Get my free credit analysis Free analysis →
Credit Repair

Credit Repair Organizations Act (CROA): Your Rights

Credit Repair Organizations Act (CROA) in plain English: advance fee ban, contract rules, 3-business-day right to cancel and how to check a company.

AP
By Ankur Pandey•11 min read
Credit Repair Organizations Act explained: a checklist of your rights when you hire a credit repair company

By Ankur Pandey, AI Credit Care | Last updated: October 2026

This article is for general education and is not legal or financial advice.

The Credit Repair Organizations Act (CROA) is the federal law that sets the ground rules for any business that charges you to work on your credit. It controls what these companies can say, when they can bill you, what goes in the paperwork, and how you can back out. Below is the law section by section, with a citation for each rule so you can read the source yourself.

What is the Credit Repair Organizations Act?

CROA is Title IV of the Consumer Credit Protection Act, added in 1996 (Pub. L. 104-208) and codified at 15 U.S.C. 1679 through 1679j. The Federal Trade Commission enforces it.

Section 1679 explains why. Congress found that some credit repair companies had used advertising and business practices that caused financial harm, especially to people with limited means and little credit experience. The law aims to give buyers the information they need to decide wisely and to protect the public from unfair or deceptive practices.

Who counts as a credit repair organization?

The definition in 15 U.S.C. 1679a(3) is broad. It covers anyone who uses the mail or interstate commerce to sell or perform a service, for money or other valuable consideration, with the “express or implied purpose” of improving a consumer’s credit record, history or rating, or advising on it. A company does not need to call itself “credit repair” to be covered.

Three groups are excluded:

  • Nonprofits that are tax-exempt under section 501(c)(3). Calling yourself “nonprofit” without that status is not enough.
  • Creditors helping you restructure a debt you owe to that same creditor.
  • Banks and credit unions (depository institutions and federal or state credit unions), plus their affiliates and subsidiaries.

What credit repair companies can’t do

Section 1679b lists the prohibited practices. Most apply to “any person,” not only to credit repair companies.

No untrue or misleading statements

No one may make, or advise you to make, an untrue or misleading statement about your creditworthiness to a credit bureau or creditor (1679b(a)(1)). Companies also may not misrepresent their services (1679b(a)(3)) or use any fraud or deception in selling them (1679b(a)(4)).

No advice to change your identity

It is illegal to make or advise any statement meant to alter your identification so that accurate, current negative information stays hidden (1679b(a)(2)). Pitches for a “new credit identity” or a so-called CPN in place of your Social Security number fall here. Our guide to common credit repair scam red flags covers more warning signs.

No payment before the work is fully performed

This is the advance fee ban. Under 1679b(b), a credit repair organization may not charge or receive money for a service before that service is fully performed. A sign-up fee or a prepaid bill for work not yet done raises questions under this rule. For pricing models, see what credit repair usually costs.

The disclosure you must get before signing

Section 1679c requires the company to hand you a written statement titled “Consumer Credit File Rights Under State and Federal Law” before you sign any contract. It must be a separate document from the contract itself (1679c(b)).

It explains that you can dispute inaccurate information with the credit bureau yourself, that accurate and current negative information cannot lawfully be erased by anyone, that you can sue a company that breaks CROA, and that you can cancel within three business days. The company must keep your signed acknowledgment for two years (1679c(c)).

What a credit repair contract must include

Under 1679d(a), no services may be provided until you sign a written, dated contract and the three-business-day cancellation period ends. Under 1679d(b), the contract must spell out:

  1. The terms and conditions of payment, including the total amount of all payments you will make.
  2. A full and detailed description of the services, including any performance promises the company makes.
  3. An estimated date by which the services will be done, or how long they will take.
  4. The company’s name and principal business address.
  5. A conspicuous statement in bold type, near the signature line, that you may cancel without penalty or obligation before midnight of the third business day after signing.

Your 3-business-day right to cancel

Section 1679e(a) lets you cancel without penalty or obligation by notifying the company before midnight of the third business day after you sign. The company must give you a “Notice of Cancellation” form in duplicate (1679e(b)), plus copies of the contract, the disclosure and anything else you sign, at signing (1679e(c)).

One quirk: the statute’s sample form says “3rd day,” while 1679e(a) says “3rd business day.” Sending your notice early avoids any doubt.

Waivers and noncompliant contracts are void

You cannot sign away CROA rights. Under 1679f, any waiver is void, asking for one is itself a violation, and a noncompliant contract is void.

Enforcement and your remedies

Your right to sue

Under 1679g, a company that fails to comply is liable for the greater of your actual damages or the amount you paid, plus possible punitive damages and, in a successful case, costs and reasonable attorney’s fees. Class actions are allowed.

FTC and state enforcement

Section 1679h treats a CROA violation as an unfair or deceptive practice under the FTC Act. State attorneys general can also sue for an injunction or for damages on behalf of residents.

How long you have to act

Under 1679i, a lawsuit must be brought within five years of the violation. If the company willfully misrepresented required information, the five years run from when you discovered it.

How CROA fits with state law and phone sales rules

Section 1679j keeps state law in force except where it is inconsistent with CROA. Many states have their own credit services laws, which can add requirements such as registration or bonding. Your state attorney general’s office can tell you the local rules.

For credit repair sold by phone, the FTC’s Telemarketing Sales Rule adds another layer. Under 16 CFR 310.4(a)(2), payment cannot be requested or received until the promised time frame has passed and the seller provides a consumer report, issued more than six months after the results were achieved, showing those results.

Quick reference: main Credit Repair Organizations Act rules

Rule What it means Citation
Who is covered Paid services aimed at improving your credit record; some nonprofits, creditors and banks excluded 15 U.S.C. 1679a(3)
No false statements No untrue or misleading claims to bureaus or creditors, or about the company’s services 15 U.S.C. 1679b(a)(1), (3), (4)
No identity changes No advice to alter your identity to hide accurate negative information 15 U.S.C. 1679b(a)(2)
No advance fees No payment before the service is fully performed 15 U.S.C. 1679b(b)
Written disclosure “Consumer Credit File Rights Under State and Federal Law,” separate from the contract, before signing 15 U.S.C. 1679c
Written contract Total cost, services, timeline, name and address, bold cancel notice 15 U.S.C. 1679d
Right to cancel Cancel within 3 business days; company must supply a “Notice of Cancellation” form 15 U.S.C. 1679e
No waivers Waivers and noncompliant contracts are void 15 U.S.C. 1679f
Civil liability Actual damages or amount paid, possible punitive damages, attorney’s fees 15 U.S.C. 1679g
Enforcement FTC and state attorneys general can act 15 U.S.C. 1679h
Time limit 5 years from the violation, or from discovering a willful misrepresentation 15 U.S.C. 1679i
State law State laws still apply unless inconsistent 15 U.S.C. 1679j

How to check a credit repair company against CROA

Use this list before you sign or pay anything:

  • [ ] You got the “Consumer Credit File Rights Under State and Federal Law” statement, separate from the contract, before signing.
  • [ ] The contract is written and dated.
  • [ ] It states the total of all payments.
  • [ ] It describes each service in detail and gives a time frame.
  • [ ] It lists the company’s name and principal business address.
  • [ ] A bold cancellation notice sits near your signature, with a “Notice of Cancellation” form in duplicate.
  • [ ] No payment is requested before services are fully performed.
  • [ ] Nobody suggested a CPN, a new identity, or disputing information you know is accurate.
  • [ ] Every spoken promise appears in the written contract.
  • [ ] Your state’s credit services law, if any, is being followed.

Before paying any credit repair company, including AI Credit Care, ask for the written contract, the disclosure statement and the cancellation notice.

You can dispute errors yourself for free

You do not need a company to dispute your credit report. Under the Fair Credit Reporting Act, 15 U.S.C. 1681i, you can dispute information that is inaccurate, incomplete or unverifiable, and the bureau must reinvestigate free of charge, generally within 30 days. The FTC’s guide to disputing errors on your credit reports suggests contacting both the bureau and the business that supplied the information, and its Fixing Your Credit FAQs notes that anything a credit repair company can do legally, you can do yourself for little or no cost. Our DIY credit repair guide walks through the steps.

Frequently asked questions

What does the Credit Repair Organizations Act do?

The Credit Repair Organizations Act (CROA), 15 U.S.C. 1679 through 1679j, regulates businesses that charge to improve a consumer’s credit record. It bans misleading claims and advance fees, requires a written disclosure and contract, and gives consumers a right to cancel.

Can a credit repair company charge me upfront?

Under 15 U.S.C. 1679b(b), a credit repair organization may not charge or receive payment for a service before it is fully performed. For phone sales, the Telemarketing Sales Rule (16 CFR 310.4(a)(2)) adds stricter timing.

How long do I have to cancel a credit repair contract?

Under 15 U.S.C. 1679e, you can cancel without penalty before midnight of the third business day after you sign. The company must give you a Notice of Cancellation form.

Does CROA apply to nonprofit credit counseling agencies?

CROA excludes nonprofits that are tax-exempt under section 501(c)(3). A group that only calls itself nonprofit, without that tax status, is not excluded.

What can I do if a credit repair company breaks CROA?

You can report it to the FTC and your state attorney general. CROA also lets consumers sue for actual damages or the amount paid, whichever is greater, plus possible punitive damages and attorney’s fees, generally within five years of the violation.

Do I need a company to dispute errors on my credit report?

No. Under the Fair Credit Reporting Act, you can dispute inaccurate, incomplete or unverifiable information with the credit bureaus and the business that reported it, at no charge.

This article is for general education and is not legal or financial advice. For advice about your situation, talk to a licensed attorney.

About the author: Ankur Pandey writes AI Credit Care’s consumer guides. This article is based on the federal laws and regulator guidance listed in the sources below. An expert review will be added when available.

Related guides: How to fix credit report errors, How to fix my credit fast, DIY credit repair software compared, Credit repair scam red flags.

Sources

  1. 15 U.S.C. Chapter 41, Subchapter II-A (Credit Repair Organizations), Cornell LII: https://www.law.cornell.edu/uscode/text/15/chapter-41/subchapter-II-A
  2. 15 U.S.C. 1679, Findings and purposes: https://www.law.cornell.edu/uscode/text/15/1679
  3. 15 U.S.C. 1679a, Definitions: https://www.law.cornell.edu/uscode/text/15/1679a
  4. 15 U.S.C. 1679b, Prohibited practices: https://www.law.cornell.edu/uscode/text/15/1679b
  5. 15 U.S.C. 1679c, Disclosures: https://www.law.cornell.edu/uscode/text/15/1679c
  6. 15 U.S.C. 1679d, Credit repair organizations contracts: https://www.law.cornell.edu/uscode/text/15/1679d
  7. 15 U.S.C. 1679e, Right to cancel contract: https://www.law.cornell.edu/uscode/text/15/1679e
  8. 15 U.S.C. 1679f, Noncompliance with this subchapter: https://www.law.cornell.edu/uscode/text/15/1679f
  9. 15 U.S.C. 1679g, Civil liability: https://www.law.cornell.edu/uscode/text/15/1679g
  10. 15 U.S.C. 1679h, Administrative enforcement: https://www.law.cornell.edu/uscode/text/15/1679h
  11. 15 U.S.C. 1679i, Statute of limitations: https://www.law.cornell.edu/uscode/text/15/1679i
  12. 15 U.S.C. 1679j, Relation to State law: https://www.law.cornell.edu/uscode/text/15/1679j
  13. FTC, Credit Repair Organizations Act: https://www.ftc.gov/legal-library/browse/statutes/credit-repair-organizations-act
  14. FTC Consumer Advice, Fixing Your Credit FAQs: https://consumer.ftc.gov/articles/fixing-your-credit-faqs
  15. FTC Consumer Advice, Disputing Errors on Your Credit Reports: https://consumer.ftc.gov/articles/disputing-errors-your-credit-reports
  16. 16 CFR 310.4, Abusive telemarketing acts or practices, eCFR: https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-310/section-310.4
  17. 15 U.S.C. 1681i, Procedure in case of disputed accuracy (FCRA): https://www.law.cornell.edu/uscode/text/15/1681i