This is an answered question, but I'll give my "one cent":
Business rules belong in the model.
The "model" always consists of (logically or physically separated):
- presentation model - a set of classes that is well suited for use in the view (it's tailored toward specific UI/presentation),
- domain model - the UI-independent portion of the model, and
- repository - the storage-aware portion of the "model".
Business rules live in the domain model, are exposed in a presentation-suitable form to the "presentation" model and are sometimes duplicated (or also enforced) in the "data layer".
