Guide

CROA Compliance for Credit Repair Agencies

Last updated September 10, 2026

Almost everything written about the Credit Repair Organizations Act explains it to consumers — here are your rights, here is how to spot a scam. Useful, but it is the wrong document if you are the organization.

This is the operator's version: what the statute actually requires you to do, quoted from the law rather than paraphrased from someone's blog. It applies from your first paying client.

The five obligations, in the order they hit you

1. The separate disclosure, before anything is signed

This is the requirement most new operators have never heard of, and it comes first chronologically.

Before any contract is executed, you must give the consumer a written statement titled "Consumer Credit File Rights Under State and Federal Law." The statute is specific that this is a separate document — not a clause in your agreement, not a paragraph on your website. Its own piece of paper, handed over before the client signs anything.

The statement covers the client's right to dispute directly with the bureaus for free, the fact that accurate information cannot be removed, how long negative information stays, their right to sue you, and their right to cancel.

Yes, it tells your client they could do this themselves without you. That is the point of it, and it is not optional.

2. No payment until the work is done

No credit repair organization may charge or receive any money or other valuable consideration for the performance of any service which the credit repair organization has agreed to perform for any consumer before such service is fully performed.

Setup fees collected at signup are the textbook violation. Monthly billing must run in arrears, for work already delivered. Per-item billing is fine, because the fee follows a confirmed result.

What to charge goes through the three billing models in more detail.

3. A written contract with specific contents

The agreement has to state the terms and conditions of payment including the total amount of all payments, a full and detailed description of the services including any guarantees of performance, an estimate of when the work will be complete or how long it will take, and your name and principal business address.

It also has to carry a cancellation notice in bold face type, immediately next to the signature line, in the statute's own words:

You may cancel this contract without penalty or obligation at any time before midnight of the 3rd business day after the date on which you signed the contract. See the attached notice of cancellation form for an explanation of this right.

4. Three business days to walk away

The client can cancel "at any time before midnight of the 3rd business day" after signing, without penalty or obligation. Business days, not calendar days. Build it into onboarding rather than hoping nobody exercises it — if your model only works when clients cannot leave, the model is the problem.

5. Four things you can never do

The statute names them directly. You may not:

• Make, or advise a consumer to make, any statement that is untrue or misleading about their credit worthiness, credit standing or credit capacity to a bureau or creditor.
• Make, or advise a consumer to make, any statement intended to alter the consumer's identification to prevent the display of their credit record — the practice sometimes sold as a "new credit identity."
• Make or use any untrue or misleading representation of your own services.
• Engage in any act or practice that constitutes or results in fraud or deception in connection with the offer or sale of your services.

The second one is worth dwelling on. Anything taught as a way to give a client a "fresh file" — a CPN, an EIN used as a substitute for an SSN, a manufactured identity — sits squarely inside that prohibition.

The clause you cannot write

You cannot contract your way out of any of this. Waivers are void:

Any waiver by any consumer of any protection provided by or any right of the consumer under this subchapter — (1) shall be treated as void; and (2) may not be enforced by any Federal or State court or any other person.

And it goes further than simply not working: attempting to obtain a waiver is itself a violation. A clause in your agreement saying the client gives up their cancellation right does not just fail — it creates a new problem.

If you are using a contract template from a course, this is the first thing to check it for.

Why this is worth treating as a feature

Compliance reads like paperwork until you look at what your competition is selling. The market a new operator arrives into is full of guaranteed deletions, upfront "setup fees," and courses teaching identity workarounds. Every one of those is on the prohibited list.

Which means the compliant version is also the differentiated one. A client who has been burned once can tell the difference between an operator who hands them a rights disclosure before asking for a signature and one who leads with a promise. So can a regulator.

A short self-audit

• Do you hand over the separate rights disclosure before the contract?
• Does any money change hands before work is delivered?
• Does your contract state the total of all payments?
• Is the cancellation notice in bold, next to the signature line?
• Does anything in your marketing promise a specific outcome?
• Does your agreement contain a waiver clause? (Remove it.)

If you answered wrong on any of these, fix that one before taking another client. And get the contract itself reviewed by an attorney in your state — that is the one line item in this business genuinely worth paying for.

This guide is general information about how the credit-repair industry is regulated. It is not legal advice, and it is not a substitute for an attorney who knows the rules in your state. ScoreBoost Pro is a software platform — it does not provide credit-repair services.