CROA Explained: What the Credit Repair Organizations Act Says and Why It Matters

Congress passed the Credit Repair Organizations Act in 1996 — but most consumers have never read it, and most credit repair companies would prefer they didn't. The statute is written clearly, its protections are real, and understanding them changes how you evaluate every company that offers to help you with your credit. This article is a complete plain-English breakdown of what CROA says, why it exists, and what it means for you.

Why Congress Passed CROA: The Problem It Was Solving

By the early 1990s, the credit repair industry had accumulated a well-documented record of fraud. Companies operating under names like "Credit Doctors" and "Fresh Start Credit Services" had a consistent playbook: advertise aggressively to consumers with damaged credit, collect substantial upfront fees, send a few form letters to credit bureaus, and disappear when the results failed to materialize. The letters they sent were often legally frivolous — mass-disputing every item on a credit report regardless of accuracy, a tactic bureaus learned to ignore.

The Federal Trade Commission had pursued enforcement actions against dozens of such companies throughout the 1980s and early 1990s. State attorneys general had filed their own suits. None of it was sufficient to clean up the industry, because the operators simply closed one company and opened another.

Congress concluded that the structural problem was the upfront fee model. If a company collected $500 to $1,500 from a consumer before doing anything, that company bore no financial risk from failing to perform. The consumer, having already paid, had limited leverage. The solution Congress chose was to eliminate the ability to collect upfront: if a company must perform its services before collecting payment, the incentive structure changes entirely.

CROA was enacted as Title IV of the Consumer Credit Protection Act. It became effective April 1, 1997, and has applied to every credit repair organization operating in the United States since then — including, as the CFPB's 2023 enforcement action against Progrexion confirmed, those that charge monthly fees at the beginning of service periods.

Who CROA Covers: The Definition of a Credit Repair Organization

The statute's reach depends on who qualifies as a "credit repair organization." Under 15 U.S.C. § 1679a(3), a credit repair organization is any person or entity that:

• Uses interstate commerce or the mails
• For payment or for profit
• Sells, provides, or performs — or represents that they can sell, provide, or perform — any service to improve any consumer's credit record, credit history, or credit rating
• or provides advice or assistance to a consumer with regard to any activity that purports to improve, or to repair, the consumer's credit record, credit history, or credit rating

The definition is intentionally broad. It captures law firms offering credit repair services, companies offering dispute letter services, and consultants advising consumers on credit improvement — as long as they charge for those services.

The statute explicitly lists several categories that are not covered: nonprofit organizations, creditors (banks, lenders), licensed CPA firms, licensed attorneys in good standing providing legal services, and depository institutions. These exemptions reflect categories where existing regulatory frameworks and professional obligations provide some protection, though they have also been criticized as potential loopholes.

The Core Prohibition: No Advance Payment (§ 1679b(b))

The most important provision — and the one that brought down Progrexion — is the advance payment prohibition at 15 U.S.C. § 1679b(b). It states that no credit repair organization may "charge or receive any money or other valuable consideration for the performance of any service which the credit repair organization has agreed to perform for any consumer before such service is fully performed."

This provision has no exceptions for subscription services, monthly service models, or attorney-supervised operations. The CFPB's enforcement action against Progrexion confirmed that billing monthly in advance — even for a recurring subscription — violates § 1679b(b) for each billing cycle in which payment precedes performance.

Prohibited Practices (§ 1679b(a))

Beyond the advance payment prohibition, CROA enumerates a list of practices that credit repair organizations are prohibited from engaging in regardless of payment timing. Section 1679b(a) prohibits any credit repair organization — and any person employed by or acting for one — from:

• Making false or misleading statements — including any representation about the consumer's identity, address, or credit history, or about the services the organization can provide (§ 1679b(a)(1)-(2))
• Advising consumers to make false statements to credit bureaus, creditors, or the government (§ 1679b(a)(3))
• Guaranteeing results — any representation that the organization can or will remove accurate negative information from a consumer's credit report (§ 1679b(a)(4)). Accurate information that is not past its reporting window cannot be removed through dispute, and any company that says otherwise is violating this provision
• Making representations regarding a new identity — advising or assisting a consumer to assume a different identity or create a new credit file using a separate identification number (a practice called "file segregation," which is also federal fraud)

These prohibitions address the specific fraud patterns that Congress observed in the pre-CROA credit repair industry. The "guarantee removal of accurate information" prohibition is particularly relevant today because it remains a marketing tactic at some companies that operate in legally ambiguous territory.

Required Disclosures (§ 1679c)

Before a consumer signs any contract with a credit repair organization, the organization must provide a written disclosure statement. This document is not optional and cannot be waived. Under § 1679c, the disclosure must inform the consumer:

• That they have the right to dispute inaccurate information in their credit report directly, for free, without using any company
• That accurate negative information cannot legally be removed from their credit report
• That they have the right to obtain a free copy of their credit report from each bureau annually
• That negative information, with limited exceptions, remains on a credit report for 7 years
• That they have a 3-business-day right to cancel any contract with a credit repair organization

The required disclosure is designed to ensure that consumers know their own rights before they pay anyone to exercise those rights on their behalf. A credit repair company that skips this disclosure, provides an incomplete one, or presents it in a format that obscures its content violates CROA.

The Written Contract Requirement (§ 1679d)

Every agreement between a credit repair organization and a consumer must be in writing. Oral agreements are not enforceable, and the absence of a written contract is itself a violation. The contract must include:

• The total amount of all payments to be made
• A full and detailed description of the services to be performed, including the estimated date by which each service will be performed or the estimated length of time it will take
• Any guarantees made (though as noted above, guarantees of specific outcomes generally violate § 1679b(a)(4))
• The name and address of the credit repair organization

The contract must also include a complete statement of the consumer's right to cancel. This is separate from the required disclosure — both must be provided.

The 3-Day Cancellation Right (§ 1679e)

You can cancel any contract with a credit repair organization within three business days after signing it, without penalty and without giving any reason. This right cannot be waived by contract — a provision in a credit repair agreement that says you waive this right is void. The organization must provide you with a cancellation form that you can use to exercise this right.

The Private Right of Action (§§ 1679g-1679h)

CROA gives individual consumers the right to sue credit repair organizations that violate the statute. You do not need to wait for the FTC or CFPB to act. Under § 1679g, you can recover:

• Actual damages — money you actually lost as a result of the violation
• Punitive damages — up to the greater of $5,000 or the amount of money you paid to the organization, if the violation was willful
• Attorney's fees and costs — if you prevail

Class action suits are also permitted under § 1679h. The CFPB's enforcement action against Progrexion was the most prominent example of aggregate enforcement, but private class actions have also been filed against credit repair companies on CROA grounds. The private right of action gives individual consumers leverage — particularly for smaller violations that would not attract CFPB attention but that can support viable individual claims.

How Restore Avoids Being a CRO

The CROA definition of a credit repair organization covers any entity that "performs" credit improvement services for compensation. Restore Credit is structured specifically to fall outside this definition.

In the Restore model, the consumer does the work. The software generates a draft dispute letter based on the item the consumer identifies on their credit report. The consumer reviews that letter, makes any edits, approves it, signs it, and mails it themselves. Restore does not send letters on behalf of consumers. Restore does not contact credit bureaus. Restore does not represent consumers in any capacity before any third party.

What Restore does is provide the infrastructure, templates, tracking, and guidance that make the consumer's own exercise of their FCRA rights more organized and efficient. This is categorically different from what Lexington Law did — Lexington Law performed the dispute services. Restore helps you perform them yourself.

The legal significance of this distinction was underscored by the Progrexion case. Companies that perform credit repair services must comply with CROA's advance payment prohibition, disclosure requirements, and contractual requirements. Software tools that help consumers exercise their own statutory rights are not in that category.

What CROA Does Not Do

It is worth being clear about what CROA does not cover, because some consumers approach the statute expecting protections it does not provide.

CROA does not give you the right to have accurate negative information removed from your credit report. The statute regulates credit repair organizations — it does not change what credit bureaus are required to report or for how long. Accurate information within the reporting window is reportable, regardless of what any credit repair company tells you.

CROA does not cap what credit repair companies can charge. It regulates when they can charge (after performance) and what they can represent about their services. A company charging $200 per month after service delivery is compliant with CROA if its other practices are in order.

CROA does not replace your FCRA rights. The FCRA — a separate statute — is what gives you the right to dispute inaccurate information, demand investigation, and sue bureaus and furnishers for violations. CROA is specifically about regulating the companies that help you exercise those rights. The two statutes work in parallel, not as substitutes for each other.