CROA Compliance Basics: Contracts, Disclosures, and Fees
The Credit Repair Organizations Act is the statute that governs this industry. It applies nationwide, it applies whether or not your state requires registration, and it does not care whether you call yourself a credit consultant, a credit coach, or a credit educator. If you sell services intended to improve someone's credit record in return for payment, it applies to you.
Most enforcement actions in this field come down to three provisions: what you claimed, what your paperwork contained, and when you took the money. This page covers all three.
Who CROA Applies To
CROA reaches any person who uses interstate commerce to sell, provide, or perform a service represented to improve a consumer's credit record, credit history, or credit rating — in return for payment.
That definition is broad on purpose. Rebranding does not exit it. The statute does carve out certain entities, including 501(c)(3) tax-exempt nonprofit organizations, creditors working with their own borrowers in specified circumstances, and depository institutions. Those exclusions are narrower than people assume, and getting one wrong is expensive.
What You May Never Do
CROA lists conduct that is prohibited outright.
- Make untrue or misleading statements about a consumer's creditworthiness, credit standing, or credit capacity to a credit reporting agency, a creditor, or anyone extending credit.
- Counsel a consumer to make such statements. Advising a client to dispute information they know to be accurate falls here. So does advice to alter identifying information to obscure a credit history.
- Make untrue or misleading statements about your own services — what you can achieve, how long it will take, what results a consumer can expect.
- Engage in any act or practice that operates as a fraud or deception on any person in connection with the offer or sale of your services.
The second item is worth dwelling on, because it is where well-intentioned operators get caught. A client who insists a legitimate charge-off is "not theirs" is asking you to help them make an untrue statement. Declining that is not just ethics — it is the statute.
The Advance-Fee Rule
This is the provision violated most often, and the easiest one for a regulator to prove.
You may not charge or receive money for credit repair services before those services are fully performed. Not a deposit. Not a setup fee. Not a first-month payment collected at signing for work that starts next week.
The practical consequence is that your business model has to be built around it from the beginning. Common approaches include billing after a defined scope of work is completed, or structuring fees so that each payment corresponds to work already performed. Whichever you choose, the test is the same: at the moment money changes hands, has the work it pays for already been done?
The Disclosure Statement
Before any contract is signed, the consumer must receive a separate written statement of their rights. Two things matter here and both get missed.
It is a separate document. Not a paragraph inside your agreement, not a section of your terms. A standalone statement, provided before the contract is executed.
Its content is prescribed by statute. CROA sets out what the disclosure must say, including that consumers have a right to dispute inaccurate information themselves without paying anyone, that accurate and current negative information cannot be removed, and where to direct complaints. Do not paraphrase it.
You must also obtain the consumer's signature acknowledging receipt, and retain a copy. The retention period matters — if you cannot produce the signed disclosure later, you are in the position of proving a negative.
What the Contract Must Contain
Every agreement must be in writing, signed by the consumer, and must include at minimum:
- The terms and conditions of payment, including the total amount of all payments to be made by the consumer to you or to anyone else.
- A full and detailed description of the services to be performed, including all guarantees and all offers of a full or partial refund — and the estimated date by which the services will be performed, or the length of the period in which they will be performed.
- Your name and principal business address.
- A conspicuous cancellation notice in the form the statute specifies, located near the space for the consumer's signature.
"Full and detailed description" is doing real work in that list. A contract promising to "dispute inaccurate items and provide credit education" is unlikely to satisfy it. Describe what you will actually do, item by item where possible, and be specific about timing.
The Three-Day Cancellation Right
The consumer may cancel the contract, without penalty or obligation, within three business days of signing. You must provide a cancellation form, in duplicate, that the consumer can use to exercise that right, and the contract itself must state the right conspicuously.
Two practical points. Nothing may be performed and no money may be collected during that window in a way that undermines the right. And the three days run from signing — so your intake sequence, not just your paperwork, has to accommodate it.
Waivers Do Not Work
Any waiver by a consumer of a protection provided by CROA is void and unenforceable. A clause in which the client agrees to waive the cancellation period, agrees to pay in advance, or acknowledges that the statute does not apply has no legal effect — and its presence in your contract is itself evidence of intent.
The same applies to arbitration clauses drafted to strip statutory remedies, and to any attempt to have a consumer contract around the advance-fee provision.
What Happens When You Get It Wrong
CROA provides a private right of action. A consumer who prevails may recover actual damages, and the statute also allows punitive damages and attorney's fees. Class actions are available. Contracts that fail to comply may be treated as void.
On top of private suits, the Federal Trade Commission enforces CROA, and state attorneys general have authority to bring actions as well. A single complaint can surface a paperwork practice applied to every client you have ever had — which is how a small compliance failure becomes an existential one.
A Working Checklist
Run this against your current process. Every item is a statutory requirement, not a best practice.
- Consumer receives the separate written disclosure statement before signing anything.
- You obtain and retain the consumer's signed acknowledgment of that disclosure.
- Your contract is in writing and signed by the consumer.
- It states the total of all payments and the terms of payment.
- It describes the services in full detail, including any guarantees or refund offers.
- It states an estimated completion date or performance period.
- It carries your name and principal business address.
- The cancellation notice appears conspicuously near the signature line.
- The consumer receives a cancellation form in duplicate.
- No money is collected for services not yet fully performed.
- No claim, in any marketing channel, promises a specific score, deletion, or timeline.
- Nobody on your team ever advises a client to dispute something accurate.
- Records are retained so you can produce all of the above later.
Common Questions
Does CROA apply if I call myself a credit coach or educator?
Yes, if you sell a service represented to improve someone's credit record in return for payment. The statute follows the substance of what you sell, not the title you use.
Can I charge a setup fee to get started?
No. CROA prohibits charging or receiving money before the services are fully performed. A setup fee collected at signing is the violation regulators find most easily.
Does my state nonprofit status exempt me?
Almost certainly not. The exclusion turns on 501(c)(3) tax-exempt status under federal law, which is different from being incorporated as a nonprofit under state law. Confirm with counsel before relying on it.
Can the client waive the three-day cancellation period?
No. Waivers of CROA protections are void, and including one signals intent.
What are the penalties?
Actual damages, punitive damages, and attorney's fees in private suits, with class actions available. The FTC and state attorneys general can also bring enforcement actions, and non-compliant contracts may be void.