Privilege, confidentiality, and what you're legally forced to disclose

This hierarchy matters because clients often assume anything they tell any professional is protected the way it would be with a lawyer. It isn't, and telling clients this upfront is itself a compliance and risk-management necessity.

Where mandatory disclosure overrides the shield

Even the strongest privilege has carve-outs, and several professions carry affirmative disclosure duties that exist specifically to override confidentiality.

The crime-fraud exception. Attorney-client privilege doesn't cover communications made to plan or commit an ongoing or future crime or fraud. A client asking "how do I structure this deal" is protected. A client asking "help me hide these assets from my creditors" likely isn't, once a court finds the exception applies.

SARs under the Bank Secrecy Act (BSA) and AML rules. Financial institutions, and in some jurisdictions certain professionals like money service businesses, must file Suspicious Activity Reports with FinCEN (the Financial Crimes Enforcement Network, part of the US Treasury) when they see transactions suggesting money laundering, fraud, or other illicit activity. The filer is legally barred from telling the subject of the SAR that a report was filed, this is called the "tipping off" prohibition. In the EU, the equivalent regime under the Anti-Money Laundering Directives requires "obliged entities" (which explicitly include lawyers, notaries, and accountants in many circumstances) to file Suspicious Transaction Reports with national Financial Intelligence Units.

SOX auditor reporting duties. The Sarbanes-Oxley Act of 2002 (SOX), passed after the Enron and WorldCom collapses, requires external auditors of public companies to report evidence of material illegality or fraud up the client's management chain, and if management doesn't act, ultimately to the board's audit committee. Section 10A of the Securities Exchange Act (which SOX amended) can require the auditor to notify the SEC directly if the issue isn't resolved and is material. This is a legal reporting duty that trumps ordinary client confidentiality for auditors.

Mandatory reporting for other professionals. Depending on jurisdiction, this can extend to reporting suspected child abuse (many licensed professionals), elder financial abuse, or, for lawyers in some states, disclosure to prevent death or substantial bodily harm (an exception to privilege under ABA Model Rule 1.6, adopted in most US states).

The pattern: privilege protects the lawyer-client relationship almost absolutely, but nearly every other professional relationship has statutory disclosure duties layered on top of, or instead of, confidentiality.

The practical squeeze: three real scenarios

Scenario 1: The auditor and the whistleblower. An audit team at an accounting firm discovers revenue recognition irregularities at a public client. Under SOX Section 10A, they must escalate internally first. If the client's audit committee doesn't fix it, the firm has a legal duty to consider withdrawing and, in some cases, reporting to the SEC. Client confidentiality doesn't protect the client here, the law compels the auditor's hand regardless of the client relationship.

Scenario 2: The law firm and the AML gatekeeper rules. In the EU and UK, lawyers handling certain transactions (real estate purchases, company formation, managing client money) are themselves "obliged entities" under AML law and must perform customer due diligence and file suspicious transaction reports, even though the same lawyer's advice on litigation strategy would be fully privileged. The US doesn't currently impose equivalent gatekeeper AML obligations directly on lawyers (a long-debated gap flagged by the Financial Action Task Force), but the Corporate Transparency Act's beneficial ownership reporting regime (administered by FinCEN, implementation ongoing as of 2025 to 2026) pulls lawyers and formation agents closer to disclosure obligations indirectly.

Scenario 3: The consultant with no privilege at all. A management consultant hired to investigate a client's internal fraud has essentially no evidentiary privilege of their own. If litigation follows, the consultant's notes and interview memos can be subpoenaed unless the engagement was structured through outside counsel under work-product protection (a common practice called a "Kovel arrangement," from *United States v. Kovel*, 1961, originally developed for accountants working for law firms).

How firms actually manage the gap

Three practical mechanisms show up repeatedly across professional services:

• Kovel arrangements: hiring accountants or consultants through outside counsel so their work product falls under attorney work-product protection, rather than standing alone with no shield.
• Engagement letter carve-outs: explicitly telling clients, in writing, what is and isn't protected, and what mandatory reporting obligations exist (auditors are required to disclose this; ethical law and accounting practice increasingly treats it as best practice everywhere).
• Internal escalation protocols: audit firms and law firms build multi-step internal review (partner review, general counsel review, ethics committee) before any external disclosure, both to comply with the law and to avoid over-disclosing beyond what's legally required.

For a grounded overview of how these obligations are framed for practicing accountants, the AICPA's Code of Professional Conduct is a useful primary source, and it's free to browse.

🎬 [VIDEO: "Attorney-Client Privilege Explained" - https://www.youtube.com/results?search_query=attorney+client+privilege+explained+crime+fraud+exception - search for a short explainer covering privilege basics and the crime-fraud exception, useful for grounding the legal baseline before layering on AML and SOX duties]

Key Takeaways

• Privilege, work-product doctrine, and professional confidentiality are three different strengths of protection, not synonyms. Attorney-client privilege is the strongest and belongs to the client; accountants generally have no equivalent federal privilege in the US.
• The crime-fraud exception strips privilege from communications made to plan future wrongdoing, this is the pressure point in most privilege disputes.
• SOX Section 10A forces auditors of public companies to escalate suspected fraud internally, and potentially to the SEC, regardless of client wishes. AML law forces SAR/STR filings on financial institutions and, in the EU, on lawyers and accountants acting as gatekeepers, with a strict "no tipping off" rule.
• Structuring engagements correctly (Kovel arrangements, engagement letter disclosures, escalation protocols) is how firms manage the legal exposure created by overlapping and sometimes conflicting duties.
• None of this is optional risk management, it's the actual legal architecture professionals operate inside. Assuming "client confidentiality" covers everything is a common and expensive misunderstanding.