US Cosmetics Compliance Under MoCRA: What SME Skincare and Beauty Brands Must Do

The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) was signed into law on 29 December 2022 as part of the Consolidated Appropriations Act, 2023. It is the most significant expansion of FDA authority over cosmetics since the Federal Food, Drug, and Cosmetic Act of 1938. For decades cosmetics were among the least actively regulated consumer product categories in the United States. That era is over.

MoCRA added new sections to the FD&C Act that turn several previously voluntary practices into mandatory federal obligations: registering the facilities that make cosmetics, listing every marketed product with the FDA, naming a Responsible Person, holding safety substantiation on file, and reporting serious adverse events. The FDA also gained mandatory recall authority and expanded records access.

The practical takeaway for a small or mid-sized brand is simple. If you manufacture, process, pack, or put your name on a cosmetic sold in the United States, you now carry federal duties that did not exist a few years ago, and the enforcement deadlines have already passed.

Every person who owns or operates a facility that manufactures or processes cosmetic products for US distribution must register that facility with the FDA. Registrations must be kept current, with changes reported within 60 days, and renewed every two years. Foreign facilities that make products for the US market must also register and designate a US agent.

Separately, the Responsible Person must submit a cosmetic product listing to the FDA for each marketed product, including its ingredients, and update it annually. The Responsible Person is the manufacturer, packer, or distributor whose name appears on the product label.

The original statutory deadline was 29 December 2023. The FDA delayed enforcement by six months, to 1 July 2024, and that date has now passed. New brands entering the market are expected to register and list before distribution, not after.

MoCRA exempts certain small businesses from facility registration, product listing, and the forthcoming Good Manufacturing Practice requirements. The threshold is an average gross annual US cosmetic sales figure below one million dollars over the previous three years, adjusted for inflation.

The exemption is narrower than it first appears. It does not apply to any business that makes or processes products in higher-risk categories: products that regularly contact the mucous membrane of the eye, products that are injected, products intended for internal use, and products intended to alter appearance for more than 24 hours where removal is not part of normal use.

The exemption is also all or nothing. A brand that sells even a single non-exempt product loses the exemption for its entire range and must register, list, and comply in full. Many small brands assume they qualify, then find one product pulls them into full scope.

Regardless of size, the Responsible Person must maintain records supporting an adequate substantiation of safety for each cosmetic product. This is not a filing; it is an evidence base you must be able to produce, made up of tests, studies, or other reliable information sufficient to support that the product is safe under normal or reasonably foreseeable use.

Serious adverse events must be reported to the FDA, and adverse event records must be retained. Standard retention is six years; qualifying small businesses may retain serious adverse event records for three years. A serious adverse event is broadly defined and includes outcomes such as significant disfigurement, hospitalisation, or the need for medical or surgical intervention.

These two obligations are where under-resourced brands are most exposed. A product can be entirely safe and still leave the brand non-compliant, simply because the substantiation was never assembled and the adverse event process was never set up.

Several MoCRA provisions arrive through FDA rulemaking rather than the statute directly. Good Manufacturing Practice regulations for cosmetics are being developed, fragrance allergen labelling rules are expected to require disclosure of specified allergens, and standardised testing for asbestos in talc-containing products is being established. Track these as they finalise, because they will change formulation, labelling, and testing practice.

MoCRA sits on top of the rules that already governed US cosmetics and still apply: the prohibition on adulterated or misbranded products, ingredient and warning labelling under the FD&C Act and the Fair Packaging and Labeling Act, the requirement that colour additives be FDA-approved and, where applicable, certified, and the line between a cosmetic and a drug. A product that treats or prevents disease, or affects the structure or function of the body, such as a sunscreen or an anti-acne treatment, is an over-the-counter drug and carries a different and heavier set of obligations.

California's Proposition 65 is a separate, state-level exposure that catches many cosmetics through warning requirements for listed substances, independent of federal law.

The recurring pattern in reviews is not exotic. It is a foreign manufacturer that never registered, a product range listed incompletely or not updated after a reformulation, a safety substantiation file that exists only as an assumption, an adverse event process that was never built, and a cosmetic that is actually a drug because of a single structure or function claim on the label.

None of these is hard to fix before launch. All of them are expensive to fix once a product is detained, a listing is found missing, or an adverse event has to be reported with no process in place. The cost of building MoCRA compliance correctly is a fraction of the cost of remediating it under pressure.