Credit Repair Laws by State — Your 2026 Compliance Guide

Why state law matters even when federal law applies

The federal Credit Repair Organizations Act applies to every credit-repair company in the United States. So why do state-by-state rules matter? Because states are allowed to go further than CROA, and most do. The most common ways state law strengthens consumer protection on top of CROA:

• Registration requirement — the credit-repair company must register with a state authority before it can legally operate in the state, often with annual renewal and disclosure of officers/owners.
• Surety bond — a posted financial guarantee (typically $10,000–$100,000) that lets the state pay out consumer claims if the company defrauds customers or shuts down without finishing its work.
• Fee caps — explicit limits on setup fees, monthly fees, or per-dispute charges.
• Longer cancellation windows — some states extend the federal 3-day right to cancel to 5 or 10 days.
• Required disclosures — state-specific language that must appear in the contract.
• State licensing authority — a designated agency that can revoke a company's right to operate in the state for violations.

Where state law gives you more protection, state law applies. Where federal CROA gives you more protection, federal law applies. The two stack.

The 9 states with no separate credit-services act

These states rely on federal CROA without layering additional state-specific requirements: Alaska, Montana, New Jersey, New Mexico, North Dakota, Oregon, Rhode Island, South Dakota, Vermont, Wyoming, and the District of Columbia. In these jurisdictions:

• CROA's prohibitions on up-front fees, false promises, and contract requirements still apply.
• The state attorney general can enforce CROA and the state's general consumer-protection statute.
• There is no state licensing requirement, surety bond, or fee cap — only the federal floor.

If you live in one of these states, the CFPB and state attorney general are your two enforcement paths.

States with the most aggressive credit-services laws

A handful of states have built credit-services statutes that go significantly beyond CROA. If you live in one of these, you have some of the strongest consumer protections in the country:

• California — CSO Act (Cal. Civ. Code §§ 1789.10–1789.26): $100,000 surety bond, mandatory state registration, expanded disclosure requirements.
• Illinois — Credit Services Organizations Act (815 ILCS 605): $100,000 surety bond, registration required.
• Louisiana — La. Rev. Stat. §§ 9:3573.1–3573.16: $100,000 surety bond, registration required.
• Nevada — Nev. Rev. Stat. §§ 598.741–598.787: $100,000 surety bond, registration required.
• Nebraska — Neb. Rev. Stat. §§ 45-801–45-815: $100,000 surety bond, registration required.
• Ohio — Ohio Rev. Code §§ 4712.01–4712.99: $100,000 surety bond, registration required.
• Oklahoma — Okla. Stat. tit. 24, §§ 131–145: $100,000 surety bond, registration required.
• Tennessee — Tenn. Code §§ 47-18-1001–1011: $100,000 surety bond, registration required.
• Utah — Utah Code §§ 13-21-1–9: $100,000 surety bond, registration required.
• West Virginia — W. Va. Code §§ 46A-6C-1–12: $100,000 surety bond, registration required.

In any of these states, always ask the company for its state registration number before signing a contract. Companies operating without registration are violating state law on top of any other infractions.

How to find your state's law

The structured fact card on our (/) gives you, for each state, the:

• Statute citation — the specific code section.
• Statute URL — direct link to the state-published text.
• Bond requirement — whether one is required and the amount.
• Registration requirement — yes/no.
• Fee caps — setup and monthly maximums where the state imposes them.
• Verification date — when we last confirmed the data.

Click any state below to see the structured summary and full content:

A–F: Alabama · Alaska · Arizona · Arkansas · California · Colorado · Connecticut · Delaware · DC · Florida

G–M: Georgia · Hawaii · Idaho · Illinois · Indiana · Iowa · Kansas · Kentucky · Louisiana · Maine · Maryland · Massachusetts · Michigan · Minnesota · Mississippi · Missouri · Montana

N–O: Nebraska · Nevada · New Hampshire · New Jersey · New Mexico · New York · North Carolina · North Dakota · Ohio · Oklahoma · Oregon

P–W: Pennsylvania · Rhode Island · South Carolina · South Dakota · Tennessee · Texas · Utah · Vermont · Virginia · Washington · West Virginia · Wisconsin · Wyoming

How to verify a credit-repair company is legal in your state

Before signing any contract:

1. Confirm the company complies with CROA. Ask for the written contract and the "Consumer Credit File Rights" disclosure. Both are required by federal law.
2. Confirm state registration if your state requires it. Ask for the registration number and verify it on the state authority's website. Most state secretaries of state, banking departments, or licensing divisions have a public lookup.
3. Check the BBB profile at bbb.org. Anything below B-grade or with a high pattern of unresolved complaints is a yellow flag.
4. Search the CFPB complaint database at consumerfinance.gov/complaint. Look for repeated patterns — one or two complaints from a high-volume company is normal; a high ratio of unresolved complaints to total business is not.
5. Read the contract. Total cost, service list, refund policy, cancellation window. If anything's missing or vague, ask.

When state and federal law collide

There are a few situations where state and federal law overlap. The general rule: stricter protection wins.

• If state law allows shorter cancellation than CROA's 3 days, CROA wins — you get the 3 days.
• If state law has stricter fee caps than the federal "no up-front fees" rule, state law wins for that specific item.
• If state law requires a longer cancellation than CROA's 3 days, state law wins — you get the longer period.
• If state law fails to require registration but federal law doesn't either, neither applies — you fall back on contract law and the BBB.

In practice, the federal floor + state add-ons gives consumers in states with their own credit-services acts substantially more protection than they'd have under federal law alone.

Bottom line

Federal CROA is the baseline. State law is where the real teeth often live — registration, surety bonds, fee caps, and state-specific enforcement. Before you sign any credit-repair contract, find your state's law, look up the company, and confirm everything is in writing. If a company can't or won't show you its state registration in a state that requires one, that's your answer: walk away.

Use our state-by-state guides to look up your jurisdiction, then (/#top-companies).