MoCRA Compliance for Cosmetics: What Brands Must File in 2026

Chart by GZ Cosmetics Lab · Free to reuse with a link back to this page.

If you sell cosmetics in the United States, MoCRA compliance is no longer something your manufacturer handles quietly in the background. The Modernization of Cosmetics Regulation Act of 2022 separates facility obligations from the duties of the responsible person named on the product label. Where registration and listing are required, the facility owner or operator is responsible for facility registration, and the responsible person must submit, or ensure submission of, the product listing. Exemptions and authorised submission arrangements matter; an agreement that someone else will file does not settle who is accountable.

This guide is written for brand owners and sourcing managers who are producing overseas and shipping into the US. It covers what each side actually owes, the dates that matter, what you should demand from a manufacturer in writing, and two claims about FDA registration that circulate constantly in supplier sales decks and are simply not true. We include our own registration details as a worked example, because it is easier to explain what a real registration looks like than to describe one in the abstract.

What MoCRA Changed, in One Paragraph

MoCRA was signed on 29 December 2022 as part of Public Law 117-328. Before it, cosmetics were the least regulated product category the FDA touched: there was no mandatory facility registration, no mandatory product listing, and no requirement to hold safety substantiation on file. MoCRA introduced all three, added mandatory serious adverse event reporting, gave the FDA mandatory recall authority, and directed the agency to write binding good manufacturing practice regulations. The old Voluntary Cosmetic Registration Program, which some brands still reference, stopped accepting submissions on 27 March 2023 and its data was not carried across to the new system. If your compliance file still says "VCRP", it is three years out of date.

One structural point matters more than any individual rule: MoCRA does not create product approval. The FDA does not approve cosmetics, does not approve facilities, and does not issue certificates for either registration or listing. Everything below is notification and record-keeping, enforced after the fact. That distinction shapes how you should read any supplier claim about being "FDA approved". The facility side of that split is ours to hold, and it is part of what our OEM service covers.

The Split: Facility Registration Is the Factory's Job, Product Listing Is Yours

This is the single most expensive misunderstanding we see, so it is worth being precise.

Facility registration generally rests with the owner or operator of a facility making or processing cosmetics distributed in the United States, including foreign facilities, unless an exemption applies. A contract manufacturer needs only one facility registration rather than one per customer. Section III.B of FDA's registration and listing guidance also allows a responsible person whose products are made at that contract facility to submit its registration.

Product listing is owed by the "responsible person", which the statute defines as the manufacturer, packer or distributor whose name appears on the label. For a private label or white label brand, that is almost always you. Your factory's name is not on the label; yours is. The listing has to include the product's ingredient list in INCI names and the registration number of the facility where it was made — which means you need a specific number from your supplier before you can complete your own filing. Which filing is ours and which is yours is set out line by line in our guide to MoCRA facility registration and product listing for the US market, including our FEI number in full.

Read those two paragraphs together and the practical consequence appears: legal responsibility and the person submitting a filing are not necessarily the same. FDA's Cosmetics Direct User's Guide, section 2.2 permits an authorised agent to submit on a company's behalf. A manufacturer's filing service therefore needs a written scope and authorisation, not a blanket promise that the brand has no remaining duties. Ask which facility registration number and submission records you will receive, and who will handle renewals and updates. If you are still at the stage of comparing suppliers, this belongs on your manufacturer selection checklist alongside GMP evidence.

The Dates, Including the One Most Articles Get Wrong

Three dates run this timeline, and the middle one is routinely misreported.

29 December 2022 — enactment. Every statutory deadline in MoCRA counts from this date.

29 December 2023 — the statutory deadline for existing facilities to register and existing products to be listed. Serious adverse event reporting also became live on this date, with a reporting window of 15 business days from when the responsible person receives the report, plus a further 15 business days for significant new medical information received within a year of the initial report.

1 July 2024 — when enforcement actually started. In November 2023 the FDA issued a compliance policy stating it did not intend to enforce the registration and listing requirements for a further six months beyond the statutory deadline. This is why you will see both "December 2023" and "July 2024" quoted as the deadline, and why some suppliers still describe registration as "becoming mandatory". It is not becoming mandatory. It has been enforced since July 2024, and failure to register is a prohibited act under the FD&C Act, which puts products from unregistered facilities at risk of import refusal.

After the initial filing, the cadence is: facility registration renewed every two years from the date of initial registration, registration changes updated within 60 days, product listings updated annually, and any product first marketed after enactment listed within 120 days of entering interstate commerce. Note that the 60-day rule attaches to facility registration changes, not to routine product listing updates; those two get conflated often enough that it is worth keeping them separate in your own calendar.

For the filing deadlines and renewal rules, see section III.F of FDA's registration and listing guidance and the agency's current registration and listing instructions.

Read the right-hand column before the dates, and check whether an exemption applies. A supplier or authorised agent may perform an agreed filing task, but that service does not erase the responsible person's statutory duties. Keep the accountable party, the actual submitter and the renewal owner explicit in your agreement.

Two Supplier Claims That Are Not True

We are including this section because we have been on the receiving end of both claims from competitors' sales material, and because the second one appeared in our own site copy until we corrected it while writing this article.

"Here is our FDA registration certificate"

There is no such FDA-issued certificate. FDA's Important Notes on cosmetic registration and listing explicitly distinguish these filings from approval and say the agency does not issue certificates to verify them. What genuinely exists is a submission and its receipt from the FDA's Cosmetics Direct portal. If someone shows you an official-looking certificate with an FDA logo on it, it was produced by the supplier or a third-party agent, not by the FDA. That does not automatically mean the registration is fake — but the certificate is not the evidence.

"You can look up our registration on the FDA website"

You cannot, and this one is worth understanding properly because it changes how you verify a supplier. Cosmetics Direct is a submission portal, not a search tool. The FEI Search Portal is for companies to find or confirm their own FEI number by company name and address; it does not report MoCRA registration status. The FDA publishes aggregate statistics — total active facility registrations, total active product listings, and a breakdown of facility counts by country and US state — but no company names, addresses or facility-level detail.

That is not an oversight. The statute restricts disclosure: product listing numbers are not made public, and brand names submitted in a facility registration, along with the facility registration number submitted in a product listing, are withheld from FOIA release. The link between brand and factory is exactly what the law protects. So a competitor cannot discover who manufactures your product through FDA records, and equally, you cannot self-serve a check on your supplier's registration.

What to do instead. Ask the supplier for the Cosmetics Direct submission receipt or registration record. Get the facility registration number in writing and make it a term of your supply agreement, because you will need it for your own product listing anyway. Give the number to your US agent, importer of record or regulatory consultant, who can pursue confirmation through channels available to them. And verify the credentials that are independently checkable — a GMP certificate from a named certification body can be checked in that body's own database, which is a different and stronger kind of evidence. We cover what those certificates do and do not prove in our guide to ISO 22716 and GMPC certification.

Our Own Registration, as a Worked Example

Our facility is registered with the FDA under MoCRA with FEI number 3038966060, valid through 29 July 2028. We publish the number in full because it is the number you would need for your own product listing, and because it lets you do the sanity checks that are available: our legal entity is Jiumei (Guangzhou) Biomedical Co., Ltd., which is the name printed on our Intertek ISO 22716 and GMPC certificates (HBPCER20260352 and HBPCER20260353, valid to 15 July 2029, verifiable at Intertek's own certificate database). That matters more than it sounds — a trading company can show you a certificate belonging to a factory it does not own, and matching the entity name across documents is how you catch that.

What our registration means: our facility is known to the FDA, our registration is current, we renew it biennially, and as a foreign facility we maintain a US agent as the statute requires. What it does not mean: the FDA has not approved or endorsed our facility, our formulas or any finished product. Nobody's registration means that. If we described it as an approval, you would be right to discount everything else we told you. Our page on manufacturing for the United States covers what foreign facility registration involves, including the US agent the statute requires of us.

For context on scale, the FDA's published aggregates as of 30 June 2026 show roughly 16,400 active facility registrations worldwide, of which about 8,100 are in China. Registration is a baseline, not a differentiator. It tells you a supplier has done the minimum filing to be legally usable for the US market. Everything you actually care about — whether they can hold a formula stable, whether their documentation survives a customer audit — sits on top of that. Our note on how to verify a manufacturer's formulation capability deals with that second layer.

What Else MoCRA Puts on You as Responsible Person

Registration and listing get the attention because they have deadlines. The obligations without deadlines are the ones that bite during an FDA inquiry.

Safety substantiation. You must hold adequate substantiation of safety for each product. FDA's MoCRA safety substantiation explanation does not prescribe one universal test list. In practice this is where your manufacturer's technical file becomes yours: challenge testing, stability data, and toxicological assessment of the formula. Agree at the quotation stage who produces what and who keeps the originals, because retrieving this two years later from a factory you no longer order from is unpleasant. This is one of several places where the difference between an OEM and an ODM arrangement changes who holds the underlying data.

Adverse event reporting and records. Serious adverse events go to the FDA within 15 business days, and you keep adverse event records for six years, or three years if you qualify as a small business.

Labelling. Labels must carry contact information through which adverse events can be reported to you, alongside existing Fair Packaging and Labeling Act requirements. Professional-use products carry their own labelling requirement.

Fragrance allergens. MoCRA directed the FDA to require disclosure of fragrance allergens on labels. Watch this one if you are running fragranced lines, and design your artwork with room to add a list rather than assuming your current layout is final.

What "MoCRA Labelling Requirements" Actually Means, Because Most of It Is Not MoCRA

This is the single most searched question we see on MoCRA, and the phrasing itself causes the error. MoCRA added exactly one labelling duty that is live today: your label has to carry contact information through which adverse events can be reported to you. Everything else that governs a US cosmetic label was already law before MoCRA passed, sitting in the FD&C Act and the Fair Packaging and Labeling Act and codified at 21 CFR 701 and 740.

Getting that backwards costs money in a specific and avoidable way. We see brands budget for a fragrance allergen disclosure rule that does not exist yet, then ship artwork that misses an ingredient type-size rule that has been enforced for decades. The first is optional preparation. The second is what actually gets a shipment detained.

The label rules that predate MoCRA and are enforced now

Three things brands get wrong in the other direction

Expiration dates are not required. No US regulation requires a cosmetic to carry an expiration date. Printing one is a commercial and shelf-life decision, and once printed it becomes a claim you have to be able to stand behind, which is a reason to base it on stability data rather than on a round number.

Off-package ingredient labelling is narrower than it sounds. It is permitted only where the cosmetic is held in tightly compartmented trays or racks, is not enclosed in a folding carton, and the package surface area is under 12 square inches. A small jar in a printed carton does not qualify.

Soap may not be a cosmetic at all. A product consisting primarily of an alkali salt of fatty acid that makes no label claim beyond cleansing the body is outside the cosmetic definition. Add a moisturising or deodorising claim and it comes back inside, which changes the labelling obligations before it changes anything about the formula.

What we can and cannot do on the artwork side

What a factory can supply is the input data: the full INCI listing in descending order with the sub-one-percent and colour additive treatment already applied (for nail products the certification mechanics are set out in our guide to custom nail polish manufacturers), the active-versus-cosmetic split where the product is also a drug, net content verified against fill records rather than nominal fill, and the country of origin as the site that actually ran the batch. What we cannot do is own the label. The responsible person named on it owns the artwork and the claims, and the type sizes and panel placement have to be checked against the final printed dieline, not the design file, because artwork that satisfies 1/16 inch on screen can fail it after scaling.

Where the Small Business Exemption Applies, and Where It Does Not

If your average gross annual US cosmetic sales over the previous three years fall below one million dollars, adjusted for inflation, you may be exempt from the good manufacturing practice requirements and from registration and listing. Check the small-business definition on PDF page 6 of FDA's registration and listing guidance rather than treating the unadjusted figure as a permanent threshold. Two cautions before you rely on that.

First, the exemption is disapplied for certain product types regardless of your size, including products that regularly contact the mucus membrane of the eye under normal use, injected products, products intended for internal use, and products intended to alter appearance for more than 24 hours where consumer removal is not part of normal use. Eye products are the category most launch-stage brands trip over.

Second, the exemption never covers safety substantiation, adverse event reporting or labelling. Those apply to every responsible person. And the FDA does not issue small business exemption certificates or ask you to file anything to claim it — which means the determination, and the risk of getting it wrong, sits entirely with you.

Sunscreen Is a Different Regime Entirely

If your range includes sunscreen, assess the US drug route rather than relying on an ordinary cosmetic filing. Section III.G of FDA's registration and listing guidance distinguishes the product exemption from the facility exemption: a cosmetic that is also a drug is excluded from MoCRA cosmetic product listing, while a facility also making non-drug cosmetics may still need cosmetic facility registration. Drug requirements remain separate. An SPF50+ sun essence and a hydrating HA serum illustrate why a US-bound range needs classification by product; a catalog entry does not itself establish US market eligibility.

This is a real planning problem for brands used to Asian or European markets, where the same product is often a cosmetic. A sunscreen developed for an ASEAN launch cannot be redirected to the US on the same documentation. We deal with the formulation side of that split in our piece on sunscreen OEM for Southeast Asia.

Cosmetic GMP: Draft Guidance and Binding Rules

MoCRA directed FDA to establish cosmetic GMP regulations. Keep that rulemaking separate from FDA's 2013 cosmetic GMP draft guidance, which the agency still labels as a draft, not a final binding regulation. Before treating a quoted requirement as law, check the final rule, its scope and its effective date through FDA's MoCRA implementation information.

Our read, and it is a judgement rather than a fact: plan against ISO 22716 now. The draft guidance and the international standard cover substantially the same ground, and a facility running to ISO 22716 with a genuine third-party audit behind it is unlikely to be badly positioned when the rule does land. What we would not do is wait for the rule before asking your supplier for GMP evidence — the safety substantiation obligation on you already depends on the quality of their manufacturing records, rule or no rule. Ours sit behind the formulation and production systems we run.

What Is Enforced Now, and What Is Still Only Proposed

The GMP rule above is not the only part of MoCRA still waiting on the FDA, and the gap between what the statute directs and what is enforceable today has become the single most misreported thing about this law. A lot of compliance content, and a fair amount of supplier and consultant sales material, describes pending rules as though they were already in force. Two of them have moved backwards in the last year rather than forwards.

Here is where each piece stood as of September 2026.

Why the distinction costs real money

Buyers get this wrong in two directions, and both are expensive. The first is paying for compliance with a rule that does not exist yet: quotes for "MoCRA fragrance allergen labelling compliance" as a mandatory line item, or artwork reruns to add a disclosure list that no regulation currently requires. The second is the opposite error, treating the pending rules as evidence that MoCRA is not really being enforced. Registration, listing, adverse event reporting and safety substantiation are all live and independent of every rule in the pending column.

A practical filter: if a supplier or consultant tells you something is required by MoCRA, ask which obligation and which date. Anything in the lower half of that table has no date yet.

The talc withdrawal, read correctly

This one is genuinely counterintuitive, so it is worth being precise. The rule the FDA withdrew in November 2025 was about standardising the test methods for detecting asbestos in talc-containing cosmetics. It was never the thing that made talc contamination unlawful. A product containing asbestos was adulterated before that proposal was written and remains adulterated now, and your safety substantiation obligation covers it either way.

So the withdrawal does not reduce what you need from a supplier. It removes the prospect of a single federal method everyone must use, which in practice means the burden of specifying the method moves to you. If you run talc-containing colour cosmetics, keep asking for batch-level asbestos testing on the talc itself, and get the analytical method named in the report rather than accepting "asbestos free" as a conclusion. Two labs using different methods can both write that sentence and not mean the same thing.

PFAS: the federal report changed less than the states did

The FDA's congressionally mandated PFAS report landed at the end of December 2025 and concluded there was insufficient data to determine the safety of the 25 most commonly used PFAS in cosmetics. No ban, no restriction, no rule. Read plainly, the federal position is still open.

The operative constraint is therefore state law, not MoCRA, and it is a patchwork with different lists and different dates. That has a sourcing consequence worth acting on now: get a written PFAS declaration from your factory covering intentionally added PFAS across the full formula including processing aids, and keep it with your safety substantiation file. It is cheap to obtain while a formula is being developed and awkward to reconstruct after a state list catches one of your ingredients.

What we would get ready anyway

On the allergen rule specifically, the useful preparation is not label design but data. Ask your fragrance house for the allergen breakdown of each fragrance you use, at the concentrations you use, and keep it on file. The EU's established allergen list is the sensible working reference while the FDA's own list does not exist, and it is what most fragrance houses can already supply. If the FDA rule eventually lands close to the EU approach, you will already hold the underlying numbers; if it does not, you have lost nothing, because that same data supports EU and UK sales and your safety substantiation.

A Sequence That Avoids Rework

The order below reflects where projects actually stall, which is almost always at a missing number or a document nobody agreed to produce.

1. Before you order: confirm the facility is registered and get the registration number in writing. Ask who the facility's US agent is. Confirm which party produces stability, challenge and toxicological data, and who keeps the originals.
2. During development: lock the ingredient list in INCI names, because that is what your listing needs and a late formula tweak means a late listing amendment. Design labels with the adverse-event contact detail and room for allergen disclosure.
3. Before first shipment: appoint your US agent or importer of record. Confirm your own responsible person status and prepare the listing. Build the customs entry into your cost model at the same time, because the duty rate is only one line of what a US shipment actually costs — our guide to US cosmetics landed cost works through the rest.
4. Within 120 days of first marketing: file the product listing.
5. Ongoing: annual listing updates, biennial facility renewal on the factory's side, 60 days for registration changes, 15 business days for serious adverse events. Put all four in a calendar, not in an email thread.

For a full launch view that folds these steps into costs and lead times, see our guide to starting a private label skincare line.

What a US-Bound Project Looks Like From Our Side

Concretely, for brands shipping into the US, we work to a minimum order quantity of 3,000 bottles or jars per SKU and a bulk-production window of 35–60 days once the formula, artwork, and packaging are locked. Sample preparation, dispatch, and revision timing are confirmed for each project after the formula route, reference information, and destination are clear. Serums, creams, and masks can sit toward the longer end because of their stability and filling requirements. We supply our facility registration number for your listing, our INCI ingredient breakdown, and stability and challenge test reports where they are included in the agreed project scope. Our glutathione brightening serum shows the level of ingredient detail that goes into a listing — baseline levels with a stated range, the pH window and the regulatory basis for each cap, which is what the safety substantiation requirement expects you to hold. We do not file your product listing for you — legally we cannot, since you are the responsible person — but we will tell you exactly which fields we can supply and which need your input.

One thing we will push back on: if you ask us to describe our FDA registration as approval or certification in your marketing, we will decline, and you should treat any supplier who agrees to it as a supplier who will be similarly relaxed about other claims. If you are scoping a US launch, send us the brief and we will tell you which fields we can fill.

Frequently Asked Questions

Does my Chinese manufacturer need to register with the FDA?

Yes, if the products it makes are distributed in the United States. Facility registration applies to foreign facilities, and a foreign facility must also identify a US agent in its registration.

Can I check my supplier's MoCRA registration myself?

No. There is no public FDA database of cosmetic facility registrations. Cosmetics Direct is a submission portal, and the statute keeps listing numbers and brand-to-facility links out of public release. Request the submission receipt and put the registration number in your contract.

Who files the product listing — me or the factory?

You, if your brand name is on the label. The responsible person is the manufacturer, packer or distributor named on the label, and product listing is that party's obligation.

Is a MoCRA registration the same as FDA approval?

No. The FDA does not approve cosmetics or cosmetic facilities and does not issue certificates for registration or listing. Registration means the facility is known to the agency and subject to inspection.

Is fragrance allergen labelling mandatory in the US yet?

No. As of September 2026 the FDA has not published even a proposed rule; the proposal was expected in May 2026 and slipped again, and a final rule is not expected before 2027. Treat any quote that lists MoCRA allergen labelling as a mandatory compliance cost with suspicion. What is worth doing now is collecting the allergen breakdown for each fragrance you use from your fragrance house, using the EU allergen list as the working reference.

The FDA withdrew the talc asbestos testing rule. Do I still need testing?

Yes. The withdrawn proposal was about standardising the test methods, not about whether talc contamination is acceptable. A product containing asbestos was adulterated before the proposal and still is, and your safety substantiation obligation is unaffected. The practical effect of the withdrawal is that no single federal method is mandated, so you should specify what you want: batch-level testing on the talc itself, with the analytical method named in the report.

What happened to the VCRP?

It stopped accepting submissions on 27 March 2023 and was replaced by MoCRA's mandatory registration and listing. VCRP data was not migrated, so a previous VCRP filing does not satisfy the current requirement.

Do I need to renew anything, or is registration once and done?

Facility registration is renewed every two years from the initial registration date, with changes updated within 60 days. Your product listings are updated annually, and new products are listed within 120 days of first marketing.

Does MoCRA apply if I only sell on Amazon or through a US distributor?

The obligations attach to the responsible person named on the label and to the manufacturing facility, not to the sales channel. If your brand is on the label, selling through a marketplace or a distributor does not move the listing obligation off you.

The Short Version

For a range subject to these requirements, the facility registration and the responsible person's product listings have different renewal and update schedules. Filing can be delegated, but responsibility must remain clear. Hold safety evidence and adverse-event records, and confirm applicable exemptions before planning the paperwork. Registration is not FDA approval, an FEI search is not a MoCRA status check, and US sunscreen needs a separate drug-pathway assessment.

If you are choosing between manufacturers for a US launch and want a straight answer on what we can and cannot supply for your filing, send us your product list and we will map the paperwork against your timeline before you commit to an order.