MoCRA: The Biggest US Cosmetics Overhaul Since 1938

Overview

The Modernization of Cosmetics Regulation Act overhauled FDA's authority over cosmetics for the first time in 86 years. Facility registration enforcement began July 1, 2024. FDA's public adverse-event dashboard went live September 12, 2025, making your product's complaint history searchable in real time. Here is what indie beauty and personal care brands actually need to do.

What MoCRA Actually Changed

Signed December 29, 2022. The biggest shift in US cosmetics law since FDR.

Updated May 2026 · Source: FDA Cosmetics Direct, MoCRA Sections 606–614

Before MoCRA, cosmetics were essentially self-regulated. Brands didn't need to register facilities, didn't need to substantiate safety before selling, couldn't be recalled by FDA, and had no adverse event reporting requirements. MoCRA changed all of that. The law adds six new sections to the FD&C Act covering facility registration, product listing, safety substantiation, adverse event reporting, mandatory recall authority, and eventually Good Manufacturing Practices.

The most immediate operational impact: any facility that manufactures or processes cosmetics for US distribution must register with FDA via Cosmetics Direct using SPL format. That registration was required by December 29, 2023 (or within 60 days of starting operations), with biennial renewal. FDA began enforcement of registration requirements in July 2024. Brands who don't manufacture, who use a contract manufacturer, still must ensure their CMO is registered, and must submit product listings under their own name.

Who Must Register and List

Registration vs. listing are two separate obligations. Most indie brands need both, or need to verify their CMO has one.

• Facility Registration: Who: the facility, not the brand · Any facility that manufactures or processes cosmetics for US distribution must register. If you manufacture in your own facility, you register. If you use a CMO, the CMO must register, and you must verify they have. Registration is via FDA Cosmetics Direct (SPL format). Biennial renewal required. Free.
• Product Listing: Who: the brand (responsible person) · The brand, not the CMO, submits product listings under their own name. Required for every cosmetic product marketed in the US, unless exempt. Information required: product name, applicable cosmetic category, list of ingredients in INCI descending order, responsible contact. Listed annually via Cosmetics Direct.

The $1M Small Business Exemption. What It Actually Covers

The most misunderstood element of MoCRA. The exemption covers registration and listing only. It does NOT exempt you from safety substantiation, adverse event reporting, labeling, or recall authority.

MoCRA's small business exemption applies to brands averaging under $1 million in annual US cosmetic sales over the preceding three years. Below that threshold, you are exempt from the facility registration and product listing requirements, and from the eventual GMP rule. That's all the exemption covers.

You are still fully subject to: safety substantiation (your products must be adequately safe before selling), adverse event reporting (serious AEs must be reported within 15 business days), all existing cosmetic labeling requirements, mandatory recall authority, and recordkeeping. The small-business exemption is narrower than most guides suggest, and it is voided entirely for brands making eye-mucous-membrane products (mascara, liquid eyeliner), injectables, internal-use cosmetics, or other categories FDA designates by rule.

$1M exemption DOES cover: These obligations are waived if under $1M

• Facility registration with FDA
• Product listing submission
• Eventual GMP compliance (when rule finalizes)

$1M exemption does NOT cover: These apply to all brands, any size

• Safety substantiation (required before selling)
• Adverse event recording and 15-day SAE reporting
• All cosmetic labeling requirements
• FDA mandatory recall authority
• 6-year recordkeeping (3 for small brands)
• Cosmetic-vs-drug crossover rules

Safety Substantiation in Practice

MoCRA requires "adequate substantiation", but FDA has not issued a formal definition. Here is what the working consensus actually looks like.

Section 608 requires that cosmetics be "adequately substantiated for safety" before marketing. FDA defines this as documentation that the product "meets the safety requirement when used as directed or in the customary or expected manner." The operative phrase is "experts qualified by scientific training." Three years post-enactment, FDA has not issued specific substantiation guidance, but the working consensus across the industry is a documented evidence stack.

Substantiation stack by product type (2026 consensus)

Cosmetic vs. Drug. The Crossover That Trips Most Brands

The moment a product makes a drug claim, the entire regulatory burden changes. Most indie brands selling SPF lip balm or antibacterial soap don't realize they're selling unapproved drugs.

Cosmetic only: These are cosmetics

• Moisturizer (no therapeutic claims)
• Deodorant (no antiperspirant claim)
• Shampoo (no dandruff claim)
• Lip balm (no SPF claim)
• Standard skincare, fragrance, makeup
• True soap (FD&C Act exempt from cosmetic rules)

Drug or drug/cosmetic combination: These are drugs

• SPF lip balm or moisturizer. OTC drug, Drug Facts panel required
• Antiperspirant. OTC drug, not cosmetic
• Anti-dandruff shampoo. OTC drug
• Antibacterial soap with "kills 99.9% bacteria" claim. OTC drug
• Acne treatments. OTC drug

The claim that crosses the line: One word can reclassify your product

A bar soap labeled "moisturizing" or "exfoliating" without drug claims is a cosmetic. Adding "kills bacteria" makes it a drug. Adding SPF to anything makes it a drug requiring NDA or OTC monograph compliance, NDC number, and drug establishment registration, none of which is MoCRA.

Adverse Event Reporting and the FAERS Dashboard

Serious adverse events must be reported within 15 business days. All AEs must be recorded. And since September 2025, that data is publicly searchable.

A serious adverse event (SAE) under MoCRA is any event associated with use of a cosmetic product that results in: death, life-threatening injury, inpatient hospitalization, persistent or significant disability/incapacity, significant disfigurement, a congenital anomaly, or requires medical or surgical intervention to prevent one of the above. This includes persistent scalp rashes, second-degree burns from a product reaction, and significant hair loss. Brands must submit SAE reports using MedWatch Form 3500A within 15 business days of becoming aware of the event.

All adverse events, not just serious ones, must be recorded and retained for 6 years (3 years for small businesses). FDA issued draft guidance on records access authority in January 2026. The FAERS dashboard launched September 12, 2025 makes these records, once reported, searchable by product, ingredient, and event type without a FOIA request.

Minimum adverse event recordkeeping system

What to capture for every AE: Your intake form must include

• Date received and date of event
• Product name and batch/lot number
• Description of the adverse event
• Consumer demographics (age range, gender)
• Medical outcome (hospitalization, severity level)
• How you learned of the event (email, social media, retailer)
• Follow-up contact information if provided

Practical minimum setup: What a small brand actually needs

• Email or web form alias: a dedicated safety@ address on your domain
• Simple Google Sheet or Notion database logging above fields
• Internal SOP: who receives, who reviews, 15-business-day SAE decision
• MedWatch 3500A familiarity (FDA online form)
• Annual review with cosmetic consultant or regulatory attorney

What Is Delayed, and What That Actually Means

The GMP rule and fragrance allergen rule are both delayed. Don't let that create false comfort.

Good Manufacturing Practices (GMP): Rule delayed, but prepare now

The GMP rule (Section 606) is on FDA's long-term action list. NPRM expected 2026–2027, final rule 2027–2028, compliance dates 2028–2030 at earliest. The rule will model ISO 22716 (Cosmetic GMP standard). Brands using ISO 22716-certified CMOs are already substantially compliant. The delay doesn't change the requirement, it just moves the enforcement date.

Note: the talc/asbestos proposed rule was withdrawn November 28, 2025 by HHS. This affects talc-containing products only.

Fragrance Allergen Disclosure (Section 609): Statutory deadline missed, still coming

The Section 609 NPRM was due June 29, 2024 and remains unpublished as of May 2026. When it lands, expect alignment with the EU's expanded ~80-allergen Annex III list, with thresholds of 0.001% for leave-on and 0.01% for rinse-off products. Realistic timeline: NPRM late 2026 at earliest, final rule 2027–2028. Start inventorying fragrance components against the EU list now.

Annual Compliance Budget by Brand Size

Realistic 2026 costs for indie and small beauty brands.

Action Plan by Brand Type

Start with your regulatory bucket, then work through the stack.

• Step 1: Determine your regulatory bucket for every SKU: Cosmetic, OTC drug, or exempt soap. Any product with SPF, antiperspirant, anti-dandruff, or antibacterial claims is a drug, not a cosmetic. Separate these before proceeding.
• Step 2: Check your $1M average sales threshold: Three-year average of US cosmetic (not drug) sales. If under $1M, registration and listing are not required, but substantiation, AE reporting, and labeling still apply.
• Step 3: Verify your CMO's registration: Ask for their FDA registration number from Cosmetics Direct. If they can't provide it, they may be non-compliant. This is a supply-chain risk that affects your product listings.
• Step 4: Submit product listings (if not exempt): Via FDA Cosmetics Direct. Required fields: product name, category, INCI ingredient list in descending order, responsible person contact. Keep updated as formulas change.
• Step 5: Audit substantiation files for all SKUs: For each SKU: supplier CoAs, SDS, CIR monograph references, IFRA compliance for fragrances, and for water-based products, a PET report ($400–$700/product). Add RIPT for leave-on products.
• Step 6: Set up adverse event intake: Create a dedicated safety@ address on your domain or a web form. Build a simple log capturing date, product/lot, event description, and outcome. Assign someone responsible for the 15-business-day SAE review decision.
• Step 7: Start inventorying fragrance components against the EU allergen list The US fragrance allergen rule hasn't landed yet but will align with the EU list. Brands that work with IFRA-compliant fragrance houses are substantially prepared. Get ingredient breakdowns from your fragrance suppliers now.

Sources

• FDA Cosmetics Direct