MoCRA Regulations: Registration, Labeling, and FDA Enforcement

MoCRA compliance requirements mean that if your business manufactures, packages, distributes, or brands cosmetics sold in the United States, you likely have to register your facility with the FDA, list every product, keep safety substantiation records on file, report serious adverse events within 15 business days, and update your labels with consumer contact information. The Modernization of Cosmetics Regulation Act of 2022 gave the FDA its broadest new authority over cosmetics since the original Federal Food, Drug, and Cosmetic Act of 1938, and the rules apply to domestic and foreign operations alike.¹ Some obligations began the day the law was signed. Others are still being written.

Who the Law Actually Covers

MoCRA assigns obligations to two roles. The “responsible person” is the entity whose name appears on the product label — usually the manufacturer, but sometimes the packer or distributor whose brand goes on the packaging. This is the party legally on the hook for safety substantiation, adverse event reporting, product listing, and accurate labeling.

The “facility” is any location where cosmetic products are manufactured or processed for U.S. distribution. Facility owners and operators have to register with the FDA and keep the registration current. One company can be both the responsible person and the facility operator, but the obligations are tracked separately, because brands often contract out manufacturing to facilities they do not own.

Foreign Facilities and U.S. Agents

Any foreign facility making cosmetics for the U.S. market must register with the FDA and designate a U.S. agent physically located in the United States. The U.S. agent serves as the communication link with the FDA, assists with inspection scheduling, responds to questions about imported products, and receives documents when the FDA cannot reach the facility directly.²

The Small Business Exemption and Its Traps

Businesses with average gross annual cosmetic sales below $1,000,000 over the previous three years qualify as small businesses and are exempt from facility registration and product listing. The threshold started at $1 million when MoCRA took effect in late 2022 and is adjusted annually for inflation.³

The exemption disappears entirely, no matter the revenue, if the business makes or processes any of these product types:

Cosmetics that regularly contact the mucous membrane of the eye under normal use
Any cosmetic product that is injected
Cosmetics intended for internal use
Cosmetics intended to alter appearance for more than 24 hours where consumer removal is not part of normal use

A small company selling lip balm and body lotion may qualify. Add an eyelash adhesive to the catalog and the exemption vanishes for the entire operation. And the exemption only removes registration and listing. Even exempt small businesses must still comply with adverse event reporting, safety substantiation, and labeling rules.³

Safety Substantiation

Every responsible person must ensure adequate evidence exists that each cosmetic product is safe under its labeled or customary conditions of use, and must keep records supporting that conclusion.⁴ “Adequate substantiation” means tests, studies, research, analyses, or other evidence that qualified experts would consider sufficient to support a reasonable certainty of safety. That can include clinical studies, toxicological profiles of individual ingredients, published literature reviews, or a combination.

The statute defines “safe” to mean the cosmetic is not injurious to users under labeled or customary conditions. Minor and transient skin irritation in some users does not by itself make a product unsafe. The FDA may also consider cumulative exposure to a product or its ingredients when evaluating safety.⁴

A certificate of analysis from an ingredient supplier is a starting point, not the finish line. The responsible person has to demonstrate the finished formulation is safe, not just each raw material. Companies that historically relied on self-certification without supporting data now carry real regulatory exposure.

Adverse Event Reporting

The responsible person must submit a report to the FDA for any serious adverse event associated with a cosmetic product manufactured, packed, or distributed by that person and used in the United States. The report, together with a copy of the product label, has to reach the FDA within 15 business days of when the responsible person first receives it.⁵

Serious adverse events include any experience that is life-threatening, requires hospitalization, results in a persistent or significant disability, causes a birth defect, or requires medical intervention to prevent one of these outcomes. Records of all adverse event reports, not just serious ones, must be kept for six years. Small businesses that qualify under the exemption and don’t make the excluded product categories keep records for three years.⁵

Build a reliable complaint intake system. The 15-business-day clock starts when anyone at the company receives the report, not when a compliance officer reviews it. A customer complaint sitting unread in a general inbox can put you in violation.

Registering Your Facility and Listing Products

Facility registration and product listing are handled through Cosmetics Direct, a module within the FDA Direct electronic portal.⁶ There is no federal fee for registration.

Facility Registration

Before registering, the facility owner or operator must obtain an FDA Establishment Identifier (FEI), which is the facility’s unique tracking number in FDA systems. Facilities with an FEI from other FDA-regulated activities can reuse it.⁷ Registration has to be renewed every two years.⁸

Product Listing

Each product listing has to include:

The FEI for each facility where the product is manufactured or processed
The responsible person’s name and contact number, plus the product name as it appears on the label
The applicable cosmetic product category or categories
The full ingredient list, with each ingredient identified by regulatory or common name, including fragrances, flavors, and colors

Products with identical formulations that differ only in color, fragrance, flavor, or quantity can be grouped under a single listing submission. Product listings have to be updated annually, and the FDA offers an abbreviated renewal for listings with no changes. Discontinued products should be reported in the annual update.⁹

Labeling

Product labels must now include contact information so consumers can report adverse health events directly to the responsible person. Products intended solely for professional use, such as those sold to salons or spas, must be labeled to clearly state they are for professional use only.¹⁰

Fragrance Allergen Disclosure

MoCRA requires responsible persons to identify each fragrance allergen on the label. The specific substances that qualify as fragrance allergens are to be determined by the FDA through rulemaking. The statute directed the FDA to issue a proposed rule within 18 months of enactment (roughly mid-2024) and finalize it within 180 days after the comment period closes.¹⁰ As of early 2026, the FDA has not published the proposed rule, and the official allergen list remains pending. Once the final rule takes effect, reformulation or relabeling may be needed on short notice.

Talc, PFAS, and Good Manufacturing Practices

MoCRA directed the FDA to establish standardized methods for detecting and identifying asbestos in talc-containing cosmetic products. The FDA issued a proposed rule in late 2024.¹¹ Any company using talc should track this rulemaking, because the final rule will impose specific testing protocols.

MoCRA also required the FDA to assess the use of per- and polyfluoroalkyl substances (PFAS) in cosmetics and report to Congress. The FDA released the report and concluded there was insufficient data to determine PFAS safety in cosmetics, which signals possible further regulatory action.¹² Treat this as an early warning, not a clean bill of health.

On good manufacturing practices, the FDA has issued draft guidance but not yet finalized regulations.¹ Even without a final rule, the expectation is clear: sanitary conditions, documented production processes, and quality controls. Companies that wait for the final rule to build these systems will end up scrambling. Aligning operations with the draft guidance now makes the eventual compliance a matter of fine-tuning.

What the FDA Can Do When Companies Fall Short

Mandatory Recalls

Before MoCRA, the FDA could not order a cosmetic recall. That changed. If the FDA determines there is a reasonable probability that a cosmetic is adulterated or misbranded and that exposure will cause serious health consequences or death, it must first give the responsible person a chance to recall voluntarily. If the responsible person refuses or fails to act in the prescribed timeframe, the FDA can order the recall directly.¹³

Facility Suspension

The FDA can suspend a facility’s registration if a product from that facility has a reasonable probability of causing serious health consequences or death, and the agency has reason to believe other products from the same facility may be affected due to a failure that cannot be isolated. Once a facility’s registration is suspended, distributing or selling any cosmetics from that facility in the United States is illegal.¹ A suspension shuts down the entire cosmetic operation at that site, not just the problem product.

Records Access

The FDA can access and copy a company’s safety substantiation records when it has a reasonable belief that a cosmetic is likely adulterated in a way that threatens serious health consequences or death. This authority can be triggered by recalls, adverse event investigations, consumer complaints, or inspection findings.¹⁴ A company that cannot produce substantiation records on request faces potential legal and regulatory action.

Criminal Penalties

Violations of the Federal Food, Drug, and Cosmetic Act, including misbranding or distributing adulterated cosmetics, can carry criminal penalties. A first offense carries a fine of up to $1,000 and up to one year of imprisonment. A repeat offense, or any violation committed with intent to defraud or mislead, carries a fine of up to $10,000 and up to three years of imprisonment.¹⁵ The FDA can also pursue product seizures and injunctions through federal courts.

Deadlines Already in Force and Rules Still Coming

MoCRA was signed on December 29, 2022, as part of the Consolidated Appropriations Act of 2023. Different requirements phased in on different timelines:

Adverse event reporting: effective immediately on enactment
Safety substantiation: effective immediately on enactment
Facility registration: required by December 29, 2023, for facilities operating at enactment
Product listing: required by December 29, 2023, for products marketed at enactment; new products must be listed within 120 days of first entering the market⁹
Fragrance allergen labeling: pending FDA rulemaking, not finalized as of early 2026
Good manufacturing practices: pending FDA rulemaking; draft guidance issued
Asbestos in talc testing: proposed rule issued late 2024; final rule pending

Companies entering the U.S. market for the first time must comply with the active requirements before distributing products. The registration and listing deadlines have passed for existing businesses, so any company still unregistered is already behind and should submit through Cosmetics Direct now to reduce enforcement risk.

1
Food and Drug Administration. Modernization of Cosmetics Regulation Act of 2022 (MoCRA)
2
Food and Drug Administration. Guidance for Industry – Registration and Listing of Cosmetic Product Facilities and Products
3
Office of the Law Revision Counsel. 21 USC 364h – Small Businesses
4
Office of the Law Revision Counsel. 21 USC 364d – Safety Substantiation
5
GovInfo. 21 USC 364a – Adverse Events
6
FDA Direct. FDA Direct
7
Food and Drug Administration. Registration and Listing of Cosmetic Product Facilities and Products
8
Food and Drug Administration. Cosmetics Direct
9
Office of the Law Revision Counsel. 21 USC 364c – Registration and Product Listing
10
Office of the Law Revision Counsel. 21 USC 364e – Labeling
11
Food and Drug Administration. FDA Issues Proposed Rule on Testing Methods for Detecting and Identifying Asbestos in Talc-Containing Cosmetic Products
12
Food and Drug Administration. FDA Finds Insufficient Data to Determine Safety of PFAS in Cosmetic Products
13
Office of the Law Revision Counsel. 21 USC 364g – Mandatory Recall Authority
14
Food and Drug Administration. FDA Issues Draft Guidance for Industry – FDA Records Access Authority for Cosmetics Products
15
Office of the Law Revision Counsel. 21 USC 333 – Penalties