Potential civil and criminal penalties for violating CROA