The Bottom Line
MoCRA (Modernization of Cosmetics Regulation Act, signed December 29, 2022) requires cosmetics manufacturers to register facilities with the FDA (renewed every two years), list every product (updated annually), report serious adverse events within 15 business days, maintain safety substantiation, and carry a US adverse-event contact on labels (since December 29, 2024). The FDA now holds mandatory recall and records-access powers. As of January 6, 2026: 14,299 facilities and 992,907 product listings. Still pending: the GMP rule, fragrance allergen labeling, and revised talc testing methods. Small businesses under $1M in average annual sales are exempt from registration and listing — but not from adverse events, substantiation, or labels.
Section 1
What MoCRA Is — and Why 1938 Matters
For 84 years, US cosmetics were governed by a few pages of the Federal Food, Drug, and Cosmetic Act of 1938: no registration, no listing, no mandatory safety files, no recall power. MoCRA — enacted December 29, 2022 — replaced that vacuum with a modern regulatory system administered by the FDA.
The law covers cosmetics in the broad statutory sense: shampoos, conditioners, styling products, skincare, makeup, fragrance, and professional salon products. Products that make drug claims (dandruff treatment, sunscreen, hair regrowth) remain regulated as drugs or drug-cosmetic combinations — MoCRA does not change that boundary.
By early 2026 the system is fully operational: registration and listing databases are live in the Cosmetics Direct portal, the adverse event dashboard went public on September 12, 2025, and the FDA is using the data to target inspections and safety signals.
Source: MoCRA — FDA →Section 2
Who Must Comply: Responsible Persons, Facilities, and the Small-Business Exemption
Responsible Person
The Name on the Label
The manufacturer, packer, or distributor named on the label. Owns product listing, safety substantiation, adverse event reporting, and label compliance. Foreign brands need a US-reachable responsible person and a US agent for registered facilities.
Facility
Where Products Are Made
Any establishment that manufactures or processes cosmetics for US distribution must register. Pure labelers, packagers, holders, distributors, retailers, and salons using products on clients do not register.
The $1 Million Small-Business Exemption
- Average gross annual US cosmetics sales under $1 million (previous 3 years) → exempt from facility registration and product listing
- The exemption never covers products contacting the eye’s mucous membrane, injectables, internal-use products, or products altering appearance for over 24 hours
- Not exempt from: adverse event reporting, safety substantiation, or labeling requirements
- Cross the threshold as you grow and the full obligations attach — build compliant habits early
Section 3
Facility Registration and Product Listing
14,299
Unique active facility registrations as of January 6, 2026 — registration is biennial; calendar your renewal
992,907
Unique active product listings as of January 6, 2026 — new products within 120 days, updates annually
- Both filings run through the FDA’s Cosmetics Direct portal (initial statutory deadline: December 29, 2023)
- Registration renewal every two years — lapsed registrations are treated as inactive, and FDA import screening checks them
- Product listings include category, full ingredient list, and the manufacturing facility; one listing can cover multiple shades or sizes of a single formulation
- Foreign facilities must designate a US agent; import shipments are screened against registration and listing data — non-filers risk detention at the border
Section 4
Adverse Event Reporting: The 15-Business-Day Clock
MoCRA’s sharpest operational requirement. A serious adverse event — death, life-threatening experience, hospitalisation, disability, congenital anomaly, serious disfigurement (including significant hair loss, highly relevant to the shampoo and salon world), or events requiring medical intervention to prevent these — triggers a mandatory MedWatch report.
1
Report Within 15 Business Days
File with the FDA within 15 business days of receiving the report, including a copy of the product label. New medical information received within one year requires follow-up filings.
2
Keep Records Six Years
Retain records of ALL adverse events — serious or not — for six years (three years for qualifying small businesses). The FDA can inspect them.
3
Be Reachable
The label must carry a US address, phone number, or electronic contact for receiving adverse event reports — required on products since December 29, 2024.
The FDA’s cosmetics adverse event dashboard has been public since September 12, 2025 — your category’s complaint patterns are now visible to regulators, journalists, and plaintiffs’ counsel alike. Monitor it.
Section 5
Safety Substantiation: Prove It Before You Are Asked
Every responsible person must maintain records providing adequate substantiation of safety — tests, studies, analyses, or other evidence that qualified experts would consider sufficient to support that the product is safe under customary use.
- There is no pre-market approval: the FDA does not review products before launch, but can demand your files at any time
- Typical evidence stack: ingredient-level safety assessments (CIR monographs), supplier toxicology data, preservation and stability testing, and a documented formulation safety review
- Assemble the file before launch — reconstructing substantiation after an FDA request or adverse event cluster is the expensive path
- EU-style Product Information Files exceed the MoCRA standard — brands compliant under EU 1223/2009 can largely reuse their dossiers
Section 6
What Is Still Coming: GMP, Fragrance Allergens, Talc, PFAS
| Rulemaking | Status (early 2026) | What To Do Now |
|---|---|---|
| Good Manufacturing Practice | Final rule not yet issued (statutory targets: proposed end-2024, final end-2025 — both passed) | Align with ISO 22716 now; the rule is expected to track international standards |
| Fragrance allergen labeling | Rule not yet issued | Map allergens in your fragrance compounds (EU’s 80+ allergen list is the template) so relabeling is a print job, not a reformulation |
| Talc asbestos testing | Proposed December 2024; withdrawn late 2025; revised approach pending | If you use talc, keep supplier asbestos testing records current — the statutory mandate remains |
| PFAS | FDA assessment issued December 29, 2025: significant safety uncertainty, data gaps | Inventory PFAS in formulations and supply chain; expect further scrutiny and state-level bans |
Do not mistake delay for absence. The FDA missed statutory rulemaking dates, but each mandate remains law. Brands that pre-align — especially on GMP and allergens — convert regulatory lag into competitive advantage.
Section 7
The FDA’s New Powers
- Mandatory recall — if a cosmetic is adulterated or misbranded and exposure risks serious adverse health consequences, the FDA can order a recall when a voluntary one is refused
- Records access — the agency can demand safety substantiation and adverse event records
- Facility suspension — in serious cases the FDA can suspend a facility registration, stopping US distribution from that site
- Import screening — shipments are checked against registration and listing data; non-compliant imports face detention and refusal
- Public transparency — adverse event dashboards and safety alerts put compliance failures in public view
Enforcement in practice starts with warning letters and import refusals — but the recall and suspension powers change the negotiating position of every brand that receives one.
Section 8
MoCRA vs EU vs Japan: The Cross-Market View
| Aspect | US (MoCRA) | EU (1223/2009) | Japan (PMD Act) |
|---|---|---|---|
| Pre-market approval | ✗ None | ✗ None (assessment required) | Notification; quasi-drugs approved |
| Safety file before launch | Substantiation records | ✓ Full PIF + signed safety assessment | Manufacturer responsibility |
| Registration/notification | Facility + product listing | CPNP notification | Marketing licence system |
| Banned/restricted substances | Short list | 1,600+ banned | Positive/negative lists |
| Adverse event reporting | ✓ 15 business days (serious) | ✓ Serious undesirable effects | ✓ |
| GMP | Rule pending (ISO 22716 expected) | ISO 22716 presumed | Licence-linked standards |
| Recall power | ✓ Mandatory (new) | Member-state authorities | ✓ |
The strategic read: EU compliance is the superset. Brands built for 1223/2009 can meet MoCRA with administrative work; US-only brands expanding to the EU face the substantive climb.
Section 9
What MoCRA Means for the Salon Channel
- Salons using products on clients — no registration or listing duties, but professional-use products must be labeled as such, and salons should funnel client reactions to the brand’s adverse-event contact
- Salon private-label brands — the salon IS the responsible person: product listing, safety substantiation, adverse event reporting, and label duties all attach
- Distributors of professional lines — verify your suppliers’ registration and listing status; import screening failures strand inventory at the border
- Hair-loss complaints — significant hair loss is expressly a serious adverse event; salon-channel brands should treat such complaints with 15-business-day urgency
Section 10
MoCRA Timeline
29 Dec 2022
MoCRA signed into law — largest US cosmetics reform since 1938 Active
29 Dec 2023
Statutory deadline for facility registration and product listing (FDA enforcement from July 1, 2024) Active
29 Dec 2024
Adverse-event contact required on labels; talc testing methods proposed Active
12 Sep 2025
FDA cosmetics adverse event dashboard goes public Active
Late 2025
Talc proposal withdrawn (revised approach pending); PFAS assessment issued December 29, 2025 Active
2026
Biennial registration renewals due for 2024 registrants; GMP and fragrance-allergen rulemakings expected to advance Now
Section 11
Frequently Asked Questions
MoCRA — the Modernization of Cosmetics Regulation Act of 2022 — is the most significant expansion of FDA authority over cosmetics since the Federal Food, Drug, and Cosmetic Act of 1938. Signed into law on December 29, 2022, it moved US cosmetics from a largely self-regulated model to one with mandatory facility registration, product listing, adverse event reporting, safety substantiation, and new FDA powers including mandatory recalls. It applies to virtually every cosmetic product sold in the US — shampoos, conditioners, skincare, makeup, and salon products alike.
The responsible person is the manufacturer, packer, or distributor whose name appears on the product label. This entity owns the core MoCRA duties: listing each cosmetic product with the FDA, maintaining safety substantiation records, receiving and reporting adverse events, and keeping the US contact information on the label current. Foreign brands selling into the US must designate a US agent for their registered facilities and ensure a responsible person handles these obligations.
If you own or operate a facility that manufactures or processes cosmetics distributed in the US, yes — registration through FDA's Cosmetics Direct portal has been required since the initial December 29, 2023 statutory deadline, and registrations must be renewed every two years. As of January 6, 2026, the FDA counted 14,299 unique active facility registrations. Facilities that only label, relabel, package, hold, or distribute (without manufacturing or processing) are not required to register — nor are retailers or salons that merely use products on clients.
The responsible person must list every marketed cosmetic product with the FDA, including product category, ingredients, and the facility where it is made. New products must be listed within 120 days of marketing, and listings must be updated annually. As of January 6, 2026, the FDA recorded 992,907 unique active product listings. Flexible listing options allow one listing to cover multiple shades or sizes of the same formulation.
A serious adverse event includes death, life-threatening experience, hospitalisation, disability, congenital anomaly, serious disfigurement (including significant hair loss), or events requiring medical intervention to prevent such outcomes. The responsible person must report a serious adverse event to the FDA within 15 business days of receiving it, attach the product label, and submit follow-up information received within one year. Records of all adverse events — serious or not — must be kept for six years (three years for qualifying small businesses).
MoCRA requires the responsible person to maintain records providing adequate substantiation that each cosmetic product is safe — meaning tests, studies, or other evidence that qualified scientific experts would accept as sufficient. There is no pre-market approval: the FDA does not review products before sale, but it can demand these records. In practice, brands rely on ingredient safety assessments (such as CIR reviews), existing toxicology data, product testing, and formulation reviews documented before launch.
Yes — partially. Businesses whose average gross annual US cosmetics sales over the previous three years are under $1 million are exempt from facility registration and product listing. The exemption does not apply to products that regularly contact the eye's mucous membrane, are injected, are intended for internal use, or alter appearance for more than 24 hours without consumer removal. Critically, small businesses remain fully subject to adverse event reporting, safety substantiation, and labeling requirements.
Since December 29, 2024, cosmetic labels must carry a US address, phone number, or electronic contact through which the responsible person can receive adverse event reports. Products intended for professional use only — common in the salon channel — must be labeled accordingly. A further change is coming: MoCRA directs the FDA to require disclosure of fragrance allergens on labels, but as of early 2026 that rule has not yet been issued, so brands should watch this rulemaking closely.
Still pending. MoCRA directed the FDA to establish good manufacturing practice regulations consistent with international standards (ISO 22716 is the reference point in industry practice). The statutory timeline called for a proposed rule by the end of 2024 and a final rule by the end of 2025, but as of early 2026 no final GMP regulation has been issued. Prudent manufacturers are aligning with ISO 22716 now — both because contract customers demand it and because the eventual rule is expected to track it.
Both moved in 2025, in opposite directions. Talc: the FDA proposed standardized testing methods for detecting asbestos in talc-containing cosmetics in December 2024, but the proposal was withdrawn in late 2025, with a revised approach pending — the statutory obligation remains. PFAS: the FDA issued its required assessment of PFAS in cosmetics on December 29, 2025, concluding that significant safety uncertainty remains due to data gaps — a signal that further regulatory attention on PFAS in cosmetics is likely.
Yes. MoCRA gave the FDA mandatory recall authority: if the agency determines a cosmetic is adulterated or misbranded and exposure will cause serious adverse health consequences, it can order a recall if the responsible person refuses to act voluntarily. The FDA can also access safety substantiation and adverse event records, suspend a facility registration in serious cases — halting US distribution from that facility — and publicises safety signals through its cosmetics adverse event dashboard, live since September 12, 2025.
Mostly indirectly. A salon using professional products on clients is not a manufacturer and does not register or list products. But the salon channel is affected: professional-use products must be labeled as such, salons are a natural collection point for adverse event complaints that should be passed to the responsible person, and salon-owned private-label brands ARE responsible persons with full listing, substantiation, and reporting duties. Salon owners with house brands should treat themselves as cosmetics companies.
The EU Cosmetics Regulation 1223/2009 remains stricter overall: it requires a designated responsible person, a full Product Information File, a safety assessment signed by a qualified assessor before launch, CPNP notification, and bans over 1,600 substances. MoCRA narrows the gap — registration, listing, substantiation, adverse event reporting — but still has no pre-market safety assessment requirement and a far shorter prohibited-ingredients list. Brands already compliant in the EU typically find MoCRA straightforward; US-only brands entering the EU face the harder climb.
Non-compliance renders products adulterated or misbranded under the Federal Food, Drug, and Cosmetic Act — the same enforcement machinery used for food and drugs. Consequences range from FDA warning letters, import refusals (a particular risk for foreign brands, as FDA screens imports against registration and listing data), facility registration suspension, and mandatory recalls, up to injunctions and criminal penalties for serious violations. In practice, import detention and warning letters are the first-line risks for most brands.
Yes. Marketplaces and retailers increasingly demand proof of MoCRA compliance — registration or exemption status, listing numbers, and label compliance — as a condition of doing business. Even exempt small businesses must handle adverse events, keep safety substantiation, and update labels with US contact information. And the $1 million exemption threshold is measured across three years of gross sales: a growing brand can cross it mid-journey and inherit the full obligations, so build compliant habits early.
Five moves: (1) Confirm your facility registration is active and calendar the biennial renewal — the FDA purges lapsed registrations; (2) Audit your product listings for completeness and file the annual updates; (3) Verify labels carry the US adverse-event contact and professional-use statements where applicable; (4) Assemble safety substantiation files for every SKU before the FDA asks; (5) Track the three pending rulemakings — GMP, fragrance allergens, and the revived talc methods — and pre-align manufacturing with ISO 22716 so the GMP rule lands softly.
Section 12
MoCRA Readiness Checklist
| # | Item | Status |
|---|---|---|
| 1 | Responsible person identified and label name/address aligned | □ |
| 2 | Facility registration active in Cosmetics Direct; biennial renewal calendared | □ |
| 3 | US agent designated (foreign facilities) | □ |
| 4 | Small-business exemption verified against the 3-year, $1M test (with product-type exceptions) | □ |
| 5 | Every marketed SKU listed; new-product 120-day listing workflow in place | □ |
| 6 | Annual listing update scheduled | □ |
| 7 | Labels carry US adverse-event contact (since 29 Dec 2024) | □ |
| 8 | Professional-use labeling applied where relevant | □ |
| 9 | Adverse event intake process live; 15-business-day escalation defined | □ |
| 10 | Adverse event records retention set (6 years / 3 years small business) | □ |
| 11 | Safety substantiation file assembled for every SKU | □ |
| 12 | Manufacturing aligned with ISO 22716 ahead of the GMP rule | □ |
| 13 | Fragrance allergen mapping done (EU list as template) | □ |
| 14 | Talc supplier testing records current (if applicable); PFAS inventory taken | □ |
| 15 | FDA adverse event dashboard monitored for your categories | □ |
Keep Your Compliance Ahead of the Rules
Explore the MmowW Salon & Cosmetics Library — evidence-based regulatory guidance for brands and salons.