Your Law Firm Runs a Treasury Function It Never Staffed: Why 2026's Money-Movement Volume Has Outgrown the Controls Most Firms Actually Have

Between trust deposits, government filing fees, settlement disbursements, lien payoffs, vendor advances, and client card payments, a mid-market law firm now moves more money in a year than many community businesses โ€” with none of the treasury controls a business that size would be expected to have. The gap is no longer a compliance risk. It is an operating risk.

Published: 2026-09-07T19:02:17.095Z ยท Category: Legal Technology ยท 9 min read

Your Law Firm Runs a Treasury Function It Never Staffed: Why 2026's Money-Movement Volume Has Outgrown the Controls Most Firms Actually Have
๐Ÿ’ก IN SHORT
Law firms have quietly become high-volume money-movement businesses โ€” holding client funds, advancing costs, paying government fees, disbursing settlements, and satisfying liens โ€” while their financial controls still assume a practice that occasionally writes a check. In 2026, rising government fees, faster payment rails, and increasingly sophisticated payment fraud have made that mismatch structural. The fix is not more approvals in email; it is treating disbursement as a controlled workflow inside the system of record.
๐Ÿ‘ฅ Who should read this: Managing Partners Controllers & CFOs Firm Administrators Risk & Compliance

๐Ÿฆ The Business Inside Your Business

Think about what actually flows through a mid-market firm in a year.

Client retainers arrive and sit in trust. Government filing fees go out โ€” and in immigration and corporate practice, those fees have risen sharply enough in 2026 to change the size of the flow, not just its cost. Expert witnesses, court reporters, medical records vendors, and process servers are paid on advance. Settlements arrive, sit while liens resolve, and disburse to three or four parties. Earned fees move from trust to operating. Clients pay by card and ACH through a portal. Vendors are paid by check, ACH, and wire.

A firm with fifty people can easily move eight figures a year across those channels. A business of comparable size in any other industry would have a treasury function: segregation of duties, dual authorization above a threshold, positive pay on its check stock, callback verification for payment instruction changes, and a daily reconciliation cadence.

Most law firms have a bookkeeper, a partner who signs things, and a shared inbox.

๐Ÿ“Š Did You Know?
The controls that professional treasury functions rely on are not expensive or exotic. Dual authorization, payee verification, and separation of the person who creates a payment from the person who releases it are standard practice at businesses a fraction of a law firm's transaction volume โ€” and they are the specific controls that stop the fraud patterns firms actually experience.

๐Ÿ“ˆ Three Things Changed at Once

1๏ธโƒฃ The dollar volume went up without the headcount

Government fee increases, higher expert and e-discovery costs, and larger settlements have all pushed more money through the same back office. The pass-through nature of much of it makes the growth invisible in revenue reporting โ€” a firm can double the money it handles without the P&L moving much at all.

2๏ธโƒฃ Payments got faster and less reversible

Instant and same-day rails are convenient right up until a payment goes to the wrong account. The window in which a mistaken or fraudulent transfer can be recalled has narrowed considerably, which shifts the entire value of controls from detection to prevention.

3๏ธโƒฃ Fraud got specific to law firms

Payment fraud aimed at law firms is no longer generic phishing. It targets the moments where a firm is known to move large sums to parties it has not paid before: a settlement disbursement, a real estate closing, a lien payoff, a new expert vendor. The attacker's job is to change one set of banking instructions at exactly that moment โ€” and the firm's job is to have a control that makes changed instructions a stop, not a formality.

๐Ÿšซ Red Flag
If a change to a payee's bank details can be made by anyone who can edit a vendor or client record, and the change takes effect on the next payment run without a second person confirming it out of band, your firm's largest financial exposure is a single compromised email account.

๐Ÿงฑ What a Law Firm Treasury Function Actually Looks Like

The point is not to hire a treasurer. It is to encode treasury behavior into the workflow, so the controls apply whether or not anyone is thinking about them that day.

๐Ÿ‘ฅ

Separation of Duties

The person who enters a payment is not the person who approves it and not the person who releases it โ€” enforced by role, not by habit.

โœ…

Threshold-Based Approval

Payments above a defined amount require a second authorizer; trust disbursements require it regardless of amount.

๐Ÿ”

Payee Detail Change Control

Any change to banking instructions triggers a hold and an out-of-band verification before the next payment can be released.

๐Ÿ’ง

Cleared-Funds Enforcement

No disbursement against a trust deposit that has not cleared โ€” the control that prevents the most common inadvertent violation.

๐Ÿ”

Duplicate Payment Detection

Automatic flagging of same-vendor, same-amount, same-window payments before the run is released.

๐Ÿ“†

Reconciliation Cadence

Daily or weekly bank matching rather than monthly, so an anomaly surfaces in days rather than at close.

๐Ÿ”Ž The Test That Reveals Where You Stand

Pick the last five disbursements over your firm's informal "large payment" threshold. For each one, answer without asking anyone:

  1. Who created the payment, and who released it? Were they different people?
  2. What evidence exists that the payee's banking details were verified?
  3. If the payment came from trust, what confirms the client's ledger had cleared funds at that moment?
  4. How many days elapsed between the payment and the reconciliation that would have caught an error?

A firm that can answer all four from the system, for all five payments, has a treasury function. A firm that has to reconstruct the answers from email has a habit.

โš ๏ธ Watch Out
Controls that live outside the system of record decay silently. A written policy requiring dual approval is honored during a normal week and abandoned during a closing week โ€” which is exactly when the payments are largest and the attacker is most likely to be watching.

โš™๏ธ Why This Belongs in the Platform, Not Beside It

Every one of the controls above depends on the payment, the matter, the client ledger, and the approval sitting in the same system. Cleared-funds enforcement requires the disbursement workflow to see the trust ledger in real time. Duplicate detection requires payment history. Separation of duties requires roles that mean something across both the practice and the books.

This is where the architectural question stops being philosophical. In a stack where practice management holds the matter and a separate accounting product holds the money, the control has to be reimplemented on the accounting side with information it receives on a delay โ€” which is why so many firms end up enforcing the important controls manually.

LawAccounting handles disbursement as a controlled workflow: approval routing on vendor bills and expenses, matter-linked accounts payable, check printing and payment runs that cannot cross the trust and operating boundary, cleared-funds controls on trust disbursement, real-time compliance alerts for overdrafts and negative client ledgers, and AI-assisted bank reconciliation across 15,000+ institutions so the matching cadence can be weekly rather than monthly. Inside CaseQube, those controls inherit Salesforce role-based permissions and a complete audit trail, so who did what โ€” and who was allowed to โ€” is a query rather than an investigation.

Every firm eventually gets asked to explain a payment. The only question is whether the explanation is a report or a reconstruction.
๐Ÿ’ก Pro Tip
Start with one control, not six. Payee banking-detail change verification stops the highest-severity loss for the least operational friction, and it can be implemented this month regardless of what system you are on. Add threshold-based dual authorization next.

๐Ÿงญ Where This Goes

The direction of travel is clear enough. State compliance programs are asking firms to certify their trust practices rather than simply follow them. Malpractice carriers are asking about payment controls at renewal. Clients โ€” particularly institutional ones โ€” are asking about them in outside counsel guidelines. Each of those is a request for evidence, and evidence is a property of systems, not of intentions.

Firms that treat money movement as a first-class operational function will find those requests routine. Firms that continue to treat it as bookkeeping will find them expensive.

โœ… Key Takeaways
  1. Mid-market law firms now move money at a volume that would warrant a treasury function in any other industry, largely through pass-through flows invisible in revenue reporting.
  2. Faster, less reversible payment rails have shifted the value of controls from detection to prevention.
  3. Payment fraud aimed at law firms targets specific moments โ€” settlements, closings, lien payoffs, new vendors โ€” where large sums go to unfamiliar accounts.
  4. Six controls cover most of the exposure: separation of duties, threshold approval, payee change verification, cleared-funds enforcement, duplicate detection, and a shorter reconciliation cadence.
  5. Controls enforced outside the system of record decay exactly when transaction volume peaks; controls built into the disbursement workflow do not.
  6. Start with payee banking-detail change verification โ€” highest severity prevented, lowest friction added.

Build the Controls Into the Workflow

See how CaseQube and LawAccounting enforce approval routing, cleared-funds checks, trust and operating separation, duplicate detection, and real-time compliance alerts on every dollar your firm moves.

Schedule Your Demo โ†’

Related Articles

โ† Back to Blog