management for politically exposed persons (PEPs), clients connected to high-risk jurisdictions identified by the FATF, complex multi-jurisdictional transactions, or clients requesting unusual financial structuring.

Attorney-client privilege vs AML reporting — the tension

Attorney-client privilege is a foundational legal principle recognized across all US jurisdictions and protected by the Sixth Amendment in criminal cases. It protects confidential communications between a lawyer and client made for the purpose of obtaining or providing legal advice. The tension with potential AML reporting obligations is not theoretical — it arises regularly in practice and is the central reason why the US has resisted imposing SAR-filing obligations on lawyers.

Table: which activities create AML exposure and which are protected

The crime-fraud exception

Attorney-client privilege does not protect communications made in furtherance of a crime or fraud. Under the crime-fraud exception — recognized in Clark v. United States, 289 U.S. 1 (1933) and its progeny — if a client seeks legal services to facilitate money laundering, tax evasion, or other criminal conduct, the privilege is pierced. The lawyer cannot invoke privilege to shield those communications from disclosure.

In practice, this means:

• A lawyer assisting with a real estate closing who discovers that the purchase price is funded by criminal proceeds cannot claim privilege over the transaction-related communications, and faces criminal exposure under 18 U.S.C. § 1956 if they proceed.
• A criminal defense attorney who learns of potential money laundering through the defense case generally retains privilege protection, provided the information was communicated for the purpose of obtaining legal advice about the defense.

FinCEN's proposed rulemaking on attorneys

FinCEN has periodically proposed extending BSA requirements to lawyers, particularly those involved in real estate transactions and company formation. While no final rule has been adopted as of March 2026, the FATF's 2016 Mutual Evaluation of the United States specifically identified the lack of AML obligations for lawyers as a significant gap. The ABA has vigorously opposed mandatory SAR filing for attorneys, citing privilege concerns, but the regulatory trajectory suggests some form of reporting obligation may be imposed in the coming years.

Client verification process — step-by-step workflow

A structured CDD process reduces both compliance risk and the time spent on manual checks.

Step 1: determine whether the engagement involves high-risk activities

Before any verification, the firm must assess whether the proposed work falls into one of the high-risk categories identified above. If the work is purely contentious, the AML risk is low and minimal verification may suffice. If the engagement involves real estate, company formation, trust work, or significant fund movements, comprehensive CDD is warranted.

Step 2: identify the client and beneficial owner

For individuals, collect full name, date of birth, residential address, and Social Security Number (SSN) or Individual Taxpayer Identification Number (ITIN). For entity clients, obtain the legal name, state of formation, registered agent, Employer Identification Number (EIN), and the identity of all beneficial owners holding 25% or more of the equity interests. Under the Corporate Transparency Act, most companies and LLCs must report beneficial ownership information to FinCEN, and lawyers can verify this information against the FinCEN BOI registry.

Step 3: verify identity

Verification must be based on documents, data, or information from a reliable and independent source:

• Individuals. Current US passport, driver's license, or state-issued ID, supplemented by a utility bill or bank statement (dated within 3 months) for address verification.
• Companies. Certificate of Good Standing or Articles of Incorporation from the Secretary of State, operating agreement or bylaws, and FinCEN BOI filing confirmation.
• Trusts. Trust agreement, identification of all trustees and beneficiaries, and a structure chart where relevant.

Automated document validation reduces verification time from 30-45 minutes per client to under 5 minutes, while flagging inconsistencies that manual review might miss.

Step 4: assess risk and apply proportionate measures

Apply the firm's risk assessment framework, considering:

Step 5: ongoing monitoring and record retention

CDD is not a one-off exercise. Firms should monitor the business relationship on an ongoing basis and update verification records when circumstances change. All CDD records should be retained for at least 5 years from the end of the client relationship. For matters involving real estate transactions subject to FinCEN GTOs, records must be retained for 5 years from the date of the transaction.

Sanctions and penalties for non-compliance

Non-compliance with AML-related obligations carries significant consequences for US lawyers, ranging from state bar discipline to federal criminal prosecution.

State bar enforcement

State bar associations have the authority to discipline attorneys for violations of professional conduct rules. The ABA Model Rules — particularly Rules 1.2(d) (assisting criminal conduct), 1.6 (confidentiality), and 1.15 (safekeeping property) — provide the basis for disciplinary action. Penalties range from private reprimand to suspension and disbarment. State bars have increasingly focused on IOLTA compliance and trust account irregularities as indicators of potential AML failures.

Federal criminal penalties

Lawyers who facilitate money laundering face prosecution under 18 U.S.C. § 1956 (money laundering) and 18 U.S.C. § 1957 (engaging in monetary transactions in property derived from specified unlawful activity). Penalties include up to 20 years' imprisonment and fines of up to $500,000 or twice the amount of the transaction. The DOJ's Money Laundering and Asset Recovery Section (MLARS) has prosecuted attorneys in multiple high-profile cases.

Form 8300 penalties

Lawyers who receive more than $10,000 in cash in a single transaction or related transactions must file Form 8300 with the IRS and FinCEN. Willful failure to file carries penalties of up to $250,000 and 5 years' imprisonment. Even non-willful failures can result in civil penalties of up to $310 per return (adjusted annually for inflation).

Corporate Transparency Act obligations

Lawyers who assist with company formation must ensure clients understand their beneficial ownership reporting obligations under the CTA. While the CTA does not impose direct reporting obligations on attorneys, a lawyer who knowingly helps a client evade BOI reporting requirements could face criminal penalties under 31 U.S.C. § 5336(h) — up to 2 years' imprisonment and fines of up to $10,000.

Reputational consequences

State bar disciplinary decisions are public records. A firm found to have facilitated money laundering or failed in its client verification duties faces not only formal sanctions but lasting damage to its market position, client relationships, and ability to attract talent.

Automating KYC while preserving attorney-client privilege

Automation addresses both the efficiency challenge and the compliance challenge, provided the chosen tool respects the boundaries of attorney-client privilege.

What a law firm needs from a KYC tool

• Data compartmentalization. CDD data must be segregated from the legal file. No information from privileged communications should be accessible to the verification system.
• US data residency. Client data must be hosted within a jurisdiction that meets applicable privacy requirements, including state privacy laws such as the CCPA and emerging state data protection statutes.
• Full audit trail. Every verification step must be timestamped and logged, producing an evidence file that satisfies state bar inspection requirements and any FinCEN examination.
• Sanctions and PEP screening. Real-time checks against OFAC SDN list, FinCEN alerts, and international PEP databases.

CheckFile.ai provides automated document validation with secure hosting, native file compartmentalization, and a complete audit trail. View our pricing for a solution scaled to your firm's volume.

For a detailed look at automating KYC in law firms while protecting privilege, read our companion guide on law firm KYC automation and client privilege. You can also explore our industry verification guide for a cross-sector comparison of AML obligations.

The business case

A mid-sized firm onboarding 150 new matters per month spends an estimated 75 to 110 hours on manual CDD. Automated verification reduces this by 70-80%, freeing attorneys for billable work. Flexible financing and leasing options allow firms to implement without a large upfront outlay.

Our data from over 180,000 documents processed monthly across regulated sectors shows a 94.8% fraud detection rate and an average verification time of 4.2 seconds. For a comprehensive overview, see our industry document verification guide.

Take action

CheckFile verifies 180,000 documents per month with 98.7% OCR accuracy. Test the platform with your own documents — results within 48h.

Request a free pilot

---

Frequently Asked Questions

Are US lawyers legally required to file SARs like banks?

No — as of March 2026, the BSA does not classify lawyers as "financial institutions" subject to mandatory SAR filing. However, lawyers must file Form 8300 for cash receipts over $10,000, and FinCEN has proposed extending AML obligations to lawyers involved in real estate and company formation. The FATF has identified this gap as a significant weakness in the US AML framework, and regulatory change is widely anticipated.

What is the difference between attorney-client privilege and work product doctrine?

Attorney-client privilege protects confidential communications between lawyer and client made for the purpose of obtaining legal advice. Work product doctrine, established in Hickman v. Taylor, 329 U.S. 495 (1947), protects documents and tangible things prepared by a lawyer in anticipation of litigation. Both protections can be pierced by the crime-fraud exception if the client uses legal services to facilitate criminal activity.

How long must client verification records be kept?

While no federal statute mandates a specific retention period for lawyer CDD records, best practice — aligned with BSA standards and state bar guidance — is a minimum of 5 years from the date the client relationship ends. For matters involving Form 8300 filings, the IRS requires record retention for 5 years. State bar rules on file retention vary but generally require 5 to 7 years.

Does the Corporate Transparency Act affect lawyers?

Yes, significantly. Lawyers who assist with entity formation must advise clients of their beneficial ownership reporting obligations under the CTA. Lawyers may also be designated as "company applicants" — the person who files the formation document — requiring their own information to be reported to FinCEN. Failure to advise clients of CTA obligations could constitute a breach of the duty of competence under ABA Model Rule 1.1.

What happens if a law firm has no AML risk assessment in place?

While not legally mandated for most law firms, the absence of any AML risk assessment creates significant exposure. The ABA's Formal Opinions 463 and 491 establish clear expectations. A firm handling high-risk transactional work without documented risk assessment procedures may face state bar discipline, malpractice liability, and — in the worst case — criminal prosecution if the firm is used to facilitate money laundering.

Strengthen your firm's AML compliance

AML compliance is both a professional obligation and a mark of credibility. Automating client verification with a tool designed for the legal sector saves time, reduces error rates, and produces the audit trail that regulators and state bars expect. Contact us for a demonstration tailored to your firm's requirements.