What Is the Credit Repair Organizations Act (CROA) and What Does It Cover? (2026)
Written by Mark Clayborne
Last updated on April 24, 2026
On this page
The Credit Repair Organizations Act, codified at 15 U.S.C. sections 1679 through 1679j, is the federal statute that governs every credit repair company operating in the United States, establishing what those companies must do for clients, what they are prohibited from doing, and when they are permitted to collect fees.
Congress enacted CROA in 1996 in response to widespread consumer harm from credit repair fraud, and the law applies to any person or company that provides credit repair services for compensation, without exception and without regard to how the business describes or packages its services.
CROA does not prohibit credit repair businesses. It prohibits the specific abusive practices that brought the industry into disrepute, and it creates a compliance framework that legitimate operations can meet entirely through correct contracts, proper disclosures, and honest service delivery.
Understanding what the Credit Repair Organizations Act covers is the starting point for every credit repair business owner who wants to operate legally and every consumer who wants to know what protections exist before signing with a credit repair company. CROA’s requirements are specific, documented in statute, and consistently enforced by the Federal Trade Commission and the Consumer Financial Protection Bureau.
Business owners who build their operations around those requirements from the first client engagement are not disadvantaged by the law. They are insulated by it, because every provision CROA imposes on them also creates legal exposure for the competitors who cut corners on the same requirements.
What Are the Legal Requirements for Credit Repair Organizations?
CROA Statutory Scope: 15 U.S.C. Sections 1679 Through 1679j
The Credit Repair Organizations Act defines a credit repair organization at 15 U.S.C. section 1679a(3) as any person who uses interstate commerce or the mails to sell, provide, or perform any service in exchange for valuable consideration when the service is represented to improve any consumer’s credit record, credit history, or credit rating.
That definition is deliberately broad. A business does not avoid CROA coverage by describing its services as credit consulting, credit coaching, or dispute management. If the company is paid to help someone improve their credit, CROA applies. nCROA contains one significant exemption: bona fide nonprofit credit counseling organizations are excluded from its coverage.
A for-profit business cannot claim this exemption, and a company that misrepresents itself as nonprofit to avoid CROA compliance compounds the original violation with a misrepresentation that creates independent federal liability.
Outside that exemption, every entity providing paid credit repair services in the United States operates under CROA’s framework, and that framework imposes both affirmative obligations and explicit prohibitions with equal force.
Who Must Comply With CROA and What CROA Prohibits
Every credit repair organization, regardless of size, business model, pricing structure, or state of incorporation, must comply with CROA’s affirmative requirements: the written contract, the Consumer Rights Statement, and the three-day cancellation right.
Compliance is not optional for smaller operators or those working informally. The statute draws no distinction based on the number of clients a business serves or the amount it charges for its services.
CROA’s prohibited practices at 15 U.S.C. section 1679b are equally non-negotiable. Credit repair companies cannot collect any fee from a consumer before every contracted service has been fully performed. They cannot make false or misleading representations about their services or about a consumer’s creditworthiness.
They cannot advise a consumer to make any statement to a credit bureau that the company knows or should know to be inaccurate. And they cannot instruct a consumer to create a new credit identity using an Employer Identification Number in place of a Social Security Number, which is a federal crime entirely separate from CROA.
Understanding what CROA prohibits is not secondary to understanding what it requires. The enforcement record shows that companies are more frequently cited for prohibition violations than for failures to complete the required disclosures.
| Croa Obligation | Statutory Source | What It Requires |
|---|---|---|
| Written Service Contract | 15 U.S.C. § 1679d | Full description of services, total cost, timeframe, cancellation rights, in writing before services begin |
| Consumer Rights Statement | 15 U.S.C. § 1679c | Separate standalone document delivered and acknowledged before the contract is signed |
| Three-Day Right To Cancel | 15 U.S.C. § 1679e | Unconditional cancellation right; waiver clauses are void; Notice of Cancellation form required |
| Advance Fee Prohibition | 15 U.S.C. § 1679b(b) | No fee collected before all contracted services are fully performed |
| No False Representations | 15 U.S.C. § 1679b(a) | No misleading claims about services or consumer creditworthiness in any channel |
| No False Bureau Statements | 15 U.S.C. § 1679b(a)(3) | Cannot counsel a consumer to make inaccurate statements to a credit bureau |
What Information Must a Credit Repair Company Provide Before I Sign Up?
Before a consumer signs a credit repair contract, CROA requires two specific disclosures in a specific sequence, and the sequencing is as legally significant as the content of the disclosures themselves. The Consumer Rights Statement, required by 15 U.S.C. section 1679c, must be delivered to the consumer and acknowledged by them as a completely separate document before the service contract is presented for signature.
The written service contract, required by 15 U.S.C. section 1679d, must then be signed before any services begin. Providing both documents simultaneously at the point of signing does not satisfy CROA’s sequencing requirement, and neither does incorporating the Consumer Rights Statement into the contract as a clause, a page-two attachment, or a footer note.
The sequence is mandatory and the documentation of that sequence is the first thing a regulatory review will examine.
The Consumer Rights Statement: What It Must Say
The Consumer Rights Statement required by 15 U.S.C. section 1679c is a statutory disclosure document with specific content requirements.
It must inform the consumer of three rights: the right to dispute inaccurate information in their credit report directly with the credit bureau at no cost, the right to obtain a free copy of their credit report, and the right to sue a credit repair organization that violates CROA, recovering actual damages, punitive damages, and attorney fees.
The statement must be provided as a document entirely separate from the service contract. It cannot be embedded in the contract as a clause or incorporated by reference.
The company must retain a signed or date-stamped acknowledgment of the consumer’s receipt of the Consumer Rights Statement, because that acknowledgment is the primary compliance documentation in any FTC or CFPB review.
Companies that provide the statement correctly but fail to retain the acknowledgment lose the evidence needed to demonstrate compliance even when the disclosure was in fact made.
The FTC has cited the failure to deliver a properly separate and properly sequenced Consumer Rights Statement as one of the most common CROA violations it identifies in credit repair enforcement actions, which means that a practice that seems like a paperwork technicality in the abstract is treated as a substantive violation in practice.
Required Disclosures Before Services Begin
The second required disclosure is the written service contract itself, and CROA specifies the content it must contain at 15 U.S.C. section 1679d.
The contract must state the total amount of all payments the consumer will make, provide a full and specific description of every service to be performed, give the date by which those services will be completed or the length of the performance period, and clearly state the consumer’s right to cancel within three business days without penalty.
The contract must be executed in writing before any service is performed. A verbal agreement, however clearly understood by both parties, does not satisfy CROA’s written contract requirement.
| Disclosure Item | Required By | Timing | Consequence Of Non-Compliance |
|---|---|---|---|
| Consumer Rights Statement (Separate Document) | 15 U.S.C. § 1679c | Before contract is presented for signature | CROA violation; each affected client has private right of action |
| Signed Acknowledgment Of Receipt | 15 U.S.C. § 1679c | At delivery of statement | Loss of primary compliance documentation in any regulatory review |
| Written Service Contract | 15 U.S.C. § 1679d | Before any services begin | Contract may be voidable; independent CROA violation |
| All Required Contract Elements | 15 U.S.C. § 1679d | In the contract at signing | Incomplete contract is a CROA violation regardless of verbal agreement |
| Notice Of Cancellation Form | 15 U.S.C. § 1679e | Included with every contract package | Absence of form is an independent CROA violation |
What Legal Requirements Govern the Service Agreements of Credit Improvement Companies?
CROA’s written contract requirements at 15 U.S.C. section 1679d govern the service agreements of every credit improvement company operating in the United States, and a contract that is missing any one of the required elements is non-compliant regardless of how it is worded in every other respect.
The statute requires four specific elements in every credit repair service agreement: a full description of all services to be performed, the total cost of those services to the consumer, the date or time period within which the services will be completed, and a clear statement of the consumer’s right to cancel within three business days without any penalty or obligation.
These elements are not suggestions for good contract drafting. They are statutory requirements, and their absence exposes every client relationship the business entered into without them to legal challenge.
Mandatory Contract Elements Under 15 U.S.C. Section 1679d
Each of the four required contract elements serves a specific consumer protection function that reflects the types of harm Congress was addressing when it passed CROA. The total cost requirement prevents hidden fees from emerging after a consumer has already committed to the service. The full description requirement prevents companies from signing clients to vague engagements with no defined scope of work.
The timeframe requirement prevents indefinite engagements that produce no results. The cancellation right statement ensures the consumer knows they have three business days to reconsider without consequence.
| Required Contract Element | Statutory Source | What It Must Include | Consumer Protection Purpose |
|---|---|---|---|
| Total Amount Of All Payments | 15 U.S.C. § 1679d(b)(1) | Every fee the consumer will pay, itemized clearly | Prevents hidden or escalating fees after signing |
| Full Description Of Services | 15 U.S.C. § 1679d(b)(2) | Specific services to be performed, not a general category | Prevents vague scope that can be interpreted against the consumer |
| Date Or Period Of Performance | 15 U.S.C. § 1679d(b)(3) | Specific completion date or defined service period | Prevents indefinite open-ended engagements with no accountability |
| Three-Day Right To Cancel Statement | 15 U.S.C. § 1679d(b)(4) | Clear statement of right to cancel and how to exercise it | Ensures consumer awareness of cancellation right before signing |
| Notice Of Cancellation Form | 15 U.S.C. § 1679e | Separate form with cancellation instructions included in contract package | Gives consumer a ready mechanism to exercise the cancellation right |
The Advance Fee Prohibition and Payment Terms in Credit Repair Contracts
The advance fee prohibition at 15 U.S.C. section 1679b(b) is not only a standalone CROA rule. It is a constraint that shapes the structure of every legally compliant credit repair service agreement. A contract that obligates a consumer to pay before any services are performed is a non-compliant contract regardless of how the payment is described, because the payment obligation itself violates the statute.
The practical implication is that CROA-compliant credit repair contracts must be structured so that every fee collection point follows a completed service period, not precedes it.
The Telemarketing Sales Rule reinforces this requirement for companies marketing by telephone or online, adding at 16 C.F.R. section 310.4(a)(2) that no fee can be collected until six months after the promised results have been delivered. Together, CROA and the TSR eliminate every permissible pathway to advance fee collection in the credit repair industry, regardless of how the business model is structured.
A monthly subscription model is compliant if each month’s fee is collected after that month’s work is completed and documented. A flat upfront fee collected before the first dispute letter is sent violates both statutes simultaneously.
Can I Cancel a Credit Repair Service Contract Without Penalty Based on Credit Repair Laws?
Yes. Under 15 U.S.C. section 1679e, consumers have an unconditional three-day right to cancel any credit repair service contract from the date it is signed, without penalty, without providing a reason, and without any advance notice beyond informing the company of the cancellation.
This right is not a contractual courtesy that the credit repair company can modify or remove through contract language. It is a statutory right created by federal law, and any contract clause that purports to limit, shorten, or eliminate the three-day cancellation window is void and unenforceable as a matter of federal law regardless of whether the consumer signed or acknowledged it.
The #3-Day Right to Cancel: How It Works Under CROA
The three-day cancellation period begins on the date the consumer signs the credit repair service contract. The consumer has three full business days from that date to cancel without any financial obligation to the company.
To exercise the right, the consumer notifies the company of their intention to cancel. The credit repair company is required to include a Notice of Cancellation form in every contract package with written instructions on how to exercise the right, which means the consumer should not need to research the cancellation process independently or negotiate the terms of a cancellation after signing.
No fee can be collected during the three-day cancellation window. A company that charges a processing fee, a document preparation fee, or any other amount at intake before the cancellation window closes violates both the three-day right to cancel and CROA’s advance fee prohibition simultaneously.
A company that begins performing services during the cancellation window does so at its own risk, because the consumer retains the right to cancel even if services have already begun, and the company has no right to charge for those services if the cancellation is exercised within the three-day period.
What Happens If a Credit Repair Company Denies Your Cancellation Right
A credit repair company that refuses to honor a consumer’s cancellation request made within the three-day window is committing a CROA violation at the moment of refusal.
The fact that the consumer signed a contract does not give the company authority to override a federal statutory right, and the existence of a waiver clause in the contract makes the situation worse rather than better for the company, because the presence of a void waiver clause is itself evidence of a CROA violation independent of whether the company attempted to enforce it.
A consumer denied their cancellation right has two enforcement options available under CROA. They can file a complaint with the FTC at ReportFraud.ftc.gov or with the CFPB at ConsumerFinance.gov/complaint, and both agencies have authority to investigate and act on those complaints.
They can also file a private lawsuit under CROA’s private right of action at 15 U.S.C. section 1679g, recovering actual damages, punitive damages up to $1,000 per violation, and attorney fees without waiting for a government agency to investigate the matter first.
What Legal Recourse Do I Have if a Credit Repair Service Fails to Deliver?
Consumers who have been harmed by a credit repair company that violated CROA have three enforcement channels available to them, and all three can be pursued independently of one another.
The most direct is the private right of action at 15 U.S.C. section 1679g, which allows a consumer to file a civil lawsuit against the credit repair company without needing a government agency to have investigated or acted first. The second is a complaint to the FTC, which enforces CROA, the TSR, and FTC Act Section 5 against credit repair companies and has the authority to assess civil penalties and order consumer restitution.
The third is a complaint to the CFPB, which holds concurrent enforcement authority over credit repair organizations under the Dodd-Frank Act and has pursued credit repair enforcement actions resulting in multi-million-dollar penalties and permanent industry bans.
Private Right of Action Under CROA: What You Can Recover
The private right of action under 15 U.S.C. section 1679g is one of the most powerful consumer enforcement tools in federal consumer protection law, because it allows individual consumers to sue credit repair companies in federal or state court with an attorney fee structure that makes litigation economically viable even when the personal monetary loss is relatively modest.
The consumer can recover the greater of the actual amount paid to the credit repair company or the actual monetary harm caused by the violation. On top of that recovery, the court may award punitive damages up to $1,000 per violation, and if the consumer prevails, the credit repair company is required to pay the consumer’s reasonable attorney fees and court costs.
The attorney fee provision is the structural key that makes CROA private litigation work at small individual loss amounts. Because the company pays the consumer’s attorney fees if the consumer prevails, an attorney can take a CROA case on contingency at individual loss amounts that would not otherwise support private representation.
That dynamic creates a real and consistently exercised enforcement mechanism that operates entirely outside the regulatory process, making every client a credit repair company enrolls a potential plaintiff if any CROA provision was not correctly followed during that client’s engagement.
Filing a Complaint With the FTC or CFPB
Consumers who are not pursuing private litigation can file complaints with the two federal agencies that enforce CROA. The FTC accepts credit repair complaints at ReportFraud.ftc.gov. The CFPB accepts complaints at ConsumerFinance.gov/complaint. Both agencies can investigate credit repair companies based on complaint patterns, bring enforcement actions resulting in civil penalties, and order restitution to consumers harmed during the period of non-compliance.
Neither agency can provide individual legal advice or guarantee a particular outcome for a specific complaint, but complaint filings from multiple consumers about the same company create the documented pattern that typically triggers a formal agency investigation.
Credit repair business owners operating on compliant platforms with proper contracts, correctly sequenced disclosures, post-service billing, and honest advertising are not the target of FTC or CFPB enforcement activity.
Those enforcement resources are directed at companies collecting advance fees before delivering services, making guarantee claims that CROA and FTC Act Section 5 prohibit, and failing to provide the written contracts and Consumer Rights Statements the statute requires.
The legal framework for credit repair is designed to eliminate those practices. Businesses built on CROA compliance are what remain after enforcement removes the non-compliant operators from the market.
Frequently Asked Questions About the Credit Repair Organizations Act
Is It Illegal to Pay for Credit Repair Upfront?
Paying for credit repair is not illegal. What federal law prohibits is a credit repair company collecting any payment before it has fully performed the services that payment is meant to cover. Both CROA at 15 U.S.C. section 1679b(b) and the Telemarketing Sales Rule at 16 C.F.R. section 310.4(a)(2) prohibit advance fee collection in the credit repair industry.
A company that collects money at intake before sending a single dispute letter is violating both statutes simultaneously, and every dollar collected before services are performed is a separately actionable violation.
Is Credit Repair Legal in All 50 States?
Credit repair is legal in all 50 states. Federal CROA applies as a minimum compliance floor in every state without exception. Many states impose additional requirements on top of the federal baseline through credit services organization laws that mandate state registration, surety bonds ranging from $10,000 to $100,000 or more, and in some cases monthly fee caps.
A credit repair business fully compliant with CROA can still be operating illegally in a specific state if it has not met that state’s registration or bonding requirements before accepting clients from that jurisdiction.
What Are the Penalties for Companies That Violate CROA?
Companies that violate CROA face three enforcement channels simultaneously. The FTC can impose civil penalties up to $50,120 per violation under the FTC Act. The CFPB can assess civil money penalties and order consumer restitution under the Dodd-Frank Act.
Consumers can file private lawsuits under 15 U.S.C. section 1679g, recovering actual damages, punitive damages up to $1,000 per violation, and attorney fees without waiting for government action. Multi-violation enforcement actions against companies with large client bases can produce total penalties reaching millions of dollars.
What Two Debts Cannot Be Erased From a Credit Report?
No credit repair company can legally erase accurate, verifiable debt from a credit report, because FCRA requires credit bureaus to maintain accurate information. The two categories most resistant to dispute are federal student loans in default and tax liens, both of which are supported by government records that bureaus can verify independently without relying on the original creditor’s response.
Credit repair can address inaccurate or unverifiable information on a credit report. It cannot remove accurate negative information simply because it is negative, regardless of how the dispute is worded or how many times it is submitted.
How Does Client Dispute Manager Software Support CROA Compliance?
Client Dispute Manager Software was built by Mark Clayborne, a certified credit consultant and CROA practitioner, around the specific compliance requirements CROA imposes on credit repair businesses.
The platform provides written contract templates containing all elements required by 15 U.S.C. section 1679d, a Consumer Rights Statement workflow that sequences the disclosure before contract execution and captures the client acknowledgment as a permanent part of the onboarding record, and a billing structure that supports post-service fee collection consistent with CROA’s advance fee prohibition. The 30-day free trial with full platform access requires no credit card.
Conclusion
The Credit Repair Organizations Act defines the legal foundation of every credit repair business operating in the United States.
Its requirements are specific, enforced consistently by the FTC and the CFPB, and designed to protect consumers from the advance fee fraud, deceptive guarantees, and hidden contract terms that defined the worst of the pre-CROA credit repair industry. CROA’s affirmative obligations , the written contract, the Consumer Rights Statement, and the three-day right to cancel , are not compliance burdens.
They are the structural framework within which a legitimate credit repair business operates, and every business that meets them correctly from the first client engagement is building on a foundation that the law was designed to protect and support. Credit repair business owners who understand CROA before they take on their first client are not at a disadvantage in the market.
They are operating with the structural advantage that comes from knowing exactly what is required, building their contracts and workflows around those requirements from the beginning, and never facing the situation where a client complaint or a regulatory inquiry reveals a compliance gap that has been present in every client relationship the business has ever had.
Client Dispute Manager Software is built around CROA’s requirements for exactly that reason, giving business owners a platform whose default workflows reflect compliant operations rather than requiring compliance to be retrofitted into a system designed for something else.
Mark Clayborne
Mark Clayborne specializes in credit repair, starting and running credit repair businesses. He's passionate about helping businesses gain freedom from their 9-5 and live the life they really want. You can follow him on YouTube.
Start Today and Explore the Features Firsthand!
Related Guides:
- How Do State-Specific Credit Repair Laws Differ From Federal Regulations? (2026)
- Is Charging for Credit Repair Illegal? What You Need to Know
- What Information Must a Credit Repair Company Provide Before I Sign Up? Legal Disclosures and Contract Requirements
- What Are the Penalties for Companies That Break Credit Repair Laws?
- What Is the Credit Repair Organizations Act (CROA) and What Does It Cover? (2026)
Client Dispute Manager
Free 30-Day Trial
Experience our credit repair software, risk-free.