On July 15, 2026, São Paulo’s Interinstitutional Asset Recovery Committee (Cira/SP) launched Operation “Distrato” exposing a billion-dollar scheme involving fake ICMS (state VAT) tax credits: 752 São Paulo-based companies allegedly used fraudulent tax credits — linked to defunct, bankrupt, or economically hollow shell entities — to improperly offset taxes, causing an estimated R$3.8 billion loss to public coffers. Agents executed 38 search and seizure warrants across São Paulo and Paraná, and one of the operation’s most sensitive details is that part of them targeted law firms that marketed the fraudulent credits as “legitimate tax planning.”
The involvement of law firms in Operation Distrato revives, in Brazil, a debate the world has been having for more than two decades: to what extent should lawyers and law firms be subject to anti-money laundering and counter-terrorist financing (AML/CFT) obligations, and where does that duty end and constitutionally protected professional secrecy begin. The Financial Action Task Force (FATF/GAFI) was the first body to formally treat lawyers, notaries, accountants, and company-service providers as “gatekeepers” — guardians of the financial system who, by structuring transactions, forming companies, and managing client funds, can be used, wittingly or unwittingly, to launder illicit assets. FATF Recommendations 22 and 23 require these professionals to apply customer due diligence and, in defined circumstances, to report suspicious transactions to financial intelligence units — except where the information is protected by professional secrecy or legal privilege, when obtained while ascertaining a client’s legal position or defending them in judicial proceedings. FATF detailed these criteria in its “Guidance for a Risk-Based Approach for Legal Professionals” (2019) and revisited the topic after the Panama Papers and Pandora Papers, which exposed how offshore firms and “professional enablers” facilitated asset-concealment structures on a global scale.
Within that same international architecture, ACAMS (the Association of Certified Anti-Money Laundering Specialists), the world’s largest AML/CFT certifying body, now offers dedicated training for lawyers (“AML General Awareness for Law Professionals“) and has been reporting on the ongoing US regulatory impasse over whether the legal profession should be brought under the Bank Secrecy Act. IOSCO (the International Organization of Securities Commissions), which brings together the world’s securities regulators and is an institutional partner of the FATF, addresses the issue through the lens of capital markets: while it does not directly regulate lawyers, it has flagged the role of professional “gatekeepers” — including legal advisers — in structuring transactions that can facilitate money laundering through financial markets and investment vehicles. The BIS (Bank for International Settlements), the central bank for central banks and host to forums such as the Basel Committee and the Financial Stability Board, regularly publishes analysis on how AML/CFT regulation affects financial intermediation — including the phenomenon of bank de-risking — and stresses in its bulletins that the effectiveness of the fight against money laundering depends on covering the entire gatekeeper chain, not only already-regulated financial institutions.
The European Union has taken the strictest approach for the longest time: lawyers were formally brought into the AML/CFT regime as early as the 2nd Anti-Money Laundering Directive (2001), when they act in company formation, management of client assets, or real estate and financial transactions — while preserving an exception for judicial representation and legal advice in the strict sense. The new EU package — the AMLD6 directive, the AMLR regulation, and the creation of the EU Anti-Money Laundering Authority (AMLA), fully applicable from July 2027 with AMLA operational since July 2025 — tightens these rules and expands supervision. The CCBE (Council of Bars and Law Societies of Europe), representing more than one million European lawyers, maintains a standing AML committee and has warned about the risk that the new supervisory architecture could compromise the independence of the bar, a concern that found a concrete precedent in the Court of Justice of the EU’s ruling in Case C-694/20 (Orde van Vlaamse Balies, December 2022), which held that requiring lawyers to notify other intermediaries of their duty to report aggressive cross-border tax arrangements violates the right to confidential lawyer-client communications, expanding the scope of legal professional privilege under EU law.
In the UK, the Legal Sector Affinity Group (LSAG) — made up of the legal sector’s regulatory and representative bodies, including the Law Society and the Solicitors Regulation Authority (SRA) — publishes the official AML/CFT guidance for the legal sector, approved by HM Treasury and last revised in April 2025, detailing how to reconcile the duty to report suspicious activity with legal professional privilege, which stops protecting a communication once a lawyer knows or suspects they are being used to launder funds. A significant change is under way: the Financial Services and Markets Bill, introduced to Parliament in May 2026, would transfer AML/CFT supervision of the legal profession from the SRA to the FCA (Financial Conduct Authority), a move the Law Society has signaled it is watching closely given its potential impact on the profession’s self-regulation.
In the United States, by contrast, the picture is almost the opposite: unlike the EU and the UK, American lawyers are not subject, in most of their activities, to the Bank Secrecy Act’s client due diligence and reporting duties. The ENABLERS Act, proposed in 2022 to bring lawyers, accountants, and other “professional enablers” within the range of institutions required to report suspicious activity, was passed by the House as part of the NDAA but stripped out in the Senate after intense opposition from the American Bar Association (ABA), which has maintained a Task Force on Gatekeeper Regulation since 2002 dedicated to preventing federal AML rules from conflicting with professional confidentiality and attorney-client privilege. In response to the criticism, the ABA chose self-regulation instead: in August 2023, its House of Delegates passed Resolution 100, amending Model Rule 1.16 to make explicit a lawyer’s duty to inquire into the facts and circumstances of a representation so as not to provide services that further a client’s crime or fraud — an ethical duty, not a legal reporting obligation to financial intelligence units.
In Brazil, Law 9,613/1998 (the Money Laundering Law), as amended by Law 12,683/2012, extensively lists the individuals and entities required to report suspicious transactions to COAF, the financial intelligence unit, but does not expressly mention the legal profession. In 2012, the Federal Council of the Brazilian Bar Association (OAB), in an opinion drafted by then-councilor Daniela Teixeira, established that the law does not apply to the practice of law, since it is protected by the professional secrecy set out in the Bar Statute (Law 8,906/1994) and in Article 133 of the Federal Constitution — a position reinforced by COAF itself, which, through Resolution No. 24/2013, exempted professions supervised by their own regulatory body, the case of lawyers, from reporting directly to COAF. In April 2021, the Federal Council backed away from a proposed rule that would have created formal AML requirements for law firms, opting instead for a non-binding conduct manual, after pressure stemming from cases involving lawyers in Operation Car Wash and episodes such as the diversion of “Sistema S” funds. More recently, in April 2024, the Federal Council filed ADI 7.624 before the Supreme Federal Court (STF), seeking a constitutional interpretation of Article 15 of Law 9,613/98, which authorizes the sharing of COAF financial intelligence reports (RIFs) with prosecutors — an action in which the OAB argues that prior judicial authorization should be required whenever privileged data is involved. The issue connects to a recent ruling by the Superior Court of Justice (STJ, Third Section, May 2025), which barred so-called “RIF on demand,” police and prosecutors requesting financial intelligence reports directly from COAF without prior judicial authorization, and to ongoing discussions at the STF on the constitutional scope of access to these reports.
The thread connecting Basel, Brussels, London, Washington, and Brasília is the same: no financial-integrity system holds up while one link in the chain — however noble or constitutionally protected — remains beyond the reach of minimum diligence controls. The question is not whether the legal profession should be subject to AML/CFT rules on the same terms as a financial institution: the differences in function and the protection of professional secrecy are legitimate and necessary to the right of defense. The question is whether professional self-regulation, as currently practiced in Brazil, has been sufficient to identify and remove the few who, as Operation Distrato showed, turn “legal advisory services” into a front for structured fraud. While this debate continues in the courts and in parliaments, the practical answer remains the one I’ve argued for 25 years: upfront and recurring due diligence, independent governance, and robust internal controls — including, and especially, in the choice of who provides legal and tax advice.
Leave a Reply