State Compliance
Compiled from California Business & Professions Code, DRE Regulations 2830–2835, and DRE audit records — including what the 2023–24 audit cycle actually found.
Updated 2026-08-05 · TrustRecon research team
California property managers who collect rent or hold security deposits operate under Business & Professions Code §10145 (trust fund handling), DRE Regulations 2830–2835 (the operational rules: account setup, deposit deadlines, withdrawals, reconciliation), B&P §10148 (three-year record retention), and Civil Code §1950.5 (security deposits). Commingling trust funds with your own is a statutory ground for license revocation under B&P §10176(e); intentional misuse of client funds is treated as conversion under §10176(d).
None of this is theoretical. In fiscal year 2023–24, the DRE closed 440 audits — 330 of them property management brokers. 124 firms had an actual trust fund shortage, totaling $9,019,436, and 57% of audited trust accounts had recordkeeping violations. The single most common sub-category: commissions left in the trust account past the 25-day rule.
Rent checks, security deposits, and any other client funds must be deposited into the trust account within three business days of receipt. Until the money is in the account, it is unprotected, uninsured, and invisible to your three-way reconciliation — which is why the DRE treats late deposits as one of the two most common violations under Reg. 2832.
The failure mode auditors find is not usually theft. It is a rent check recorded in Buildium or AppFolio — tenant ledger credited, owner ledger credited — that never physically reached the bank. The DRE's own audit records describe exactly this: "trust funds were properly recorded in the books, but the check was never deposited into the trust account." The software shows a balance; the bank does not have the money.
The trust account must be held in the broker's name (or dba) with the designation "as Trustee." The DRE's "Ten Most Common Violations" list puts improper account designation at the top of §10145 findings, and the consequences go beyond a citation:
The auditor verifies this by pulling the bank signature card, not by asking you.
California allows a broker to keep at most $200 of personal funds in the trust account to cover bank charges. Anything above that is commingling. This is also why bank service fees should never be debited directly from the trust account — the auditor reads the bank statement line by line, and a $35 wire fee charged against trust funds is a standalone finding.
Once a management fee or leasing commission is earned, it stops being client money and becomes yours — which means it must leave the trust account within 25 days. Leave it longer and you are commingling in the other direction: the trust balance exceeds true client liability.
This is the most commonly cited violation in the DRE's 2023–24 audit summary, and it has a specific software cause: Buildium's "Pay Out Management Income Accounts" and AppFolio's management fee withdrawal are both manual steps. The system calculates your fee but does not move the money. Skip the step for a few months and your earned fees quietly accumulate in trust. In 2023 the DRE cited S.D.S. Realty & Property Management for exactly this: "commissions/fees left in trust account beyond the 25-day limit."
Reg. 2832 is explicit: "Income earned shall not be taken from trust funds received before depositing such funds into the trust bank account; under no circumstances may the broker pay personal obligations from the trust fund bank account even if such payments are a draw against commissions."
The practical version of this violation: running the management fee sweep at the start of the month, before rent has actually cleared. The fee comes out of the pooled trust account — which at that moment is other clients' money. The owner's ledger goes negative, and every dollar of that negative balance was funded by someone else's trust funds. If you see negative owner balances in your books, this guide covers what they mean and how auditors read them.
Every calendar month, three independent numbers must be pulled level:
Any leg off from the other two is a violation. The most common shortcut the DRE finds is two-way reconciliation — bank vs. books — with the sub-ledger total never checked. Small posting errors compound monthly until they become a real shortage. One audited firm's internal reconciliation "showed no discrepancies"; the DRE's audit found a shortage of at least $46,729.72. Another audit decomposed a $33,939.90 shortage into negative property balances, bank fees charged to trust, a negative bank balance — and $32,903.42 the firm could not explain at all, the signature of deposits recorded but never made.
The reconciliation worksheet must be signed by the broker. "My bookkeeper does it" is not a defense the DRE accepts — the license on the line is the broker's.
Security deposits belong to the tenant until lawfully applied. California caps the penalty for bad-faith retention at twice the deposit on top of the deposit itself, and requires an itemized statement within 21 days of move-out. From a trust accounting standpoint, the rules that get firms in trouble are:
Leases, owner statements, trust account records, work orders, and correspondence: three years minimum, and they must survive the end of the management agreement. The DRE's position on missing records is blunt: any discrepancy in trust funds that cannot be documented is construed against the property manager. A destroyed record is not a neutral gap — it is evidence for the other side.
The full list of what auditors request — signature cards, reconciliation worksheets, sub-ledger detail — is in our 24-point audit checklist, compiled from state audit manuals including California's.
If you manage on Buildium or AppFolio, note that the software will not enforce any of these deadlines for you — it records what you enter and trusts it. Our Buildium and AppFolio bookkeeping services exist precisely because the violations above live in the gap between what the system shows and what the bank holds.
Upload three exports. Within 48 hours you get a discrepancy report with every finding tied to a record ID. Built from the same failure patterns state auditors look for.
For property management companies on Buildium or AppFolio. No call required.