Credit Repair Organizations Act (CROA) — Your 2026 Plain-English Guide

What CROA is, in one paragraph

The Credit Repair Organizations Act (15 U.S.C. §§ 1679–1679j), enacted in 1996, is the federal law that regulates every for-profit credit-repair company in the United States. It exists for one reason: before 1996, the credit-repair industry was a free-for-all of bait-and-switch promises, charged-up-front fees for nothing, and outright fraud. CROA put a stop to the worst of it by giving consumers a baseline set of rights that every credit-repair organization (CRO) must respect — and by giving the Federal Trade Commission, the Consumer Financial Protection Bureau, and state attorneys general the authority to sue companies that violate them.

The 7 things CROA prohibits

Under federal law, no credit-repair company may:

1. Collect any money before services are performed. Period. Even a "setup fee" must be tied to work already completed — not future work.
2. Promise to remove accurate negative information from your credit reports. No legitimate company can do this, and the FCRA's reinvestigation process doesn't allow it.
3. Claim it can create a "new credit identity" using a CPN, EIN, or any other number that's not your Social Security number. This is identity fraud, not credit repair.
4. Misrepresent its services to a consumer or a credit-reporting agency. This includes inflated claims about score increases, fake testimonials, or implying affiliation with a government program.
5. Counsel you to make any false statement to a credit-reporting agency. Disputing accurate information by claiming it's inaccurate is fraud.
6. Charge or attempt to charge for any service not specifically described in your written contract.
7. Take any action with respect to your credit report before the 3 business-day cancellation window has expired.

A company that does any of these things is not just being aggressive — it's breaking federal law.

The 6 things CROA requires

Every credit-repair company that operates in the United States must:

1. Give you a written contract before performing any service. The contract must list each service, the total cost, the timeline, and your right to cancel.
2. Provide a separate "Consumer Credit File Rights" disclosure at or before the contract. This is a standardized disclosure that informs you of your rights under the FCRA, your right to dispute items directly with the bureaus for free, and your right to sue the credit-repair organization for CROA violations.
3. Honor your 3-day right to cancel. You can cancel the contract within three business days, no questions asked, and receive a full refund.
4. Wait until services are actually performed before billing.
5. Maintain truthful and verifiable claims in all advertising.
6. Allow you to terminate the contract for any reason at any time after the 3-day period, subject to whatever cancellation policy is in the written contract.

How to spot a CROA violation in real time

These are the five most common red flags that should make you walk away from a credit-repair company immediately:

• "Pay $XXX upfront and we'll get started." Federal violation. Every penny must be tied to work already completed.
• "We can remove anything from your report, even accurate items." Federal violation, plus impossible.
• "We'll give you a new CPN so you can start over with clean credit." Federal violation, plus likely identity fraud you would be a party to.
• "You don't need to read the contract — just sign and we'll explain later." Federal violation. The contract and disclosure must be provided before you sign and you must get a copy.
• "Sorry, no refunds — we've already done the work." Federal violation if you're inside the 3-day cancellation window.

Document the violation. Save emails, take screenshots of marketing claims, keep the contract. Then report it (see the next section).

How to report a CROA violation

If you believe a credit-repair company has violated CROA, you have several enforcement paths and you can pursue more than one in parallel:

• Consumer Financial Protection Bureau (CFPB) — file at consumerfinance.gov/complaint. The CFPB forwards the complaint to the company, which has 15 days to respond. Complaints become part of the public CFPB Consumer Complaint Database.
• Federal Trade Commission (FTC) — report at reportfraud.ftc.gov. The FTC has direct enforcement authority for CROA and can bring civil actions for restitution and penalties.
• Your state attorney general — most state AGs have a consumer-protection division that pursues credit-repair violations under both CROA and the state's own credit-services act.
• Better Business Bureau (BBB) — not a regulator, but the BBB profile is where most prospective customers go to do due diligence. A documented complaint with the BBB protects future consumers.
• Private lawsuit. CROA gives consumers a private right of action. You can sue a credit-repair organization directly in federal court for actual damages, punitive damages, and attorney's fees. The 5-year statute of limitations runs from the date the violation occurred.

How CROA interacts with state law

CROA is the federal floor, not the ceiling. Many states have their own credit-services acts that add to CROA — surety bonds, registration requirements, maximum-fee caps, and longer cancellation windows. Where state law gives you more protection, state law wins. Where federal law gives you more protection, federal law wins. They stack rather than conflict.

Curious about your state's specific rules? See our (/resources/credit-repair-laws-state/) guide.

CROA and your self-help rights

Whether or not you use a credit-repair company, CROA emphasizes that you always have the right to dispute items on your credit reports yourself, for free. Specifically:

• You can pull your three credit reports for free every week at AnnualCreditReport.com — the only federally authorized source.
• You can dispute inaccurate items directly with each bureau online, by phone, or by mail. The bureau has 30 days (or 45 with additional documentation) to investigate.
• You can dispute directly with the furnisher (the company that reported the item) under the FCRA's furnisher-dispute provisions.

A credit-repair company can save you time and provide expertise, but it cannot do anything you can't do yourself. CROA exists to make sure you understand that and that, if you choose to pay a company to handle disputes, you're paying for actual work — not promises.

Bottom line

The Credit Repair Organizations Act is the single most important law to understand before you hire a credit-repair company. It defines what's legal, what's prohibited, and what your rights are if something goes wrong. Pick a company that treats CROA as a baseline rather than a finish line, and walk away from anyone who treats it as an obstacle.

If you're ready to compare CROA-compliant credit repair companies, (/#top-companies).