FDA cosmetic regulations under MoCRA represent the most significant change to US cosmetic oversight in more than eighty years, and brands still operating as though the FDA has no enforcement teeth are exposed to real market and legal risk. The Modernization of Cosmetics Regulation Act of 2022 (MoCRA), signed into law on December 29, 2022, replaced a system built almost entirely on voluntary participation with mandatory facility registration, product listing, adverse event reporting, and safety substantiation — backed, for the first time, by FDA mandatory recall authority. Non-compliance can mean a product being deemed misbranded or adulterated, blocked at US ports of entry, or pulled from the market entirely. This guide explains what changed, who must comply, and how to build a MoCRA-compliant programme, reflecting FDA guidance published through 2024.
What MoCRA Is and Why It Exists
Before MoCRA, FDA oversight of cosmetics rested on the Federal Food, Drug, and Cosmetic Act of 1938 and the Fair Packaging and Labeling Act — statutes that gave the FDA authority to act against adulterated or misbranded products after the fact, but no authority to require facility registration, mandate recalls, or compel safety data before a product reached shelves. Facility registration and product listing existed only through the FDA's Voluntary Cosmetic Registration Program, and participation rates were low relative to the size of the industry.
MoCRA closes that gap. It was passed as part of a broader government funding package in December 2022, following years of advocacy from consumer safety groups and, notably, from major segments of the cosmetics industry itself, which had grown concerned about inconsistent state-level regulation filling the federal vacuum. The result is a federal framework that finally gives the FDA visibility into who manufactures cosmetics in the United States, what products are on the market, and what happens when those products cause harm — while also preempting a patchwork of conflicting state safety substantiation and adverse event reporting requirements.
Scope: Who MoCRA Applies To and Which Products Are Covered
MoCRA applies to "responsible persons" — the manufacturer, packer, or distributor whose name appears on a cosmetic product label — and to the facilities that manufacture or process cosmetics for the US market, regardless of whether that facility is located domestically or overseas. The definition of "cosmetic" under MoCRA follows the existing FD&C Act definition: articles intended to be rubbed, poured, sprinkled, or sprayed on, introduced into, or otherwise applied to the human body for cleansing, beautifying, promoting attractiveness, or altering appearance. Soap that meets a narrow regulatory definition remains largely outside MoCRA's core registration provisions.
A limited small business exemption applies to facility registration and product listing, but the exemption has hard edges that trip up brands who assume it covers them fully.
| Category | MoCRA Status | Practical Note |
|---|---|---|
| Facility < $1M average annual US sales, standard products | Exempt from registration/listing only | Still subject to adverse event reporting, safety substantiation, records |
| Facility manufacturing eye-area, injectable, internal-use, or >24-hour appearance-altering products | Not exempt regardless of revenue | Common trap for small injectable-adjacent and lash/brow tint brands |
| Talc-containing products | Subject to mandatory asbestos testing method requirements | FDA method guidance applies irrespective of business size |
| PFAS-containing products | Subject to FDA study and forthcoming action | Monitor FDA's PFAS report to Congress for regulatory direction |
Foreign manufacturers exporting finished cosmetics into the US carry the same facility registration obligation as domestic manufacturers, and importers should confirm that every overseas facility in their supply chain has a current FDA registration number before shipment — customs holds on unregistered-facility products are already occurring.
Key Requirements: What MoCRA Demands of Cosmetic Companies
MoCRA's obligations cluster around five pillars: facility registration, product listing, safety substantiation, adverse event reporting and recordkeeping, and (once finalized) Good Manufacturing Practice compliance. Each pillar carries its own timeline and its own responsible party, and brands that treat MoCRA as a single one-time filing exercise typically miss at least one of these ongoing obligations.
- Facility registration — every facility manufacturing or processing cosmetics for the US market must register with the FDA and renew that registration every two years.
- Product listing — the responsible person must list each cosmetic product, including its ingredients, with the FDA and update the listing annually or when the formulation materially changes.
- Safety substantiation — the responsible person must maintain records supporting a reasonable certainty that the product is safe under labeled or customary conditions of use.
- Adverse event reporting — serious adverse events must be reported to the FDA within 15 business days, with records retained for six years (three years for small businesses).
- Good Manufacturing Practice — the FDA is finalizing GMP regulations that will apply to facility operations once the rule takes effect.
Two of these — registration and listing — are submitted through the FDA's electronic Cosmetics Direct portal, which functions as the single point of entry for both obligations and replaces the old voluntary program entirely.
Testing and Documentation Requirements
MoCRA does not prescribe a fixed battery of safety tests the way some ingredient-specific regulations do. Instead, it requires the responsible person to hold "adequate substantiation" — a standard the FDA has described as evidence, which could include toxicological risk assessment, history of safe ingredient use, or product testing, sufficient to support a reasonable certainty of safety. The burden is on the company to build and retain a defensible file, not to await an FDA-issued checklist.
For brands already selling into the EU, the existing Cosmetic Product Safety Report built for Regulation 1223/2009 substantially overlaps with what MoCRA substantiation requires, though the two are not automatically interchangeable and should be cross-checked against FDA's specific safety standard. Documentation that should sit in every product's substantiation file includes an ingredient-by-ingredient safety rationale, any relevant third-party test reports, a record of the responsible person's identity and contact information, and — where the product contains talc — records demonstrating compliance with the FDA's mandated asbestos testing method for talc-containing cosmetics.
Facilities should also retain adverse event records for the statutory period, currently six years for most businesses and three years for small businesses as defined under MoCRA's revenue threshold, and be prepared to produce these records on FDA request without delay.
Step-by-Step MoCRA Compliance Pathway
Building a MoCRA compliance programme from scratch is a structured, sequential exercise. The following pathway reflects the order most companies find practical, starting from determining exemption status through to ongoing maintenance.
- Determine facility and product exemption status. Confirm whether the facility qualifies for the small business exemption, and separately confirm that none of its products fall into the categories — eye-area, injectable, internal-use, or long-duration appearance-altering products — that void the exemption regardless of revenue.
- Register every manufacturing or processing facility. Submit facility registration through the FDA's Cosmetics Direct portal for each site producing product for the US market, including contract manufacturers and overseas facilities.
- Compile and submit product listings. For each product, list the ingredients, the facility of manufacture, and the responsible person, and submit through Cosmetics Direct.
- Build the safety substantiation file. Assemble ingredient safety rationale, test data, and any relevant CPSR-equivalent documentation for each formulation, and retain it in a form retrievable on FDA request.
- Establish an adverse event intake and reporting process. Create a system for logging consumer complaints, screening them against the MoCRA serious adverse event definition, and reporting qualifying events to the FDA within 15 business days.
- Monitor GMP rulemaking and prepare operationally. Track the FDA's cosmetic GMP proposed and final rules, and begin aligning manufacturing controls, even before the compliance deadline, to avoid a compressed implementation window.
Realistic Timeline and Cost Expectations
For a company already selling in a regulated cosmetics market such as the EU, MoCRA compliance is a moderate lift — much of the underlying safety documentation already exists and needs reformatting and cross-referencing rather than generating from zero. For a brand entering formal regulatory compliance for the first time, budget a longer runway: assembling a full ingredient safety substantiation file across a multi-product portfolio commonly takes two to four months when done properly, particularly where legacy formulations lack organized toxicological documentation.
Cost categories include internal or consultant time to compile facility and product listing data, the cost of any new toxicological risk assessments needed to fill substantiation gaps, and the ongoing administrative cost of maintaining the adverse event reporting system and biennial facility registration renewal. Registration and listing submissions through Cosmetics Direct carry no FDA filing fee, which keeps the direct cost of the registration step itself low relative to the documentation work behind it.
The largest unbudgeted cost for many companies is GMP readiness. Because the FDA's cosmetic GMP rule was still working through rulemaking as of this writing, companies that wait for the final rule before beginning any operational changes risk a compressed compliance window once the effective date is set. Building basic batch record, equipment maintenance, and personnel hygiene documentation now — even before GMP is finalized — meaningfully reduces that later cost and time pressure.
Common Mistakes Cosmetic Companies Make Under MoCRA — and How to Avoid Them
Most MoCRA non-compliance is not deliberate; it stems from treating a new, multi-part federal statute as if it were a single form to file. The recurring failure patterns below account for the large majority of the gaps found during compliance reviews.
Assuming Small Business Status Exempts the Whole Programme
The small business exemption applies only to facility registration and product listing. Companies under the revenue threshold still owe adverse event reporting, safety substantiation, and recordkeeping in full, and many assume incorrectly that falling under $1,000,000 in average annual US sales removes them from MoCRA entirely.
Missing the Exemption-Voiding Product Categories
A small brand that otherwise qualifies for the registration exemption loses it entirely if even one product in its line touches the eye mucosa, is injected, is intended for internal use, or is designed to alter appearance for more than 24 hours — lash and brow tints are a frequent trigger here. Companies should audit their full catalogue against these categories rather than assuming exemption applies uniformly across the brand.
Treating Overseas Contract Manufacturers as Outside FDA's Reach
Foreign facilities manufacturing finished cosmetics for the US market carry the same registration obligation as domestic facilities. Brands using overseas contract manufacturers should confirm registration status directly rather than assuming the manufacturer has already handled it — unregistered-facility shipments are subject to import refusal at US ports of entry.
No Adverse Event Intake Process
The 15-business-day reporting clock starts when the responsible person receives a report of a serious adverse event — not when someone gets around to reviewing customer service emails. Companies without a defined intake and medical-judgment screening process risk missing the reporting deadline simply through administrative delay, which is itself a compliance failure independent of the underlying event.
For related formulation background, the Global Formulation guide to cosmetics and personal care formulation fundamentals covers ingredient categories most likely to raise substantiation questions, and the guide to EU Cosmetics Regulation 1223/2009 is a useful comparison point for companies building parallel US and EU compliance programmes. Official MoCRA guidance is maintained by the FDA at fda.gov/cosmetics/cosmetics-laws-regulations/modernization-cosmetics-regulation-act-2022, with industry technical resources available through the Personal Care Products Council.