MoCRA: How US Cosmetics Compliance Works
MoCRA is the biggest update to U.S. cosmetics regulation in over 80 years. Here's what it requires, who it applies to, and what your brand should be doing about it right now
For decades, the U.S. cosmetics industry operated with remarkably little federal oversight. The FDA had authority over cosmetics in theory, but the regulatory framework hadn't been meaningfully updated since the Federal Food, Drug, and Cosmetic Act was passed in 1938. Brands didn't have to register facilities, list products, or report adverse events. If your label didn't make drug claims and your product didn't contain banned color additives, you were largely on your own.
That changed on December 29, 2022, when the Modernization of Cosmetics Regulation Act, better known as MoCRA, was signed into law. It's the most significant expansion of the FDA's authority over cosmetics in over 80 years, and it affects every brand selling cosmetic products in the United States, whether you're a multinational conglomerate or an indie brand running out of a co-packer's facility.
If you're still sorting out what MoCRA actually requires, this guide walks through the key provisions, who they apply to, and what you should be doing about it right now.
What MoCRA Changed
Before MoCRA, the FDA's cosmetics oversight was largely reactive. The agency could take action against unsafe products, but it had limited tools to proactively monitor what was on the market. MoCRA flipped that dynamic by introducing a set of requirements that bring the cosmetics industry closer to how the FDA already regulates food, drugs, and medical devices.
The major new requirements include mandatory facility registration with the FDA for any domestic or foreign facility that manufactures or processes cosmetics distributed in the U.S., mandatory product listing for every cosmetic product on the market, serious adverse event reporting within 15 business days, safety substantiation records that must be maintained and made available to the FDA, labeling updates including contact information for the responsible person, upcoming Good Manufacturing Practice (GMP) regulations, and future rules around fragrance allergen disclosure and talc testing.
These aren't suggestions. They're legal requirements, and the FDA began enforcement on July 1, 2024, after a six-month grace period.
Who Counts as a Responsible Person
MoCRA introduces the concept of a "responsible person," which is defined as the manufacturer, packer, or distributor whose name appears on the product label. This is the entity that carries the legal obligations under MoCRA, including facility registration, product listing, adverse event reporting, labeling compliance, and safety substantiation.
For most indie brands, the responsible person is the brand itself, since the brand name is what appears on the label. But this is where things get operationally complex. If you're using a contract manufacturer, both your facility and the contract manufacturer's facility may need to be registered. If you're importing products from overseas (common for K-beauty brands entering the U.S.), the foreign manufacturing facility needs to be registered with the FDA and must designate a U.S. agent if they meet the threshold FDA registration requirements.
Understanding who the responsible person is for each product in your line is the first step in MoCRA compliance. Get this wrong, and everything downstream, from your facility registration to your product listings, will be filed incorrectly and subject to penalties and losing access to the US market for cosmetics.
Facility Registration
Every facility (with domestic revenues greater than $1 million USD) that manufactures or processes cosmetic products for distribution in the U.S. must be registered with the FDA. This applies to domestic facilities and foreign facilities alike. Foreign facilities are additionally required to designate a U.S. agent who can serve as the FDA's point of contact.
Registration is done through the FDA's Cosmetics Direct portal and must be renewed biennially. The information you'll need to provide includes the facility name and address, the owner or operator's name, the FDA Establishment Identifier (FEI number), all brand names associated with products manufactured at the facility, and the product categories for each cosmetic product made there.
A few things worth noting: if you need an FEI number and don't have one, you'll need to request it from the FDA (Noedal can do this for you) before you can complete your registration. Also, facilities that only perform labeling, relabeling, packaging, repackaging, holding, or distributing are excluded from the registration requirement (though the packaging exclusion doesn't extend to filling product containers). Salons, retailers, and healthcare facilities are also excluded.
Product Listing
In addition to registering facilities, the responsible person must submit a product listing for every cosmetic product distributed in the U.S. This is done through the same Cosmetics Direct portal.
For each product, you'll need to provide the marketed product name and category, a full list of ingredients using INCI naming conventions (including fragrances, flavors, and colors), the FEI numbers for all facilities where the product is manufactured or processed, the responsible person's name and contact information, and a copy of the product label.
Product listings need to be updated when anything material changes, such as a reformulation, a new manufacturing facility, or updated labeling. The FDA will assign a product listing number to each submission, which is kept confidential and not publicly disclosed.
One detail that catches brands off guard: free samples and gifts intended for consumers also require product listings. The only exception is samples distributed within the industry for research and development purposes that aren't intended for consumer use.
The Small Business Exemption
MoCRA does include an exemption for small businesses, but it's narrower than many brands assume. To qualify, your average annual gross sales of cosmetic products in the U.S. over the previous three years must be less than $1 million (adjusted for inflation). If you meet this threshold, you're exempt from facility registration, product listing, and GMP requirements.
However, the exemption has hard limits. If you manufacture or sell even one product that falls into certain high-risk categories, you lose the exemption entirely for your whole business. Those categories include products that regularly come into contact with the mucus membrane of the eye (the FDA has expanded this to include eye shadow, not just eyeliner and mascara), products that are injected, products intended for internal use, and products that alter appearance for more than 24 hours where removal by the consumer isn't part of normal use.
Even if you do qualify for the small business exemption, you're still subject to adverse event reporting requirements (with a shorter three-year record retention period instead of six), labeling requirements, and the prohibition against adulterated or misbranded products. The exemption reduces your administrative burden, but it doesn't take you off the FDA's radar entirely. That's not even to mention that most large distributors like Amazon, TJ Maxx, and Costco require MoCRA registration regardless of whether you qualify for the small business exemption.
Adverse Event Reporting
This is the requirement that applies to everyone, regardless of size. If a serious adverse event is associated with one of your products, you must report it to the FDA within 15 business days. A serious adverse event is defined as any health-related event that results in death, a life-threatening experience, inpatient hospitalization, a persistent or significant disability or incapacity, a congenital anomaly or birth defect, or an infection, or requires medical or surgical intervention to prevent one of these outcomes.
The report must include a copy of the product label. If you receive additional medical or other information about the adverse event within one year of the initial report, you must submit that follow-up information to the FDA within 15 business days as well.
You're also required to maintain records of all adverse events (not just serious ones) for six years, or three years if you qualify as a small business.
Safety Substantiation
MoCRA requires that every cosmetic product on the market have "adequate substantiation" of safety. The law defines this as tests, studies, research, analyses, or other evidence that, considered by qualified scientific experts, supports the reasonable certainty that the product is safe.
The FDA hasn't issued detailed guidance yet on exactly what this looks like in practice, which means brands need to develop their own policies and documentation. The key is that you need records demonstrating that safety substantiation exists for each product. This doesn't necessarily require new testing for every product. You can rely on existing data, published literature, and ingredient safety profiles. But you need to have it documented and available if the FDA asks.
For brands that work with contract manufacturers, this is an area where clear communication and documentation practices matter. Your manufacturer should be able to provide ingredient safety data, stability testing, and any relevant challenge testing. If that data isn't centralized and organized somewhere accessible, you're going to struggle to demonstrate compliance.
This is one of the areas where Noedal adds the most value. The platform is built around centralizing exactly this kind of documentation: ingredient files from manufacturers, formulation records, safety data, and compliance filings. When your manufacturer uploads ingredient files directly through Noedal's collaboration portal, that data becomes part of your compliance record from day one. You're not scrambling to assemble documentation after the fact. It's already there.
Labeling Requirements
As of December 29, 2024, all cosmetic product labels must include contact information for the responsible person, enabling consumers to report adverse events. This is a domestic phone number, email address, or mailing address.
Future labeling requirements are also in the pipeline. MoCRA mandates that the FDA establish rules around fragrance allergen disclosure on labels, bringing the U.S. closer to the EU's approach of requiring individual allergen listings. The FDA has been working on a proposed rule for this, though timelines have been pushed back. As of the most recent regulatory agenda, the proposed rule is expected in 2026.
Brands should start preparing for fragrance allergen labeling now, even though the final rule hasn't been issued. If you're already selling in the EU, you're likely already tracking allergens for CPNP compliance, and that data will be directly relevant when the U.S. requirement takes effect.
Good Manufacturing Practices
MoCRA directed the FDA to establish binding GMP regulations for cosmetic manufacturing facilities. The original congressional timeline called for a proposed rule by December 2024 and a final rule by December 2025. Both deadlines have slipped, and the GMP rulemaking has been moved to the FDA's "long-term actions" list, suggesting further delays.
That said, the direction is clear. When GMP regulations are finalized, cosmetic products manufactured in facilities that don't comply will be considered adulterated under the FD&C Act. The FDA has indicated that the regulations will be broadly consistent with ISO 22716, which is the same GMP standard used in the EU.
Brands that are already selling in the EU and maintaining GMP compliance for their PIF documentation will have a head start. For everyone else, this is worth getting ahead of. Building quality management systems, standard operating procedures, and documentation practices now will be much less painful than scrambling to comply once the rule is finalized.
What This Means for International Brands
MoCRA applies to anyone selling cosmetic products in the U.S., regardless of where the products are manufactured. For Korean brands, European brands, and other international companies looking to enter or expand in the American market, the requirements are the same.
Foreign manufacturing facilities must register with the FDA and designate a U.S. agent. Product listings must be filed for every product sold in the U.S. The responsible person (typically the U.S. importer or distributor whose name is on the label) is on the hook for adverse event reporting, safety substantiation, and labeling compliance.
For Korean cosmetics brands in particular, this can feel like a lot to manage on top of the compliance requirements they're already handling at home with MFDS. And if those same brands are also selling in the EU and the UK, they're now juggling MoCRA, CPNP, and SCPN across three separate regulatory frameworks, each with its own filing portal, responsible person requirements, and evolving ingredient rules.
This is the problem Noedal was built to solve. The platform automates the MoCRA compliance process end to end, from facility registration and product listing to ongoing regulatory monitoring. Brands connect with their manufacturers through the platform, ingredient data flows in directly, and filings are handled without the back-and-forth emails and spreadsheet tracking that most brands are still relying on. Once you're set up, it runs in the background. You focus on selling products. Noedal makes sure the compliance side stays current.
What's Still Coming
MoCRA is still being implemented. Several major provisions are still working through the rulemaking process. Fragrance allergen labeling rules are expected in proposed form by 2026. GMP regulations are on the long-term agenda with no firm timeline. Talc testing standards have a proposed rule in progress. And the FDA published its first report on PFAS in cosmetics in December 2025, which could lead to additional regulatory action down the road.
The regulatory landscape for U.S. cosmetics is going to keep evolving over the next several years. Brands that build compliance infrastructure now, rather than reacting to each new rule as it drops, will be in a much stronger position.
Next Steps
If you're not yet compliant with MoCRA, here's what to prioritize.
Determine who the responsible person is for each of your products. This is the entity whose name appears on the label, and they carry the legal obligations.
Register your manufacturing facilities through FDA's Cosmetics Direct portal. If you're using a foreign manufacturer, make sure they've registered and designated a U.S. agent.
File product listings for every cosmetic product you distribute in the U.S., including free samples intended for consumers.
Update your labels to include the responsible person's contact information if you haven't already.
Set up an adverse event reporting process. You need a system for capturing, documenting, and reporting serious adverse events within 15 business days.
Organize your safety substantiation records. Make sure you can demonstrate that each product has adequate evidence of safety, documented and accessible.
Start preparing for GMP compliance. Even though the final rule hasn't been issued, the direction is clear, and the work you do now will pay off.
And if you'd rather not manage all of this manually, Noedal can handle it all for you. The platform was purpose-built for this exact workflow. You can learn more at noedal.com.
