FDA Cosmetics Regulation and MoCRA

If you make or sell cosmetics in the United States, MoCRA is the law you now answer to. The Modernization of Cosmetics Regulation Act, signed at the end of 2022, is the biggest expansion of FDA authority over cosmetics since 1938, and it turned a lightly regulated industry into one with real registration, safety, and reporting obligations. For a brand founder, it comes down to three questions: are you the “Responsible Person,” are you small enough to skip some of it, and have you done what the parts you cannot skip require.

This is general educational information, not legal advice. Regulatory deadlines and rules shift, so confirm the current requirements with the FDA or a cosmetics regulatory professional before you rely on any of this.

---

What MoCRA changed

Before MoCRA, the FDA had strikingly little power over cosmetics. It could not require companies to register, could not demand safety records, and could not order a recall. MoCRA changed all of that at once, giving the agency mandatory recall authority, access to safety records, and a set of obligations that every cosmetics company now has to meet. It is the reason a beauty brand that launched with almost no federal paperwork a few years ago suddenly has a compliance checklist.

Who counts as the “Responsible Person”

Most of MoCRA’s duties fall on the Responsible Person, which the law defines as the manufacturer, packer, or distributor whose name appears on the product label. For most indie beauty brands, that is you. Even if a contract manufacturer makes your product, if your brand name is on the label, you are almost certainly the Responsible Person and the obligations below are yours to meet.

What MoCRA requires

Facility registration. Any facility that manufactures or processes cosmetics for US sale must register with the FDA and renew every two years. To register you need a free DUNS number for the site (each physical location has its own, from Dun & Bradstreet), plus the facility’s contact, a US agent if the facility is outside the US, and the responsible-person names and product categories tied to it. The FDA gives the facility an identifier called an FEI number. If you use a contract manufacturer, that registration is usually theirs, not yours, but confirm it is done, because a product made in an unregistered or suspended facility cannot legally be sold.

Product listing. The Responsible Person must list every marketed product with the FDA, including its full ingredient list, and update the listing annually. Each listing ties a product to the facility that makes it, its product category, and the responsible person, and it covers free samples and gifts too. Listing is done through the FDA’s online portal, Cosmetics Direct, or on paper with Form FDA 5067.

Safety substantiation. You must keep records showing adequate substantiation that each product is safe. The law does not mandate any specific test, and animal testing is not required, but the data behind your safety claim has to come from scientifically sound methods. This obligation applies even to the smallest businesses.

Adverse event reporting. You must report serious adverse events to the FDA within 15 business days, with a copy of the product label. “Serious” means outcomes like hospitalization, significant disfigurement, serious or persistent rashes, significant hair loss, or anything requiring medical intervention. You also have to keep records of these reports.

Labeling. Your label must give consumers a way to report an adverse event, meaning a domestic contact. Two more labeling requirements are still being written by the FDA: a fragrance-allergen disclosure rule and professional-use product labeling.

Recalls and records access. The FDA can now order a mandatory recall if a product is dangerous and the company will not pull it voluntarily, and it can access your safety records during an inspection. Both powers are new under MoCRA.

The small business exemption

If your average gross annual cosmetics sales in the US over the previous three years are under $1 million, you qualify as a small business and are exempt from three of the heaviest requirements: good manufacturing practice rules, facility registration, and product listing. You are still fully on the hook for safety substantiation, adverse event reporting, and labeling, so the exemption lightens the paperwork, it does not remove the safety duties.

The exemption also has one hard exception: a few higher-risk product types never qualify no matter how small you are, meaning anything that touches the eye area, is injected, is for internal use, or alters appearance for more than 24 hours (like a long-wear or semi-permanent product). If you sell that kind of product, you register and list regardless of size.

Where things stand in 2026

Registration and product listing have been enforced since July 1, 2024, after the FDA pushed back the original end-of-2023 deadline to give companies time. Adverse event reporting, safety substantiation, and the recall authority are all in effect now. The good manufacturing practice rule and the fragrance-allergen labeling rule are still working their way through rulemaking and have been delayed more than once, with proposed versions pushed toward 2026, so those are the ones to keep watching. The FDA published its report on PFAS in cosmetics at the end of 2025.

What to actually do

Confirm you are the Responsible Person. If your brand name is on the label, assume you are.

Check your size and product type. Under $1 million in average annual US cosmetics sales makes you a small business, unless you make one of the higher-risk products that never qualify (the ones described in the small business exemption above).

Handle facility registration. Get a free DUNS number for the site, gather your facility, responsible-person, and product-category details, then register through Cosmetics Direct online, or on Form FDA 5066. If a contract manufacturer makes your product, confirm they registered instead. Renew every two years.

List your products. For each product, submit its name, full ingredients, product category, and the facility that makes it through Cosmetics Direct, then update the listing annually, unless you qualify for the small-business exemption.

Build a safety file. Keep sound, scientifically grounded data behind the safety claim for every product.

Set up an adverse-event process. Put a working contact for reports on your labels, and be ready to report serious events to the FDA within 15 business days.

Watch the pending rules. Keep an eye on the good manufacturing practice and fragrance-allergen rules so you are ready when they land.

When you are ready to actually file, the FDA’s registration and listing page walks through the process step by step, and you submit through the Cosmetics Direct portal. If you are a small or homemade brand, the FDA’s small businesses and homemade cosmetics fact sheet spells out exactly what does and does not apply to you.

Frequently Asked Questions

What is MoCRA?

MoCRA is the Modernization of Cosmetics Regulation Act of 2022, the first major update to US cosmetics law since 1938. It gives the FDA new authority over cosmetics, including mandatory recalls and records access, and it requires companies to register facilities, list products, substantiate safety, and report serious adverse events.

Do I have to register with the FDA to sell cosmetics?

If you manufacture or process cosmetics, your facility must register with the FDA, and the Responsible Person must list each product, unless you qualify as a small business (under $1 million in average annual US cosmetics sales over the prior three years). Small businesses are exempt from registration and listing but not from safety substantiation, adverse event reporting, or labeling. Certain product types never qualify for that exemption.

What is a “Responsible Person” under MoCRA?

The Responsible Person is the manufacturer, packer, or distributor whose name appears on the product label. For most beauty brands, that is the brand owner, even when a contract manufacturer makes the product. The Responsible Person carries most of MoCRA’s obligations, including product listing, safety substantiation, and adverse event reporting.

Are small cosmetics businesses exempt from MoCRA?

Partly. Businesses under $1 million in average annual US cosmetics sales over the prior three years are exempt from good manufacturing practice rules, facility registration, and product listing. They still have to substantiate safety, report serious adverse events, and meet labeling rules. The exemption does not apply to eye-area, injected, internal-use, or long-wear appearance-altering products.

Does MoCRA require animal testing?

No. MoCRA requires that you substantiate the safety of your products, but it does not mandate any specific test, and it does not require animal testing. You can use existing, scientifically sound safety data to support a product.

Sources

• FDA, “Modernization of Cosmetics Regulation Act of 2022 (MoCRA)”. The official overview of MoCRA’s requirements, definitions, and small-business exemptions.
• FDA, “Registration & Listing of Cosmetic Product Facilities and Products”. Facility registration, product listing, and the Cosmetics Direct portal.
• FDA, “Form FDA 5066 - Registration of Cosmetic Product Facility”. The data required to register a facility, including the DUNS number and FEI.
• FDA, “Form FDA 5067 - Cosmetic Product Listing”. The data required to list each product.
• FDA, “Deadline for Registration and Listing of Cosmetic Product Facilities and Products”. The July 1, 2024 enforcement date and renewal requirements.
• Focal Point, “FDA Announces Updated Timelines for Key Cosmetic Regulations”. The delayed timelines for the GMP and fragrance-allergen rules.