Our current O/RM tool does not really allow for rich domain models, so we are forced to utilize anemic (DTO) entities everywhere. This has worked fine, but I continue to st
This is exactly what the service layer is for - I've also seen applications where it's called the BusinessLogic layer.
These are the routines you'll want to spend most of your time testing, and if they're in their own layer then mocking out the repository layer should be straightforward.
The repository layer should be genericized as much as possible, so it's not an appropriate place for business logic that's individual to particular classes.