State-by-state credit-repair bonding and registration, explained

The Credit Repair Organizations Act is federal law, but it doesn't require a single credit repair company anywhere to register with a government agency or post a bond. That layer, where it exists at all, comes entirely from individual states — and which layer applies to you depends entirely on which state you're standing in.

What CROA does, and doesn't, require

CROA (15 U.S.C. § 1679 et seq.) bans advance fees, bans guaranteed-results claims, mandates a three-business-day cancellation right, and requires a specific written disclosure before signing — see our advance-fee rule explainer and our standard for the details. What it does not do is set up any federal licensing scheme: there is no federal registry of credit repair organizations, no federal bond requirement, and no federal agency that pre-approves a company before it opens for business. CROA is enforced after the fact — by the FTC, the CFPB, state attorneys general, or a consumer's own private lawsuit — not through an upfront permission slip.

Many states decided that gap was worth closing on their own. A majority of states have passed some version of a state 'Credit Services Organization' (CSO) act that adds a licensing-style layer CROA never created. The rest either have no dedicated statute at all, or — in at least one case — criminalized the underlying business model instead of licensing it. All three outcomes exist right now, in different states, at the same time.

The general pattern, where a state regulates this at all

States that do regulate credit repair organizations tend to combine some mix of three mechanisms:

Registration or notification with a state agency — commonly the Secretary of State, the Attorney General's office, or a consumer-protection division, filed before the company can lawfully solicit or sign up a resident of that state.
A surety bond, typically in the $10,000–$100,000 range, purchased from a licensed surety company and filed with the state. The bond isn't a fine paid to the government — it's a fund a harmed consumer (or the state, on consumers' behalf) can make a claim against if the company violates the law, up to the bond's face amount. Most states require the bond to stay in force for one to two years after a company stops doing business there, precisely so a consumer with a claim doesn't discover the safety net vanished the day the company closed its doors.
A trust-account requirement, in some states, for money a company actually holds on a consumer's behalf before passing it along. Kansas, for instance, requires funds received for disbursement to a consumer's creditors to be deposited into a dedicated trust account within four calendar days of receipt; Delaware and Washington structure their own statutes around the same bond-or-trust-account choice. This is narrower than a general operating bond — it applies specifically to money a company is holding, not to its basic right to operate — but it exists in exactly the states that decided a bond alone wasn't enough oversight of client money in transit.

Five real states, five different answers

Bond range across states that require one: $10,000 – $100,000

Federal (CROA) bond or registration requirement: None

States with a dedicated CSO statute: Most, not all

California requires a credit services organization to register with the Department of Justice (the Attorney General's office) and file a $100,000 surety bond with the Secretary of State before doing any business in the state, under the Credit Services Act of 1984 (Cal. Civ. Code §§ 1789.10 et seq.). The bond must come from an admitted surety, stays in force for two years after the company stops operating in California, and a harmed consumer can sue against it directly for actual damages.

Illinois requires registration with the Secretary of State under its own Credit Services Organizations Act (815 ILCS 605/1 et seq.), plus a $100,000 surety bond specifically triggered by the same fact pattern CROA cares about federally: a company that collects money before fully performing the service it promised. Once required, the bond must be maintained continuously, and for two years after the company closes.

Texas shows the other end of the bond-size range: registration with the Secretary of State is required under Chapter 393 of the Finance Code, but the bond is $10,000 — filed separately for each physical location a company operates, so a multi-location company's total security requirement scales with its footprint rather than staying fixed at one number.

Utah requires registration with the Division of Consumer Protection and a $100,000 security under the Credit Services Organizations Act (Title 13, Chapter 21 of the Utah Code) — the same $100,000 figure our own internal vetting notes have flagged, on more than one occasion, as an open question we couldn't independently confirm for a specific company's current filing. Worth knowing if you're checking a Utah-registered company today: a 2026 state law (S.B. 38) took effect in May 2026 and eliminated the irrevocable letter of credit as an acceptable form of that security going forward, narrowing the options to a surety bond or a certificate of deposit — a live example of exactly the kind of state-by-state detail that changes and needs re-checking rather than assumed permanent. A bond amount being common, well-documented state law is not the same thing as a specific company's current compliance with it being verified — that's exactly the gap this page is meant to help you close yourself.

Georgia does not regulate credit repair organizations at all — it bans them. Under O.C.G.A. § 16-9-59, operating a 'credit repair services organization' for profit is a criminal misdemeanor, not a licensed business, with a short list of specific exemptions: regulated lenders, FDIC-insured banks and thrifts, SEC/CFTC-registered broker-dealers, consumer reporting agencies acting under the federal FCRA, licensed attorneys and real estate brokers acting within their normal practice, and 501(c)(3) nonprofits — which is exactly why nonprofit credit counseling, covered in our DMP explainer, remains lawful there. There is no bond amount to check in Georgia, because there is no lawful for-profit version of this business to check it against.

And some states have no dedicated law at all

Wyoming and South Dakota are two clear examples of a real third category: no state Credit Services Organization statute, no state registration requirement, and no state bond requirement layered on top of CROA. A company operating only in a state like this is still bound by federal law — CROA's advance-fee ban and cancellation-rights requirement don't disappear — but there is no state agency to register with, no bond number to ask for, and no state-level licensing check a consumer can run at all. Several other states fall into this same category. The honest answer, if you're in one of them, is that 'state registration' simply isn't a question your state's law asks a credit repair company to answer.

How to actually check a specific company, in your specific state

Start with the agency your own state actually uses, since it varies: some states route this through the Secretary of State's corporate/UCC filing office (Texas runs a dedicated CSO Public Search Portal for exactly this), some through the Attorney General's consumer protection division (California's Department of Justice maintains its own registration page), and some through a consumer protection or commerce agency (Utah's Division of Consumer Protection runs registration and renewal through its own online portal). Searching '[your state] Secretary of State credit services organization' or '[your state] Attorney General credit repair registration' will usually surface the right office within the first result or two. If no self-serve online search turns anything up, call the office directly and ask — not every state has built a public lookup tool, and a phone call gets you a real answer either way: registered, not registered, or 'we don't regulate that.'

If your state is one of the ones with no dedicated CSO law at all, there's no registration number to ask for in the first place — checking the company's federal-level record (the CFPB's Consumer Complaint Database, FTC enforcement actions) is the closest available substitute, and it's worth doing regardless of which state you're in.

Why this is a genuine gap, not a technicality: the practical result of this patchwork is that 'is this company registered and bonded' doesn't have one national answer. It can mean a specific $100,000 filing you can look up by name in California, a $10,000-per-location filing in Texas, a criminal question rather than a licensing one in Georgia, or a question your state's law simply never asks at all. A company that can't or won't tell you plainly which of these applies to it, in your state, is failing a check that costs a legitimate company nothing to answer honestly — see point 6 of our standard and the parallel entry on our warning-signs checklist.