What Is MoCRA? The FDA’s New Cosmetics Law Explained

If you sell cosmetics in the United States — whether you are a domestic brand, a foreign manufacturer, or a contract manufacturer — there is a significant chance you are now subject to federal requirements that did not exist three years ago. The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) is the most sweeping overhaul of U.S. cosmetics law since the Federal Food, Drug, and Cosmetic Act was passed in 1938. And unlike most regulatory updates, MoCRA created entirely new obligations — not just refinements of existing ones.

This guide explains what MoCRA is, what it requires, who it applies to, and what happens if you are not yet in compliance.

Why MoCRA Was Passed

For most of the 20th century, the FDA had remarkably limited authority over cosmetics. Unlike drugs, dietary supplements, or food, cosmetics did not require pre-market approval or registration. The FDA could take action against unsafe cosmetics after the fact — but it had no formal mechanism to require facility registration, product listing, or mandatory safety testing before a product reached consumers.

MoCRA changed that. Passed as part of the Consolidated Appropriations Act of 2023, MoCRA gave the FDA new authority to require cosmetics manufacturers to register their facilities, list their products, maintain safety substantiation records, report serious adverse events, and — eventually — follow binding Good Manufacturing Practices. It also gave the FDA mandatory recall authority over cosmetics for the first time in history.

What MoCRA Requires: The Five Core Obligations

1. Facility Registration

Any person who owns or operates a facility that manufactures or processes cosmetic products for distribution in the United States must register that facility with the FDA. This includes both domestic manufacturers and foreign manufacturers exporting to the U.S. Registration must be renewed every two years and updated within 60 days of any change to the registered information.

The registration deadlines have already passed. If your facility is not registered, you are currently out of compliance and subject to FDA enforcement, including import detention for foreign manufacturers.

2. Product Listing

In addition to facility registration, “responsible persons” — typically the brand owner or domestic distributor — must submit a product listing for each cosmetic product they market. The listing must include the product name, category, ingredient list (using INCI names), and the facility registration number where the product is manufactured. Product listings must be updated annually and whenever the formulation changes.

3. Serious Adverse Event Reporting

Responsible persons must report serious adverse events to the FDA within 15 business days of receiving a report. A serious adverse event is one that results in death, life-threatening injury, inpatient hospitalization, persistent disability, congenital anomaly, or requires medical intervention to prevent serious harm. Records of all adverse event reports — serious and non-serious — must be maintained for six years.

4. Safety Substantiation

MoCRA requires that cosmetic products have “adequate substantiation of safety.” The responsible person must be able to demonstrate that the product and its ingredients are safe for their intended use. While the FDA has not yet issued a formal definition of “adequate substantiation,” the obligation exists now and the FDA has authority to inspect your safety files.

5. Good Manufacturing Practices (GMP) — Coming

MoCRA requires the FDA to issue binding GMP regulations for cosmetics. These regulations are expected to align closely with the voluntary ISO 22716 GMP standard that many professional cosmetics manufacturers already follow. Once finalized, compliance will be mandatory. Companies that have invested in ISO 22716 compliance will have a significant advantage when the rules take effect.

Who Does MoCRA Apply To?

MoCRA applies to a broad range of businesses in the cosmetics supply chain:

• Domestic brands and brand owners — responsible for product listing, safety substantiation, and adverse event reporting for products they market
• Contract manufacturers — responsible for facility registration and, eventually, GMP compliance
• Foreign manufacturers exporting to the U.S. — must register their facilities with the FDA; failure to do so can result in import detention
• Private label distributors — if they are the “responsible person” for a product, they bear the product listing and adverse event reporting obligations

Small business exemption: Businesses with average annual U.S. gross sales of $1 million or less (adjusted for inflation) are exempt from facility registration. However, they are still subject to product listing, safety substantiation, adverse event reporting, and labeling requirements.

What Are the Consequences of Non-Compliance?

MoCRA significantly expanded the FDA’s enforcement authority over cosmetics:

• Warning letters: The FDA can issue warning letters citing specific MoCRA violations — including failure to register, failure to list products, or failure to report adverse events.
• Mandatory recall authority: For the first time, the FDA has statutory authority to order a mandatory cosmetics recall if it determines a product poses a reasonable probability of serious adverse health consequences. Previously, all cosmetic recalls were voluntary.
• Import detention: Foreign manufacturers that fail to register their facilities can have their products detained at the U.S. border.
• Injunction and seizure: The FDA can seek court orders to stop the distribution of non-compliant cosmetics and seize violative products.
• Civil penalties: The FDA can impose civil penalties for failure to comply with serious adverse event reporting requirements.

Common MoCRA Misconceptions

“My contract manufacturer registered — I’m covered.”

No. Facility registration is the manufacturer’s obligation. Product listing, safety substantiation, and adverse event reporting are the responsible person’s (typically the brand owner’s) obligations. These are independent duties. Your manufacturer being registered does not satisfy your product listing or adverse event reporting requirements.

“We sell on Amazon / Etsy — MoCRA doesn’t apply to online sellers.”

Wrong. MoCRA applies to any cosmetic product sold or distributed in the United States, through any channel. Third-party marketplace platforms are not a shield from FDA enforcement. If you manufacture or have products manufactured and sell them in the U.S., MoCRA applies to you.

“We haven’t received any complaints — we don’t need adverse event reporting procedures.”

The obligation to have adverse event reporting procedures in place is not triggered by receiving a complaint — it exists the moment you are a responsible person marketing a cosmetic product in the U.S. You need a system to identify, document, evaluate, and report serious adverse events before you receive one, not after.

Getting into Compliance

If your business has not yet completed MoCRA compliance, the most important next step is a structured compliance assessment. That means:

1. Determining whether your facility is registered (if required)
2. Confirming whether your products are listed with the FDA
3. Establishing an adverse event reporting procedure
4. Reviewing your safety substantiation files
5. Assessing your current manufacturing practices against ISO 22716 ahead of binding GMP requirements

Capote Law Firm has been helping cosmetics companies navigate FDA compliance since 2006. For MoCRA compliance guidance, visit our MoCRA Compliance page or call (786) 207-1174 to schedule a free consultation.