THE TECHNOLOGY BLIND SPOT

Part 3 of a 3-Part Series: AI-Enabled Money Laundering and the Legal Profession

Five Days

Rachel Dominguez has fourteen all-cash closings on her calendar for March. She handles residential real estate in South Florida, where non-financed transfers to LLCs and trusts make up roughly half her practice. On February 24, she opened the BSA E-Filing portal for the first time. The registration form asked for her employer identification number, her FinCEN ID, and a reporting person category. She had none of these ready.

On March 1, 2026, FinCEN’s Residential Real Estate Rule takes effect. Starting that day, closing attorneys, settlement agents, and title professionals must file reports with the Financial Crimes Enforcement Network for every non-financed transfer of residential real property to a legal entity or trust. The reports require identification of beneficial owners, transaction details, and the source of funds. FinCEN finalized the rule in August 2024, set the original effective date for December 1, 2025, then issued exemptive relief pushing it to March 1, 2026. The delay gave the industry three additional months. Those months are gone.

The rule exists because FinCEN’s own data demonstrated the problem. A Global Financial Integrity study found that 61 percent of federal money laundering cases involving real estate between 2016 and 2021 occurred in counties not covered by FinCEN’s prior Geographic Targeting Orders. Money laundering through residential real estate is a nationwide problem. Jurisdictionally limited reporting proved insufficient to address it.

Part 1 of this series showed how deepfake voice cloning defeated the callback, the profession’s primary trust account verification method. Part 2 mapped how AI-enabled laundering compromises each of Model Rule 1.16’s five risk factors. This final installment applies that framework to four practice areas, examines the ENABLERS Act’s threat to professional self-regulation, and provides an implementation checklist organized by firm size.

The Chasm

The gap between what amended Rule 1.16 requires and what most firms actually do is widest in four practice areas: real estate, corporate entity formation, trusts and estates, and litigation settlements. Each area handles client funds in ways that AI-enabled laundering specifically targets. Each area now faces regulatory pressure that did not exist eighteen months ago. The compliance chasm is not theoretical. It has a deadline.

Real Estate: The First Regulated Practice Area

Real estate attorneys who handle closings involving non-financed transfers to entities or trusts are now FinCEN reporting persons. The rule applies nationwide. It covers all-cash purchases, seller-financed transactions, and deals funded by private lenders not subject to Bank Secrecy Act obligations. Residential property includes single-family homes, townhouses, condominiums, cooperatives, and even vacant land on which the buyer intends to build a one-to-four-family structure.

FinCEN designed a cascading hierarchy to determine who files: the settlement agent listed on the closing statement comes first, followed by the person who prepared the statement, followed by the person who prepared the deed. Attorneys occupy multiple positions in that cascade. A designation agreement allows parties to allocate reporting responsibility, but the obligation itself cannot be delegated away.

I explored the specific data that makes real estate closings vulnerable to wire fraud in “The Two-Dollar Deepfake.” FBI IC3 data from 2024 documented 9,359 real estate fraud complaints with $173.6 million in reported losses, and estimated total losses exceeding $500 million when unreported incidents are included. FinCEN’s new rule adds a federal reporting obligation on top of the state-level ethics duties that amended Rule 1.16 already imposed. A real estate attorney who fails to file the required report faces BSA penalties. A real estate attorney who fails to evaluate the five risk factors from Rule 1.16 faces bar discipline. These are separate obligations with separate enforcement mechanisms, and both apply to the same transaction.

Corporate Entity Formation: The Preferred Entry Point

Treasury’s 2024 National Money Laundering Risk Assessment identified “the misuse of legal entities” as one of five persistent and emerging money laundering risks facing the United States. Shell companies and “the lack of timely access to beneficial ownership information” ranked as “distinct vulnerabilities” in the AML framework. Attorneys who form entities sit at the center of both.

Part 2 documented the economics: a synthetic business costs $150 to create through state registration systems that do not verify identities. An attorney adds a layer of legitimacy that state filings alone cannot provide. A Delaware LLC created by a registered attorney, with articles filed through the attorney’s office and an initial deposit processed through the firm’s trust account, carries an implicit endorsement that no online filing service can match.

Rule 1.16’s fifth risk factor, “the identities of those depositing into or receiving funds from the lawyer’s client trust account,” applies directly to entity formation when the new entity’s initial capitalization flows through the trust account. The retainer-and-return pattern the ABA identified as a red flag takes a specific shape in entity work: a client forms an entity, deposits capitalization funds through the trust account, then requests return of those funds before the entity conducts any business. The formation itself was the laundering mechanism. The legal service provided the clean entry point.

Sumsub’s 2025-2026 Identity Fraud Report categorized professional services, including legal firms, at a 1.6 percent fraud rate across verified transactions. Applied to the volume of entity formations that U.S. law firms process annually, that percentage represents exposure that no individual firm can see from its own intake data alone. “Why Hackers Target Law Firms” examined the data profile that makes firms attractive to attackers. Entity formation work concentrates every element of that profile: trust account access, beneficial ownership information, and the implicit credibility of attorney involvement.

Trusts and Estates: The Opacity Advantage

Treasury’s 2024 National Strategy for Combating Terrorist and Other Illicit Finance stated it directly: the government is working with states to assess “whether new federal legislation is necessary to address the misuse of trusts for money laundering, sanctions evasion, and other crimes.” Treasury did not use conditional language. It identified trusts as a category requiring assessment for potential federal legislation. That assessment is ongoing.

The vulnerability is structural. An irrevocable trust funded with laundered proceeds can hold real estate, financial instruments, and business interests indefinitely. The beneficial owners may be layers removed from the settlor. The trustee may be a professional fiduciary with no knowledge of the funds’ origin. FinCEN’s Residential Real Estate Rule names trusts as transferee structures that trigger reporting obligations, and Rule 1.16’s risk factors reach trusts through the beneficial ownership inquiry. But trusts present a distinctive laundering advantage that neither real estate nor entity formation shares: they can hold assets across generations without the ownership transfers that trigger scrutiny in other vehicles.

Estate planning attorneys face a version of the familiarity problem that Part 2 analyzed. A longstanding client who asks an attorney to create a trust funded by assets the attorney has never seen before, for beneficiaries the attorney has never met, in a jurisdiction the client has no prior connection to, has triggered at least three of the five risk factors. The question is whether the attorney’s existing relationship, Factor Two, creates enough comfort to suppress the inquiry that Factors One, Four, and Five require.

Formal Opinion 513 answered that question. The inquiry obligation applies “throughout the entire representation,” not only at intake. A trust created for a familiar client using unfamiliar assets from an unfamiliar source requires the same risk-based assessment as a new engagement. Familiarity with the client does not satisfy the obligation to evaluate the transaction. Treasury’s willingness to consider federal trust legislation suggests the self-regulatory response has not yet demonstrated sufficiency.

Litigation Settlements: The $1.3 Billion Lesson

In 2016, the Department of Justice filed civil forfeiture complaints identifying five leading U.S. law firms whose IOLTA accounts had been used to launder $1.3 billion in funds stolen from Malaysia’s 1MDB sovereign wealth fund. The firms were not defendants. They were conduits. Their trust accounts moved money that originated in a foreign government corruption scheme, passed through shell companies and offshore accounts, and emerged on the other side bearing the imprimatur of legitimate legal transactions.

The 1MDB case was not an outlier. Treasury’s 2024 National Money Laundering Risk Assessment identified Interest on Lawyers’ Trust Accounts as “an increasingly popular means of legitimizing corrupt payments.” The FFIEC BSA/AML Examination Manual states the vulnerability plainly: banks maintaining IOLTA accounts have “no direct relationship with or knowledge of the beneficial owners” of the funds those accounts hold. FinCEN’s Customer Due Diligence Rule reinforces this gap. For CDD purposes, the lawyer is the bank’s customer. The lawyer’s clients, whose settlement funds, retainers, and transaction proceeds flow through the account, are not.

Settlement disbursements operate in this gap. Funds arrive from one party and are distributed to another, often across multiple accounts and jurisdictions, in amounts that can reach seven and eight figures in commercial litigation, mass tort resolutions, and class action distributions. No external AML reporting requirement applies to these transfers. The attorney handling the disbursement is the only checkpoint between the funds’ origin and their destination.

A Texas attorney was convicted in 2016 for a scheme that exploited this exact structure. The conspirator contacted lawyers, established small IOLTA accounts, deposited forged checks described as proceeds of legal settlements, and then requested that all funds be wired to shell company accounts. The forged settlement documentation provided the cover story. The IOLTA account provided the clean transfer mechanism. William Byrnes, a professor at Texas A&M University School of Law, put it directly: “An attorney’s IOLTA account may be the weak link in a money laundering chain.” When AI can generate the forged settlement documentation, the fabricated wire instructions, and the synthetic identity of the requesting party, as Part 2 documented across all five Rule 1.16 risk factors, the weak link becomes weaker.

“Your AI Tool Doesn’t Keep Secrets” examined how AI tools can expose the communication metadata that makes wire instruction interception possible. The settlement context compounds this risk with urgency: opposing counsel wants the deal closed, the client wants the funds, and the pressure to disburse works against the deliberation Rule 1.16 requires.

The Regulatory Pressure: Self-Regulation or Federal Oversight

Kevin Shepherd, then ABA Treasurer and the association’s representative to the Treasury Department and the FATF, spoke to the House of Delegates before the Rule 1.16 vote in August 2023. His words were specific: “Treasury informed me last Friday that the failure of the ABA to adopt Resolution 100 will cause Treasury to explore every means available in its regulatory toolkit to impose anti-money laundering regulations on the legal profession.”

The ENABLERS Act would do exactly that. The legislation would amend the Bank Secrecy Act’s definition of “financial institution” to include attorneys involved in entity formation, trust services, and financial activity on behalf of clients. Lawyers would file suspicious activity reports with FinCEN. They would be prohibited from disclosing to clients that they had filed those reports. The ABA opposed the legislation, arguing it would undermine attorney-client privilege and the confidentiality protections of Model Rule 1.6.

The ENABLERS Act did not pass in the 117th Congress. It remains available as a legislative template. FinCEN’s Residential Real Estate Rule, which takes effect in five days, represents the incremental approach: regulate specific transaction types in specific practice areas. If that incremental approach proves insufficient against AI-enabled laundering at the scale Chainalysis documented ($154 billion in illicit crypto addresses in 2025 alone), the legislative case for the ENABLERS Act strengthens.

Amended Rule 1.16 is the profession’s answer to Treasury’s ultimatum. It is the self-regulatory alternative to federal reporting requirements. Every attorney who treats the five-factor inquiry as a formality rather than a genuine assessment weakens the case for self-regulation. Every firm that builds a compliance infrastructure that actually addresses AI-enabled threats strengthens it.

The Strongest Objection

Small firms and solo practitioners face a legitimate resource constraint. The compliance infrastructure I describe in this series, sanctions screening APIs, trust account monitoring procedures, independent verification channels, beneficial ownership databases, requires time, money, and technical knowledge that a two-attorney firm handling residential closings may not have.

I take this objection seriously because the regulatory framework itself contributes to it. FinCEN exempts IOLTA accounts from the Customer Due Diligence Rule, treating only the lawyer as the bank’s customer. The FFIEC BSA/AML Manual acknowledges the resulting gap: banks have no direct relationship with the beneficial owners of trust account funds. The compliance burden falls entirely on the attorney, yet the legal technology market has built AI tools for brief-writing, contract review, and document assembly while leaving AML compliance largely unaddressed for small practices. Until affordable, law-firm-calibrated AML tools reach the market, the checklist below prioritizes zero-cost and low-cost measures that require no specialized technology.

The preemptive vulnerability I disclosed in Part 2 applies to this entire series: no bar disciplinary proceeding or court decision has yet tested an attorney’s due diligence under amended Rule 1.16 against AI-specific laundering threats. The framework I present is analytical. It is not precedent. But the threats are documented, the Rule’s text is clear, and the regulatory trajectory is visible. Waiting for the first disciplinary case to define the standard is not a risk management strategy. It is a bet.

Implementation Checklist by Firm Size

Solo and small firms (1-5 attorneys):

Register for FinCEN’s BSA E-Filing system if your practice involves any real estate closings. The reporting obligation takes effect March 1, 2026. Check the Treasury Department’s Specially Designated Nationals list before accepting any new entity client. The list is free, searchable, and updated regularly at ofac.treasury.gov. Establish a written policy requiring independent verification of wire instructions through a channel the requesting party did not initiate. Document your Rule 1.16 risk assessment for every new matter, not just matters that appear high-risk. Call your malpractice insurer and ask what they expect regarding AML compliance. This conversation costs nothing and clarifies your exposure immediately.

Mid-size firms (6-50 attorneys):

Everything above, plus: subscribe to a sanctions screening service (Dow Jones Risk & Compliance, LexisNexis WorldCompliance, and Thomson Reuters World-Check are established options; pricing scales by volume) that checks beneficial owners against the SDN list, FATF high-risk jurisdictions, and politically exposed persons databases. Designate a compliance point person, not necessarily a full-time role, responsible for staying current on FinCEN rules, FATF guidance, and state bar AML developments. Implement trust account monitoring that flags the retainer-and-return pattern, deposits from unverified entities, and disbursements to jurisdictions inconsistent with the representation. Train every attorney whose practice touches entity formation, trust accounts, or real estate closings on the five Rule 1.16 risk factors and what AI-enabled threats look like in each practice area.

Large firms (50+ attorneys):

Everything above, plus: integrate AML screening into your conflicts and intake system so that every new matter triggers an automated check before an engagement letter is sent. Conduct annual training for all attorneys and staff who handle client funds, entity formations, or real estate transactions. Audit trust account activity quarterly against the red-flag patterns identified in this series. Assign a partner-level attorney as the firm’s AML compliance officer with authority to escalate matters and, when necessary, decline or terminate representations. Engage a certified anti-money laundering specialist (CAMS-credentialed professionals or former FinCEN examiners work in this space) to benchmark your compliance infrastructure against the five-factor framework and document the assessment. That documentation is your defense if a bar disciplinary proceeding or malpractice claim questions your firm’s diligence.

The Choice

Kevin Shepherd told the ABA House of Delegates that Treasury would “explore every means available in its regulatory toolkit” if the profession failed to act. The profession acted. It adopted Resolution 100 by a vote of 216 to 102. It amended Rule 1.16. The ABA issued Formal Opinion 513. The framework exists.

FinCEN’s real estate reporting rule takes effect in five days. The ENABLERS Act sits in legislative reserve. Chainalysis documented $154 billion in illicit cryptocurrency activity in 2025. Autonomous AI agents fragment transactions across dozens of jurisdictions while attorneys review intake forms at their desks.

Rachel Dominguez in South Florida has fourteen closings in March. She now knows what FinCEN requires. She registered for BSA E-Filing. She pulled up the SDN list. She wrote a two-page policy for verifying beneficial owners before closing. None of it existed a week ago.

The profession chose self-regulation over federal oversight. That choice is not permanent. It has to be earned, firm by firm, matter by matter, factor by factor. The machine from Part 2 does not sleep. The compliance chasm from this installment does not close by itself. Rachel closed the gap in a week. The question for every attorney reading this is whether they will close it before regulators close it for them.

This blog provides general information for educational purposes only and does not constitute legal advice. Consult qualified counsel for advice on specific situations.

About the Author

JD Morris is Co-Founder and COO of LexAxiom. With over 20 years of enterprise technology experience and credentials including an MLS from Texas A&M, MEng from George Washington University, and dual MBAs from Columbia Business School and Berkeley Haas, JD focuses on the intersection of legal technology, cybersecurity, and professional responsibility.

Connect: LinkedIn | X | Bluesky

References

1. FinCEN, Residential Real Estate Rule (31 CFR 1031.320), finalized August 29, 2024. Effective date delayed from December 1, 2025, to March 1, 2026, per Exemptive Relief Order issued September 30, 2025. https://www.fincen.gov/rre

2. FinCEN, Residential Real Estate Rule Fact Sheet (reporting person cascade, covered transactions, beneficial ownership requirements).

3. Global Financial Integrity, study finding 61% of federal money laundering cases involving real estate (2016-2021) occurred in counties not covered by FinCEN Geographic Targeting Orders.

4. Holland & Knight, “FinCEN Delays Residential Real Estate Transfer Reporting Rule,” October 2025.

5. K&L Gates, “FinCEN’s New Reporting Requirements for Nonfinanced Residential Real Estate Transactions,” May 5, 2025.

6. Bradley Arant, “FinCEN’s New Real Estate Reporting Rule: Historical Context, Compliance Requirements, Legal Challenges,” November 2025.

7. American Bar Association, Revised Resolution 100, Amendments to Model Rule 1.16, adopted August 8, 2023 (216-102 vote).

8. ABA Formal Opinion 513, August 2024 (“reasonable risk-based inquiry” standard; obligation applies “throughout the entire representation”).

9. Kevin Shepherd (ABA Treasurer), remarks to ABA House of Delegates, August 8, 2023, quoted in ABA Journal and Ballard Spahr LLP (Money Laundering Watch).

10. ENABLERS Act (H.R. 5525, 117th Congress), proposing to amend Bank Secrecy Act definition of “financial institution” to include attorneys involved in entity formation, trust services, and financial activity.

11. ABA Governmental Affairs Office, letters opposing ENABLERS Act amendment to FY 2023 NDAA (July and October 2022).

12. ICIJ, “House committee advances ‘once in a generation’ crackdown on enablers of financial crime,” June 29, 2022.

13. Chainalysis, 2026 Crypto Crime Report Introduction, January 8, 2026 ($154 billion illicit crypto addresses in 2025, 162% YoY increase).

14. Sumsub, Identity Fraud Report 2025-2026 (professional services fraud rate at 1.6% across verified transactions).

15. FBI IC3, 2024 Internet Crime Report (9,359 real estate fraud complaints, $173.6 million reported losses, estimated $500 million total).

16. La Marca, Andrew (Dun & Bradstreet), quoted in GovInfoSecurity, December 9, 2025 ($150 synthetic business creation cost).

17. DOJ, civil forfeiture complaints in United States v. Certain Rights to and Interests in the Viceroy Hotel Group, et al. (1MDB), identifying five U.S. law firms’ IOLTA accounts used to move $1.3 billion in stolen funds (2016).

18. Washington Legal Foundation, summary of 2024 NMLRA: ‘specifically calls out Interest on Lawyers Trust Accounts (IOLTAs) as an increasingly popular means of legitimizing corrupt payments,’ December 9, 2025.

19. FFIEC BSA/AML Examination Manual, ‘Risks Associated with Money Laundering and Terrorist Financing: Professional Service Providers’ (banks have ‘no direct relationship with or knowledge of the beneficial owners’ of IOLTA accounts).

20. FinCEN Customer Due Diligence Rule: IOLTA accounts exempt; lawyer treated as customer, not underlying clients (Sia Partners analysis).

21. Byrnes, William (Texas A&M University School of Law), quoted in ABA Journal: ‘An attorney’s IOLTA account may be the weak link in a money laundering chain.’

22. ABA Journal, ‘Lawyer gets prison time for using trust accounts to transfer $12 million in client cash’ (San Diego attorney Medina conviction).

23. NICE Actimize, ‘Where Attorneys Connect to Money Laundering Typologies,’ June 20, 2025 (Texas attorney 2016 IOLTA conviction; forged settlement proceeds deposited into IOLTA accounts).

24. U.S. Department of the Treasury, 2024 National Strategy for Combating Terrorist and Other Illicit Finance (assessing ‘whether new federal legislation is necessary to address the misuse of trusts for money laundering’).

25. Morris Legal Technology Blog, “The Two-Dollar Deepfake” (Part 1 of this series).

26. Morris Legal Technology Blog, “The Machine That Never Sleeps” (Part 2 of this series).

27. Morris Legal Technology Blog, “Your AI Tool Doesn’t Keep Secrets” (prior series entry on AI data exposure).

28. Morris Legal Technology Blog, “Why Hackers Target Law Firms” (prior series entry on law firm attack surfaces).