FDA MoCRA: Cosmetic Compliance & Registration¶
Before the Modernization of Cosmetics Regulation Act (MoCRA) was signed into law in December 2022, cosmetic manufacturers could legally sell products in the US without ever registering with the FDA or listing a single product ingredient. The FDA had no authority to recall unsafe cosmetics, no mandatory adverse event reporting system for cosmetics, and no requirement that manufacturers substantiate product safety. MoCRA changed all of that in a single legislative package — the most significant overhaul of US cosmetic regulation since the Federal Food, Drug, and Cosmetic Act of 1938.
MoCRA imposes mandatory facility registration, product listing, safety substantiation, adverse event reporting, and — for the first time — gives the FDA mandatory recall authority over cosmetics. On the Sustalium platform, the MoCRA-related compliance activity we see most is cosmetic brands and contract manufacturers reconciling their ingredient lists with the FDA's product listing format — because the FDA's electronic submission portal requires structured ingredient data, and most brands' internal records are not yet structured to match.
What MoCRA Requires¶
MoCRA applies to every cosmetic product manufactured or distributed in the United States, including imported products. The law introduced five major new obligations:
1. Facility Registration (Mandatory)¶
Every facility that manufactures or processes cosmetic products distributed in the US must register with the FDA. Registration must be renewed every two years. The registration must include:
- Facility name, physical address, and contact information
- All brand names under which cosmetics manufactured at the facility are sold
- Product categories manufactured at the facility
- Name of the Responsible Person for the facility
Deadline: FDA's registration portal opened in December 2023. Existing facilities were required to register by July 1, 2024. New facilities must register within 60 days of beginning operations.
2. Product Listing (Mandatory)¶
For each cosmetic product, the Responsible Person must submit a product listing to the FDA that includes:
- The facility registration number of the manufacturing facility
- Product name and brand name
- Product category (from FDA's standardized list)
- List of ingredients (including fragrances, flavors, and colors)
- A product label image
Deadline: Existing products must be listed by December 29, 2024. New products must be listed within 120 days of first marketing.
As of 2025, the FDA reported that thousands of cosmetic facilities had registered and hundreds of thousands of individual product listings had been submitted — but an estimated 20-30% of smaller manufacturers had not yet fully completed their listings.
3. Safety Substantiation (Self-Declaration)¶
The Responsible Person must ensure and document that there is adequate substantiation of the safety of each cosmetic product. This is a self-declaration obligation — the FDA does not pre-approve cosmetic safety — but the manufacturer must maintain records demonstrating that qualified experts have evaluated the product and concluded it is safe under labeled conditions of use.
Adequate safety substantiation typically includes: - Toxicological profile of each ingredient at its concentration in the product - Review of any known adverse reactions or safety concerns - Assessment of the finished product under its intended use conditions - Documentation of the qualified expert's qualifications and their safety conclusion
4. Adverse Event Reporting (Mandatory)¶
The Responsible Person must report serious adverse events to the FDA within 15 business days of receiving the report. A serious adverse event is one that results in death, life-threatening experience, hospitalization, disability, birth defect, infection, or significant disfigurement. Records of all adverse events — serious and non-serious — must be maintained for at least 6 years.
5. Mandatory Recall Authority¶
For the first time, the FDA now has the authority to order a mandatory recall of a cosmetic product if the agency determines there is a reasonable probability that the product is adulterated or misbranded and that exposure to the product will cause serious adverse health consequences. Previously, the FDA could only request a voluntary recall for cosmetics.
Who Is the Responsible Person?¶
Under MoCRA, the "Responsible Person" is the manufacturer, packer, or distributor whose name appears on the product label. For imported cosmetics where no US entity appears on the label, the Responsible Person is the US importer. This creates a specific obligation for non-US brands selling cosmetics into the US market: either a US-based entity must appear on the label, or a US importer assumes the Responsible Person role — including the obligation to register the facility, list the product, and report adverse events.
FDA Enforcement Under MoCRA¶
The FDA has been actively enforcing MoCRA since the registration and listing deadlines passed. Key enforcement developments include:
- Facility registration enforcement: The FDA began issuing warning letters in 2025 to facilities that had not registered or had not renewed their registration within the two-year cycle.
- Product listing enforcement: Manufacturers that had registered their facilities but failed to list individual products received FDA compliance notices.
- GMP rulemaking: MoCRA required the FDA to promulgate Good Manufacturing Practice (GMP) regulations for cosmetics by December 2024. The FDA published its proposed rule in 2024, with the final rule expected to establish detailed facility, equipment, personnel, and production standards.
- Fragrance allergen labeling: MoCRA requires the FDA to identify fragrance allergens that must be individually listed on cosmetic labels (beyond the current "fragrance" catch-all). The FDA published its proposed list in 2024.
How Sustalium Supports MoCRA Compliance¶
The administrative burden of MoCRA — tracking facility registrations and renewals, listing every product with structured ingredient data, maintaining safety substantiation records, and integrating adverse event reporting — becomes substantial for any brand with more than a handful of SKUs.
Sustalium's FDA MoCRA compliance platform addresses this:
- Facility Registration & Renewal Tracking: Link your manufacturing facilities to your account. Sustalium tracks registration status, renewal deadlines, and registration numbers for each facility — and provides automated reminders before registration lapses.
- Product Listing Builder: Enter your product ingredient lists once, structured by INCI name and concentration. Sustalium formats the data for FDA product listing submission and maintains a current registry of all listed products, including their listing confirmation numbers.
- Safety Substantiation Document Management: Link toxicological assessments, expert safety reviews, and adverse event investigations to each product SKU. When the FDA or a buyer requests evidence of safety substantiation, the documentation is organized and retrievable — not scattered across emails and shared drives.
- Adverse Event Logging: Record and track adverse events with automatic flagging of serious events that trigger the 15-day reporting deadline. Maintain the mandatory 6-year record retention in a structured, searchable format.
- Integrated Cosmetic Compliance: MoCRA documentation sits alongside your product safety declarations, supplier ingredient certifications, and any EU Cosmetic Product Safety Reports (CPSR) — creating a single compliance hub for your cosmetic product lines.
Get Your MoCRA Compliance in Order Before FDA Issues Your Warning Letter
Facility registration and product listing are mandatory — and the FDA is actively enforcing compliance. Don't wait for a regulatory notice to organize your cosmetic compliance documentation.
With Sustalium, build your MoCRA product listing and facility registration profile for just €10 per document.
Frequently Asked Questions¶
Does MoCRA apply to small businesses?
Yes. While MoCRA provides certain exemptions for small businesses (defined as those with less than $1 million in average annual gross sales), the exemptions are limited. Small businesses are exempt from GMP requirements and from facility registration and product listing for certain products, but they are NOT exempt from safety substantiation, adverse event reporting, or mandatory recall provisions.
Is an EU Cosmetic Product Safety Report (CPSR) sufficient for MoCRA safety substantiation?
No. While the CPSR and MoCRA safety substantiation requirements are conceptually similar, they operate under different regulatory standards and different responsible person definitions. The CPSR is structured under EU Cosmetics Regulation (EC) 1223/2009 and follows EU-specific guidance. MoCRA requires safety substantiation under FDA standards by a US Responsible Person. An existing CPSR can inform the MoCRA safety review but does not replace it.
What happens if I don't register my facility or list my products?
The FDA can issue a warning letter, which becomes a public record. Continued non-compliance can result in product detention at the border (for imported products), mandatory recall, and civil or criminal enforcement action. Additionally, non-compliance with MoCRA is increasingly flagged in retailer and distributor audits — meaning market access can be blocked before the FDA ever gets involved.
Do contract manufacturers need to register separately from brand owners?
Yes. If a contract manufacturer operates a facility that processes cosmetic products, that facility must be registered with the FDA regardless of whether the brand owner separately registers. The facility registration is tied to the physical manufacturing location, not the brand.
Last updated: July 20, 2026