CROA Compliance for Credit Repair Pricing: What You Can and Cannot Charge
Written by Mark Clayborne
Last updated on June 1, 2026
On this page
CROA (Credit Repair Organizations Act) requires that credit repair companies complete services before receiving payment. This is the advance fee rule under 15 U.S.C. section 1679b. It does not cap what you can earn. It determines when service delivery must be completed relative to payment.
The stakes for business owners are serious. The Consumer Financial Protection Bureau (CFPB), granted enforcement authority under the Dodd-Frank Act, and the Federal Trade Commission (FTC) both actively pursue CROA violations. A single non-compliant client engagement creates federal exposure.
Client Dispute Manager Software supports thousands of credit repair businesses in building CROA-compliant service delivery workflows, which is why this guide addresses the law from a business structure perspective, not just a legal definition perspective.
What Is the Credit Repair Organizations Act and How Does It Affect Credit Repair Pricing?
CROA (Credit Repair Organizations Act), codified at 15 U.S.C. sections 1679 through 1679j, is the federal law that governs every for-profit credit repair company in the United States. It does not prohibit credit repair businesses.
It prohibits specific abusive practices: collecting payment before services are fully performed, making false representations about outcomes, and failing to provide required written disclosures. Business owners who build their operations around CROA’s requirements are insulated by the law rather than constrained by it.
How Does CROA Define a Credit Repair Organization Under Federal Law?
A credit repair organization, as defined at 15 U.S.C. section 1679a(3), is any person or entity that uses interstate commerce to provide services for compensation represented to improve a consumer’s credit record, credit history, or credit rating.
That definition is deliberately broad. A business does not avoid CROA coverage by describing its services as credit consulting, credit coaching, or dispute management. If the company is paid to help someone improve their credit, CROA applies.
The Fair Credit Reporting Act (FCRA) and the Fair Debt Collection Practices Act (FDCPA) are related statutes that credit repair businesses must follow alongside CROA. The FCRA governs what information credit bureaus may report and how consumers can dispute inaccuracies.
The FDCPA governs third-party debt collection activity. CROA is the primary federal law governing the business structure itself, including service delivery sequencing, written contract requirements, and the advance fee prohibition.
What Are the Five Core CROA Provisions That Govern Every Credit Repair Business?
CROA imposes five core limitations on credit repair businesses: no advance fees before services are fully performed, a written contract required before services begin, an unconditional three-day right to cancel, no false representations about outcomes, and no instruction to consumers to make inaccurate statements to credit bureaus.
Each of these five provisions carries specific legal weight. The advance fee prohibition at 15 U.S.C. section 1679b(b) is unconditional. No label, structure, or business model justifies collecting payment before service completion. The written contract requirement at 15 U.S.C. section 1679d mandates a complete description of every service before a single task begins.
The three-day cancellation right at 15 U.S.C. section 1679e is unconditional and cannot be waived by contract. The prohibition on false representations at 15 U.S.C. section 1679b(a) means no credit repair company may promise to remove accurate, verifiable information. The prohibition on coaching consumers to make inaccurate statements at 15 U.S.C. section 1679b(a)(1) is absolute.
One additional rule applies to credit repair businesses that market by phone or online. The Telemarketing Sales Rule (TSR) at 16 C.F.R. section 310.4(a)(2) imposes a stricter requirement: no compensation until six months after the promised results are achieved.
That requirement is narrower in application than CROA but more restrictive in effect. CROA was enacted in 1996 and has been enforced continuously since. See the FTC’s CROA enforcement page for the full statutory text and enforcement history.
Who Does CROA Apply To and Who Is Exempt?
CROA applies to any for-profit entity paid to improve a consumer’s credit. The exemptions are narrow. Nonprofit organizations, creditors acting on their own accounts, and banks and credit unions acting within their normal business functions are exempt.
The nonprofit exemption does not extend to for-profit companies that describe themselves as nonprofits without meeting the legal definition. If a company takes compensation to improve credit and operates for profit, CROA governs it.
Can Credit Repair Companies Charge Upfront Fees?
No. CROA does not prohibit charging for credit repair. It prohibits charging before services are fully performed. The advance fee prohibition at 15 U.S.C. section 1679b(b) is absolute: no credit repair company may collect any payment from a consumer before every contracted service has been completed. A fee collected before a single dispute letter is sent violates federal law regardless of what the fee is called.
What Is the Advance Fee Prohibition Under 15 U.S.C. Section 1679b?
The advance fee rule, established at 15 U.S.C. section 1679b(b), prohibits credit repair companies from collecting any payment before the contracted services have been fully performed.
The rule does not distinguish between a “setup fee,” “processing fee,” “enrollment fee,” or “first-month fee.” The label is irrelevant. What matters is whether the services were completed before the payment was received. A fee by any other name is still a fee.
Charging for credit repair is legal. CROA prohibits collecting payment before services are fully performed, not charging for services altogether. A credit repair business that completes a defined service period before receiving compensation operates within federal law. The law governs timing, not amount.
What Does "Fully Performed" Mean Under CROA?
Service delivery structure is where compliance is built or broken. A service is fully performed when the contractually defined unit of work has been completed and delivered. The contract must define what completion looks like. A vague contract produces a vague standard, and a vague standard creates compliance exposure.
For a monthly service period model, fully performed means one complete month of dispute preparation, submission, and follow-up has been delivered. For a pay-per-deletion model, fully performed means a specific negative item has been confirmed removed from the consumer’s credit report.
For a flat-fee project model, fully performed means the entire agreed scope of work has been delivered. Each model requires a contract that states these completion conditions explicitly.
What Are the Most Common Advance Fee Violations in the Credit Repair Industry?
Four patterns account for most advance fee violations that FTC enforcement actions have documented. First: collecting a setup, enrollment, or onboarding fee before any dispute work is performed. Second: collecting the first month’s service rate before the first dispute letters are prepared and sent.
Third: collecting full project payment under a flat-fee model before any work is delivered to the client. Fourth: structuring a payment described as a “retainer” that functions in practice as an advance fee because no services have been performed at the time of collection. For credit repair businesses that market by phone or online, the Telemarketing Sales Rule adds a stricter overlay.
The TSR at 16 C.F.R. section 310.4(a)(2) prohibits collecting any compensation until six full months after the promised outcome is achieved. That six-month window applies on top of CROA’s fully performed standard, not instead of it.
What Service Delivery Structures Are CROA Compliant?
Three service delivery structures satisfy CROA’s fully performed standard: the monthly service period model, the pay-per-deletion model, and the flat-fee project model. Each defines service completion differently.
What they share is that compensation follows the completion of a defined unit of work. A business may set any service rate it chooses under any of these three structures. CROA governs when service is complete, not how much the service is worth.
How Does the Monthly Service Period Model Satisfy CROA?
A service period is a defined unit of credit repair work, typically one month of dispute activity, that when completed constitutes a fully performed service under CROA’s advance fee standard.
When one complete month of dispute preparation, submission, and follow-up is delivered to the client, service for that period is complete. Compensation for that period may then be received. The sequence matters: delivery first, compensation after.
CROA sets no price cap on credit repair services. Business owners set their own service rates. Monthly service period rates typically range from $99 to $299 per client. Pay-per-deletion rates range from $35 to $100 per confirmed item removal. These amounts are not regulated by federal law.
How Does the Pay-Per-Deletion Model Satisfy CROA?
Service is complete upon confirmed removal of a specific negative item from the consumer’s credit report. Compensation follows that confirmation. Pay-per-deletion rates typically range from $35 to $100 per confirmed removal. The compliance risk in this model is collecting compensation before deletion is confirmed.
When that sequence is maintained and documented, the model fully satisfies CROA. The documentation requirement is critical. The business must retain written evidence of the confirmed deletion before processing compensation for that item. A credit report showing the item removed is the standard form of that documentation.
How Does the Flat-Fee Project Model Satisfy CROA?
A defined scope of work is agreed upon in the contract. The contract must specify precisely what constitutes project completion: which dispute types will be performed, which credit bureaus will be addressed, and what deliverables will be provided.
Compensation is received after that scope is fully delivered. Compensation collected before any work begins violates CROA regardless of the flat-fee structure. The flat-fee label does not create an exemption from the advance fee prohibition. What creates compliance is the sequence: work delivered in full, compensation received after.
Comparison of Three Compliant Service Delivery Structures
The following table shows how each compliant service model defines completion and timing. All three satisfy CROA’s fully performed standard when the sequences described are followed and documented.
| Service Model | Service Completion Trigger | Compensation Timing | Common Rate Range |
|---|---|---|---|
| Monthly Service Period | One complete month of dispute work delivered | After each completed service period | $99 to $299 per month |
| Pay-Per-Deletion | Specific negative item confirmed removed | After each confirmed deletion | $35 to $100 per item |
| Flat-Fee Project | Defined scope of work fully delivered | After project completion | $399 to $999 per project |
What Are the Written Contract Requirements Under CROA?
CROA requires a written contract before any credit repair services begin. The contract must contain four elements: a full description of every service to be performed, the total cost to the consumer, the date or period within which services will be completed, and a clear statement of the consumer’s three-day right to cancel without penalty. A verbal agreement, however clearly understood by both parties, does not satisfy this requirement.
What Four Elements Must Every Credit Repair Contract Include?
The statutory basis for contract requirements is 15 U.S.C. section 1679d. The Consumer Rights Statement required separately is governed by 15 U.S.C. section 1679c. The four required contract elements are:
A complete and detailed description of every service to be performed, including the types of negative items to be disputed, the credit bureaus covered, and the number of dispute rounds per service period.
The total cost or method of determining the total cost of the services, including per-period rates for ongoing service models. The date by which services will be completed or, for ongoing engagement models, the defined service period and how completion will be measured for each period.
The Consumer Rights Statement required by 15 U.S.C. section 1679c, which must be provided as a separate written document before the contract is signed. The Consumer Rights Statement requirement carries a sequencing rule.
This document must be provided separately from the contract and before the contract is signed. Providing both simultaneously at the point of signing does not satisfy CROA’s sequencing requirement, and neither does incorporating the Consumer Rights Statement into the contract as a clause, a page-two attachment, or a footer note.
How Does the Three-Day Right to Cancel Work Under CROA?
Under 15 U.S.C. section 1679e, consumers have an unconditional right to cancel any credit repair service contract within three business days of signing. The business must include a Notice of Cancellation form with the contract. The three-day period begins on the date the contract is signed, not the date services begin.
These are not the same date. Services should not begin within the three-day cancellation window. A contract clause that waives or limits this right is void.
The fact that the consumer signed a contract does not give the company authority to override a federal statutory right, and the existence of a waiver clause in the contract makes the situation worse rather than better for the company, because the presence of a void waiver clause is itself evidence of a CROA violation independent of whether the company attempted to enforce it.
What Contract Clauses Violate CROA?
Three categories of contract clauses violate CROA directly. First: any clause purporting to waive the consumer’s three-day right to cancel, which is void under 15 U.S.C. section 1679f. Second: any clause requiring consumers to waive their right to dispute accuracy directly with credit bureaus, which is prohibited under 15 U.S.C. section 1679b.
Third: any clause collecting compensation before services are performed, which violates 15 U.S.C. section 1679b(b) regardless of how the clause labels that payment. A contract containing any of these clauses is non-compliant even if the company never attempts to enforce the prohibited provision. The clause itself is the violation.
Which States Have Additional Credit Repair Laws Beyond Federal CROA?
CROA is the federal compliance floor. Many states impose additional requirements through their own Credit Services Organization laws.
California, Georgia, Maryland, Florida, Texas, and Tennessee each require formal registration, a surety bond, or both before a credit repair business can legally solicit or serve clients in that state.
Operating across state lines without meeting each state’s requirements creates regulatory exposure regardless of federal compliance status.
Which States Require a Surety Bond for Credit Repair Businesses?
A Credit Services Organization (CSO) is the state-law designation for entities providing credit repair services, governed by individual state CSO statutes that may impose requirements beyond federal CROA. Surety bonds are required in six states: California ($100,000), Georgia ($50,000), Maryland ($25,000), Tennessee ($15,000), Florida ($10,000), and Texas ($10,000). Federal CROA has no bond requirement.
Most states have no bond requirement. Verify your state’s Credit Services Organization Act requirements before accepting clients. The following table shows bond and registration requirements by state. Bond amounts are sourced from individual state Credit Services Organization Acts. Verify current requirements with a licensed attorney in your state.
| State | Bond Requirement | Registration Required |
|---|---|---|
| California | $100,000 | Yes |
| Georgia | $50,000 | Yes |
| Maryland | $25,000 | Yes |
| Tennessee | $15,000 | Yes |
| Florida | $10,000 | Yes |
| Texas | $10,000 | Yes |
| All Other States | Varies | Check state CSO Act |
Which States Require Registration as a Credit Services Organization?
All six bond-requirement states also require formal CSO registration before a credit repair business may solicit or serve clients. The registration process varies by state. California and Georgia have the most comprehensive requirements, including detailed application filings and ongoing renewal obligations.
Some states require annual registration renewal and continuous bond maintenance throughout the period of operation. A lapsed bond or registration renewal is a compliance violation even if the business was compliant at the time of initial registration.
How Do You Verify Your State Requirements Before Accepting Clients?
Consult your state’s version of the Credit Services Organization Act, available through your state legislature’s official website. Each state publishes its current CSO Act requirements, bond amounts, and registration procedures through its legislature or attorney general’s office. Requirements can change. Verify current requirements before accepting the first client in any new state.
What Is the CROA Compliance Checklist for Credit Repair Businesses?
A credit repair business that meets all of the following requirements operates in full compliance with federal CROA from the first client engagement. These obligations reflect what the FTC and CFPB most frequently examine in credit repair enforcement actions.
The following 10 requirements constitute the minimum federal compliance baseline under CROA:
- #1. Written contract executed before any services begin, containing all required elements under 15 U.S.C. section 1679d.
- #2. Consumer Rights Statement provided as a separate written document before the contract is signed, as required by 15 U.S.C. section 1679c.
- #3. Notice of Cancellation form included with the contract, giving the consumer an unconditional three-day right to cancel under 15 U.S.C. section 1679e.
- #4. No payment collected before services are fully performed, as required by 15 U.S.C. section 1679b(b).
- #5. Service completion defined and documented for each client engagement before compensation is received.
- #6. No false or misleading representations about the ability to remove accurate, verifiable information, as prohibited by 15 U.S.C. section 1679b(a).
- #7. No instruction to consumers to make inaccurate statements to credit bureaus or creditors, as prohibited by 15 U.S.C. section 1679b(a)(1).
- #8. No waiver clauses in contracts purporting to limit consumers’ CROA rights, as these are void under 15 U.S.C. section 1679f.
- #9. State CSO registration and surety bond in place where required by the business’s operating state or states.
- #10. Compliance process documented and consistently applied across every client engagement.
The National Association of Credit Services Organizations (NACSO) provides compliance resources and industry guidance for credit repair businesses seeking additional support beyond the federal baseline.
What Are the Penalties for CROA Violations?
Companies that violate CROA face enforcement from three directions simultaneously: the FTC, the CFPB, and private lawsuits from affected consumers. These channels operate independently. A consumer can file a lawsuit under 15 U.S.C. section 1679g without waiting for a government agency to act, and the company must pay the consumer’s attorney fees if the consumer prevails.
What Civil Penalties Can the FTC Impose for CROA Violations?
CROA violations expose companies to FTC civil penalties of up to $50,120 per violation, CFPB enforcement with consumer restitution orders, and private lawsuits from affected consumers recovering actual damages, statutory damages of up to $1,000 per violation, and attorney fees under 15 U.S.C. section 1679g.
The FTC enforces CROA under its general enforcement authority and seeks civil penalties of up to $50,120 per violation. Each client engagement that violates the advance fee prohibition is a separate violation.
A company with 50 clients in a non-compliant service structure faces 50 separate penalty exposures. The $50,120 figure applies per violation, not per company. The total exposure scales directly with client volume.
What Can Consumers Recover in a Private CROA Lawsuit?
Under 15 U.S.C. section 1679g, consumers may recover four categories of damages. Actual damages are the amounts the consumer lost through the violation. Statutory damages are not less than the amount paid to the company and not more than $5,000 per violation. Punitive damages are available in class action suits.
Attorney fees are recoverable by prevailing consumers, meaning a consumer who wins pays nothing out of pocket to bring the suit. That attorney fee provision is significant. It lowers the barrier to private litigation against non-compliant companies to near zero.
How Do State Attorneys General Enforce CROA?
State attorneys general may bring enforcement actions on behalf of state residents under CROA. They do not need the FTC or CFPB to act first. The CFPB, granted enforcement authority under the Dodd-Frank Act, can enforce CROA independently and impose consumer restitution orders that exceed the cost of any single violation.
The combination of federal agency enforcement, state attorney general enforcement, and private consumer litigation creates no safe harbor for CROA violations. A business that violates CROA is exposed on all three channels simultaneously, for every affected client.
Frequently Asked Questions About CROA and Credit Repair Pricing
Is Charging for Credit Repair Illegal?
Charging for credit repair is legal in the United States. CROA prohibits collecting payment before services are fully performed, not charging for services altogether. A credit repair business that completes a defined service period before receiving compensation for that period operates within federal law. The law governs the timing of compensation relative to service delivery, not the amount charged for that service.
What Are the Limitations of CROA
CROA imposes five core limitations on credit repair businesses: no advance fees before services are fully performed, a written contract required before services begin, an unconditional three-day right to cancel, no false representations about outcomes, and no instruction to consumers to make inaccurate statements to credit bureaus or creditors. These limitations apply to every for-profit credit repair company in the United States regardless of how the business describes its services.
How Much Can I Charge for Credit Repair?
CROA sets no price cap on credit repair services. Business owners determine their own service rates. Monthly service period rates in the industry typically range from $99 to $299 per client per month. Pay-per-deletion rates typically range from $35 to $100 per confirmed item removal. Neither range is regulated by federal law; both reflect market practice.
Do I Need a Bond to Start a Credit Repair Business?
Bond requirements depend on your state, not federal law. California requires a $100,000 surety bond, Georgia requires $50,000, Maryland requires $25,000, Tennessee requires $15,000, and Florida and Texas each require $10,000. Federal CROA imposes no bond requirement. Most states have no bond requirement. Check your state’s Credit Services Organization Act or consult a licensed attorney before accepting clients in that state.
What Happens If a Credit Repair Company Violates CROA?
CROA violations create three simultaneous enforcement exposures. The FTC may seek civil penalties of up to $50,120 per violation. The CFPB may seek consumer restitution under its Dodd-Frank authority. Affected consumers may file private lawsuits under 15 U.S.C. section 1679g and recover actual damages, statutory damages, and attorney fees. Each non-compliant client engagement is a separate violation, and the total exposure scales with the number of affected clients.
Conclusion
CROA defines the legal structure of every credit repair business operating in the United States. The advance fee prohibition at 15 U.S.C. section 1679b(b), the written contract requirement at 15 U.S.C. section 1679d, and the three-day cancellation right at 15 U.S.C. section 1679e are not compliance burdens.
They are the operational framework that separates lawfully operating businesses from those exposed to FTC, CFPB, and private enforcement. This article covered the three compliant service delivery structures that satisfy CROA’s fully performed standard: the monthly service period model, the pay-per-deletion model, and the flat-fee project model.
It covered the state-level requirements that go beyond CROA, including surety bond obligations in California, Georgia, Maryland, Tennessee, Florida, and Texas. It covered the 10-item federal compliance checklist derived from CROA’s core provisions.
It covered the three simultaneous enforcement channels that CROA violations trigger and the penalty exposure that scales with client volume. A credit repair business built around documented service completion, CROA-compliant contracts, and state-specific registration requirements operates with federal and state law as a structural advantage, not a constraint.
Mark Clayborne
Mark Clayborne specializes in credit repair, starting and running credit repair businesses. He's passionate about helping businesses gain freedom from their 9-5 and live the life they really want. You can follow him on YouTube.
Start Today and Explore the Features Firsthand!
Client Dispute Manager
Free 30-Day Trial
Experience our credit repair software, risk-free.