You are about to take your first paying client in a new state. You have the dispute software, the intake form, and a clean contract. Then a nagging question stops you cold at 9pm: do you actually need a license to do this here? Are you allowed to charge a monthly fee? Could you get fined, or worse, for opening the shop you just spent three months building?
Here is the short answer. Credit repair is legal in almost every state, but it is regulated on two levels at once. The federal Credit Repair Organizations Act (CROA) sets rules that apply everywhere, and on top of that most states run their own credit services organization (CSO) law that can require you to register with a state office and post a surety bond before you take a dollar. The bond runs anywhere from $5,000 to $100,000 depending on the state. And one state, Georgia, makes operating a credit repair organization a crime for anyone who is not a nonprofit or a licensed attorney. This is the checklist that tells you which bucket you are in.
Table of contents
- Why credit repair is regulated twice
- The federal floor: what CROA requires everywhere
- The state layer: registration and surety bonds
- Georgia: the state that bans it outright
- Texas, California, and Florida up close
- How this goes wrong: four failure modes
- Steal this: the pre-launch registration checklist
- Three scenarios: solo, expanding, and multi-state
- Common objections, answered
- FAQ
Why credit repair is regulated twice
The thing that trips up almost every new operator is assuming there is one rulebook. There are two, and they stack.
The first is federal. CROA is a national law, enforced by the Federal Trade Commission, and it governs how you sell and deliver the service no matter where you sit. The second is your state. Legislators watched credit repair scams take money from people who could least afford it, so more than 30 states passed their own credit services organization laws that add a registration step, a bond, or both. A few states go further and criminalize the activity for most operators.
You have to satisfy both layers. Clearing CROA does not exempt you from your state’s bond. Posting your state bond does not let you charge an advance fee that CROA bans. Miss either one and you are operating illegally, even if the other side of the ledger is spotless.
None of this is a reason to panic. It is a reason to spend one afternoon confirming your obligations before you spend three months building a business that a single letter from a state office can shut down.
The federal floor: what CROA requires everywhere
Start here, because CROA is the same in every state and it decides how your whole business model works.
No advance fees. This is the big one. A credit repair organization cannot charge or collect any money before the service it promised is fully performed (FTC). There is no exception for a fee you call a setup charge, an enrollment fee, or an administrative cost. You do the work first, then you bill. That single rule is why credit repair runs on monthly recurring billing and why you need cash runway to float the first cycle of every client. We cover the money side of that in the credit repair pricing playbook and how to run clean monthly charges in recurring billing without chargebacks.
A written contract, in specific terms. Before any work starts, the client signs a written agreement that spells out the services you will perform, a reasonable estimate of how long it will take, your total cost, and the client’s rights (Consumer Action). A handshake or a checkout page alone does not meet the bar.
A 3-business-day right to cancel. The client can cancel the contract for any reason within three business days of signing, with no penalty and no fee (Consumer Action). You have to give them a separate cancellation notice they can use, and you cannot write a clause that waives this right.
No guarantees, no false claims. You cannot promise a specific score, guarantee an item comes off, or advise a client to lie about their credit history. A violation of CROA is treated as an unfair or deceptive practice under Section 5 of the FTC Act, which is what gives the FTC its teeth here. The safe way to describe your work is process and effort, never a promised outcome. Our CROA-compliant onboarding checklist has the exact intake language.
Get CROA right and you have the federal layer covered. Now for the part that changes at the state line.
The state layer: registration and surety bonds
This is where operators get surprised, because the rules move the moment you cross a border. Below are the states with the clearest, best-documented requirements. Confirm your own state before you launch, because these figures and agencies do change.
| State | Register with | Surety bond | Notes |
|---|---|---|---|
| Georgia | Not available to most | Not applicable | Operating a credit repair organization is a misdemeanor except for nonprofits and licensed attorneys (O.C.G.A. 16-9-59) |
| California | Dept. of Justice (Attorney General) | $100,000 | Certificate of registration required before doing business; bond filed with the Secretary of State (CA DOJ) |
| Texas | Secretary of State | $10,000 | CSO registration under Finance Code Ch. 393; bond required to charge before full performance (TX SOS) |
| Florida | State filing | $10,000 | Bond plus a trust account if you take money before services are complete (Fla. Stat. 817.7005) |
| Illinois | Secretary of State | $100,000 | Credit services organization registration and bond |
| Maryland | Commissioner of Financial Regulation | $50,000 | Credit Services Business license required |
| Nevada | Div. of Mortgage Lending | $100,000 | Registration under NRS 598.741 to 598.787 |
| Arizona | State filing | $5,000 to $25,000 | Bond scales with your annual receipts (see below) |
The pattern is consistent even though the numbers are not. A state wants two things: a public registration so consumers and regulators know who you are, and a bond so a wronged client has something to claim against. The bond is not insurance for you. It protects your clients, and if a claim pays out, your surety comes after you to recover it.
Required credit services organization surety bond amount by state (2026). Amounts are the bond’s face value, not what you pay; a surety typically charges a small percentage of the face value as your annual premium. Sources: California DOJ, Texas Secretary of State, Florida Statutes 817.7005.
One point that saves people real money: the bond amount is the coverage, not the cost. You do not hand a state $100,000. You buy a bond for that face value from a surety company, and your premium is usually a small percentage of it, priced on your credit and financials. Budget the premium as a yearly cost of doing business, and renew it on time, because a lapsed bond can suspend your registration.
Georgia: the state that bans it outright
If you operate in Georgia, or you are a remote firm thinking about taking Georgia clients, stop and read this section twice.
Georgia does not register credit repair organizations. It criminalizes them. Under O.C.G.A. 16-9-59, a person commits an offense when they own, operate, or are affiliated with a credit repair services organization, and that offense is a misdemeanor (O.C.G.A. 16-9-59). There is no bond you can post to make it legal. The activity itself is off limits for most operators.
The statute carves out narrow exemptions. The definition of a credit repair services organization does not include a nonprofit that is tax exempt under Section 501(c)(3), a person licensed as a real estate broker in Georgia acting within the scope of that license, or a person licensed to practice law in Georgia acting within the scope of their practice as an attorney (Georgia Attorney General). If you are not one of those, you cannot run a for-profit credit repair shop in Georgia.
This matters even if you are not based in Georgia. If you run a remote firm and you enroll a Georgia resident, you are arguably operating in Georgia. That is exactly the kind of question you route to a lawyer before you flip on lead generation in that market. For the operational side of moving a firm’s systems without touching its compliance obligations, see our Atlanta migration playbook, but the licensing question here is a legal one, not a software one.
Texas, California, and Florida up close
These three states between them cover a huge share of US credit repair demand, and each handles the bond a little differently.
Texas. Credit services organizations register with the Secretary of State under Finance Code Chapter 393. The headline number is a $10,000 surety bond, filed with the Secretary of State, in favor of the state and of any person the CSO damages (Texas Secretary of State). Texas ties the bond directly to advance fees: a CSO can only take money before it fully performs if it has the bond or a surety account on file. Given CROA already bars advance fees, the practical read for most operators is simple, register and bond up, then bill monthly after work is done.
California. California is the strict one. Under the Credit Services Act of 1984 you must file a registration application and receive a certificate of registration from the Department of Justice before you do business in the state (California DOJ). The bond is $100,000, in favor of the State of California for anyone harmed by a violation, and it is filed with the Secretary of State. California also sets a minimum bond term, so this is not a one-and-done filing. It is a standing obligation you maintain for as long as you serve California clients, plus a tail period after you stop.
Florida. Florida’s rule lives in the state’s credit service organization statute. If you charge or receive money before your services are fully performed, you must hold a $10,000 surety bond issued by a surety admitted in Florida and maintain a trust account at a federally insured institution (Florida Statutes 817.7005). The bond and the trust account together are Florida’s way of making sure client money is protected if you take it early.
The takeaway across all three: same idea, different price, different filing office. You cannot copy your Texas setup into California and assume you are covered.
Arizona and the states that scale the bond
Arizona is worth a callout because it does not use a flat number. Your bond scales with your annual receipts, from a $5,000 floor to a $25,000 ceiling.
Arizona credit services organization bond amount by prior-year receipts (2026). The bond steps up as the business grows and is adjusted each year. Source: Surety One, Arizona credit services organization bond.
A scaling bond has one operational trap: you have to revisit it every year. Grow past a receipts threshold and your required bond rises with you. Miss the adjustment and your bond no longer matches your size, which puts your registration at risk. Put the renewal and the receipts check on your compliance calendar so it never sneaks up.
Beyond the states above, plenty of others (Illinois, Maryland, and roughly two dozen more) run their own CSO statute with its own bond and filing office. Do not assume a state has no rule just because you have not heard of it. The default assumption for any new state should be “there is probably a CSO law here, prove otherwise,” not the reverse.
How this goes wrong: four failure modes
Setup is the easy part. Here is where operators actually get hurt, and what to do instead.
Failure 1: operating unregistered because “nobody checks.” Plenty of small shops run for a year or two without registering and nothing happens, right up until a client complaint, a chargeback dispute, or a competitor’s tip puts you on a regulator’s desk. Then the missing registration turns a solvable client problem into an enforcement problem. Fix: register before your first client in a state, not after your tenth complaint.
Failure 2: charging an advance fee anyway. This is the most common CROA violation because it feels harmless. You want to cover your costs, so you take a $199 setup fee at signup. That fee is illegal under CROA no matter what you call it (FTC), and it is the exact pattern the FTC and state AGs look for. Fix: bill only after the first cycle of work is done, and hold three months of runway so you can afford to.
Failure 3: letting the bond lapse. Bonds renew annually. Miss a renewal and, in a state like California with a standing bond requirement, your registration can be suspended while you are still taking clients, which means you are now operating unlicensed without realizing it. Fix: put every bond renewal on a calendar with a 45-day warning, and treat the confirmation like you treat payroll.
Failure 4: expanding into a new state on autopilot. You get good at generating leads and your ads start pulling clients from three states you never registered in. Every one of those is a separate obligation. Fix: gate new-state lead generation behind a compliance check. No registration, no ads in that state. This is a workflow, not a memo, which is why it belongs in your system and not in your head.
Steal this: the pre-launch registration checklist
Run this before you take your first client in any state. Copy it, fill in your state’s specifics, and keep the completed version in your records.
CREDIT REPAIR PRE-LAUNCH COMPLIANCE CHECKLIST (per state)
FEDERAL (same in all 50 states)
[ ] Contract is written and signed BEFORE any work begins
[ ] Contract lists services, a time estimate, and total cost
[ ] Contract includes the 3-business-day cancellation right
[ ] A separate cancellation notice is given to the client
[ ] No fee is charged or collected before work is fully performed
[ ] No guaranteed-result or "delete accurate items" language anywhere
STATE (repeat for EVERY state you serve clients in)
[ ] Confirmed whether this state has a CSO / credit services law
[ ] Confirmed this state does NOT ban the activity (see Georgia)
[ ] Registered with the correct state office (SOS, DOJ, or regulator)
[ ] Surety bond purchased at the state's required face amount
[ ] Bond filed with the correct office, filing fee paid
[ ] Bond renewal date on the calendar with a 45-day warning
[ ] (Arizona-type states) Receipts-based bond tier reviewed yearly
OPERATIONS
[ ] Client texting registered under A2P 10DLC (separate hurdle)
[ ] Monthly billing set to charge AFTER the work cycle, not before
[ ] New-state lead generation gated behind a compliance checkAnd here is a plain compliance line to keep in your contract and your sales script, so nobody on your team ever promises a result:
“We provide credit repair services in accordance with the Credit Repair Organizations Act and applicable state law. We review your credit reports, dispute the items you identify with the credit bureaus and furnishers, and keep you informed as they respond. We do not and cannot guarantee that any specific item will be removed or that your score will reach any particular number. You have the right to cancel this contract within three business days of signing, without penalty.”
Treat that as a starting point, not a finished contract. Have a licensed attorney in your state adapt it to your setup and your state’s exact disclosure language before you use it with a real client.
Three scenarios: solo, expanding, and multi-state
The rules are the same. What you actually have to do differs a lot depending on how you operate.
The solo operator serving one state. You live in Texas and you take Texas clients. Your job is contained. Register as a CSO with the Texas Secretary of State, post the $10,000 bond, get your CROA contract and cancellation notice right, and bill monthly after work is done (Texas Secretary of State). One registration, one bond, one renewal date. This is the cleanest version of the business, and it is why many operators deliberately stay in-state for their first year.
The operator expanding to a second state. You are established in Texas and California starts sending you leads. Do not touch those leads until you have cleared California separately: a Department of Justice registration and a $100,000 bond, which is ten times your Texas bond (California DOJ). The jump in bond size alone is a real business decision. Expansion is not “turn on ads in a new state.” It is “complete a full registration in a new state, then turn on ads.” Build the gate before you build the demand.
The multi-state remote firm. You run everything online and you take clients wherever they are. This is the highest-obligation setup, because you inherit the rules of every state your clients live in, not just where you sit. That means a stack of registrations, a stack of bonds, a calendar full of renewals, and a hard rule that you do not enroll a client from a state you have not cleared. It also means Georgia is a live landmine: enrolling a Georgia resident may pull you into a state that criminalizes the activity. The remote model is the most scalable and the most compliance-heavy at the same time, and it is the one where a system that tracks client state against your registrations stops being a nice-to-have.
Common objections, answered
“Do I really need a license? I thought CROA was the whole thing.”
CROA is federal and it is only half the picture. It governs how you sell and deliver, but it does not register your business or bond it. Most states add their own credit services organization law with a registration and a bond on top, and a few change the rules entirely. Clearing CROA and skipping your state requirement still leaves you operating illegally in that state. You need both layers.
“I work remotely. Doesn’t that mean state rules don’t apply to me?”
It usually means the opposite. When you enroll a client who lives in a given state, you are generally doing business in that state, which can pull you under that state’s CSO law regardless of where your desk is. A remote firm serving ten states can owe ten registrations. This is exactly why the smart move is to gate lead generation by state and only open a market once you have cleared it.
“The bond is $100,000 in California. Do I have to come up with that much cash?”
No. The bond amount is the coverage, not the price. You buy a surety bond for that face value and pay a premium that is a small percentage of it, priced on your credit and financials. You are not depositing $100,000 with the state. You are buying a promise that, if a client wins a claim against you for a violation, there is money to pay it, which the surety then recovers from you. Budget the annual premium and renew on time.
“Isn’t this easier to just handle inside my software?”
Your dispute software does not register you or bond you, and it will not stop you from enrolling a client in a state you have not cleared. What software can do is enforce the parts that repeat: a signed CROA contract on every client, the cancellation notice, billing that only fires after work is done, and a check that ties a client’s state to your registrations. Picking the tool that actually does the operational work is its own decision, which we break down in the best credit repair software for a solo operator.
FAQ
Credit repair licensing by state: FAQ
Do you need a license to start a credit repair business?
It depends on your state. Federally, CROA does not require a license, but it does require a written contract, a 3-business-day cancellation right, and a ban on advance fees. On top of that, more than 30 states have a credit services organization (CSO) law that can require you to register with a state office and post a surety bond before you take a client. A handful of states have stricter or different rules, and Georgia makes the activity a misdemeanor for most operators. Check your specific state before you launch.
Is credit repair illegal in Georgia?
For most for-profit operators, yes. Under O.C.G.A. 16-9-59, operating a credit repair services organization in Georgia is a misdemeanor. The only exemptions are 501(c)(3) nonprofits, licensed Georgia real estate brokers acting within the scope of that license, and licensed Georgia attorneys acting within the scope of their practice. There is no registration or bond that makes a standard for-profit credit repair shop legal in Georgia, so this is a situation to bring to an attorney before doing anything.
How much is a credit repair surety bond?
The required bond face value depends on the state. Texas and Florida require a $10,000 bond, Maryland requires $50,000, and California, Illinois, and Nevada require $100,000. Arizona scales its bond from $5,000 to $25,000 based on your annual receipts. Important: the face value is the coverage, not your cost. You buy the bond from a surety company and pay a premium that is a small percentage of the face value, priced on your credit and finances.
Can I charge a setup or enrollment fee to cover my costs?
No. CROA prohibits charging or collecting any fee before the promised service is fully performed, and there is no exception for a fee labeled setup, enrollment, or administrative. You must complete the work first, then bill. That is why credit repair runs on monthly recurring billing and why you should plan for roughly three months of operating runway to float the first cycle of client work before revenue catches up.
If I'm registered in my home state, can I take clients in other states?
Not automatically. When you enroll a client who lives in another state, you are generally doing business there and may owe that state's own registration and bond. A firm serving several states often needs a separate registration and bond in each one. Before you run ads or take clients in a new state, confirm and complete that state's requirements. Gate your lead generation by state so you never enroll someone from a market you have not cleared.
Does GoHighLevel or my dispute software handle licensing for me?
No software registers or bonds your business with a state; those are filings you make yourself. What a good system does is enforce the repeatable compliance work: a signed CROA-compliant contract and cancellation notice on every client, billing that only charges after work is performed, an audit trail, and a check that matches each client's state against the states you are registered in. The filings are on you; the day-to-day guardrails can be automated.
Back to that 9pm question. The honest answer is that credit repair is a real, legal business in almost every state, and the rules that feel intimidating are just a checklist once you see them laid out. Confirm your state, register if it asks you to, post the bond, keep your CROA disclosures clean, and never open a new state on autopilot. Do that and the letter from a state office never comes, because you already did the thing it would have asked about.
Written by Simone Braxton. This article is general information for credit repair operators and is not legal advice. Confirm every requirement with a licensed attorney in your state before you act.