In this article
The short answer
Under MoCRA, the Modernization of Cosmetics Regulation Act of 2022, cosmetics sold in the United States must be made in a facility registered with the FDA, and each product must be listed with the FDA through Cosmetics Direct by the responsible person named on the label. Brands must also hold safety substantiation, report serious adverse events, and meet new labeling and GMP requirements set out in fda regulations. Some small businesses are exempt from registration and listing, but not from safety duties.
Key takeaways
- MoCRA replaced a largely voluntary US system with mandatory facility registration and product listing, both handled through the Food and Drug Administration's Cosmetics Direct portal.
- The responsible person, the manufacturer, packer or distributor named on the label, owns the listing, adverse event reporting and safety substantiation duties.
- Facilities register once and renew every two years; product listings are submitted before or within 120 days of marketing and updated annually.
- Foreign facilities, including UK and EU makers shipping to the US, must register and must appoint a US agent.
- A small business exemption removes registration and listing for very small brands, but not for products used near the eyes, injected, for internal use or that alter appearance for more than 24 hours.
For decades the United States was the easy market for cosmetics: no premarket approval, no mandatory registration and a regulator that largely reacted rather than required under the federal regulations then in place. That changed with the Modernization of Cosmetics Regulation Act of 2022, known as MoCRA, the most significant expansion of the FDA's authority over cosmetics in more than eighty years and the first major amendment to the cosmetic act provisions of the Federal Food, Drug, and Cosmetic Act since they were written. UK and EU brands used to the Cosmetics Regulation will recognise many of the ideas, but the mechanics are different, and a product that is fully compliant in London or Tallinn is not automatically compliant in Florida.
This guide explains what MoCRA requires of a brand selling cosmetics in the US: who the responsible person is, how facility registration and product listing work through Cosmetics Direct, the timelines, the small business exemption and its limits, the safety substantiation, adverse event and labeling duties, and what UK and EU makers need to do differently from their home markets. Phoenix, with an office in Pensacola, Florida, handles MoCRA product listing for brands entering the US.
What MoCRA changed
Before MoCRA, US cosmetic regulation rested on the prohibition of adulterated or misbranded products under the Federal Food, Drug, and Cosmetic Act and a voluntary registration programme few used. MoCRA introduced mandatory facility registration and product listing, a legal definition of the responsible person with specific duties, mandatory serious adverse event reporting, a requirement to hold adequate safety substantiation, FDA authority to order recalls and to access records, and directions to the FDA to issue rules on good manufacturing practice, fragrance allergen labeling and talc testing, all in the name of consumer protection. It kept the principle that cosmetics do not need premarket approval, so there is no US equivalent of a CPSR being reviewed before sale, but it made the brand's own safety evidence a legal requirement.
Who is the responsible person under MoCRA
MoCRA defines the responsible person as the manufacturer, packer or distributor whose name appears on the product label. That entity submits the product listing, receives and reports adverse events, holds the safety substantiation, and maintains the records. For a UK brand selling through its own US website or a marketplace, the brand is usually the responsible person; for a brand sold through a US distributor who relabels, the distributor may be. The label must carry the responsible person's name and a US address, telephone number or electronic contact through which adverse events can be received. Deciding who this is, and putting the contact on the label, is the first practical step.
Facility registration
Every facility that manufactures or processes cosmetics for distribution in the US must register with the Food and Drug Administration, whether it is in the US or abroad. Facilities that only label, relabel, package, hold or distribute finished products do not need to register, and neither do beauty shops, retailers or research facilities engaged purely in research and development. Registration is done through the Cosmetics Direct portal, includes the facility's contact details, its FDA establishment identifier, the product categories made there and the brand names, and must be renewed every two years. A new facility must register within sixty days of first manufacturing for the US market. A foreign facility must designate a US agent, a person or business located in the US who acts as its communication channel with the FDA.
Contract manufacturers. If your products are made by a contract manufacturer, the manufacturer's facility registers, and the manufacturer may register on behalf of the brands it produces for or the brand may register the facility with the manufacturer's consent. Confirm which arrangement applies and that it has actually been done; a brand cannot list a product made in an unregistered facility.
Product listing
The responsible person must list each cosmetic product marketed in the US, submitting the product name, the responsible person's details, the facility where it is made, the product category, the full ingredient list including fragrances, flavors and colors, and, if you choose to include one, an image of the label. Listings are submitted through Cosmetics Direct in the FDA's structured product labeling format, and a single listing can cover multiple flexible variants such as shades or scents where the formulation differs only in those respects. A product must be listed before it is marketed or within 120 days of first marketing, and listings must be updated annually to reflect any changes or to confirm they are current. Each listing receives an FDA listing number that distributors and marketplaces increasingly ask for.
Phoenix prepares and submits listings through Cosmetics Direct as part of our FDA MoCRA product listing service, including the ingredient nomenclature conversion from INCI to the format the FDA expects.
Timelines that matter
| Requirement | When |
|---|---|
| Facility registration, existing facility | By the FDA's initial compliance date, since passed; new entrants register before or promptly on entering the US market |
| Facility registration, new facility | Within 60 days of first manufacturing for the US market |
| Facility registration renewal | Every two years |
| Product listing, new product | Before marketing or within 120 days of first marketing |
| Product listing update | Annually, or when the listing changes |
| Serious adverse event report | Within 15 business days of receipt, with follow up information within 15 business days of receiving it |
| Adverse event records | Retained six years, three for small businesses |
The small business exemption
Responsible persons and facility owners whose average gross annual US cosmetic sales over the previous three years were below a set threshold, one million dollars at enactment, are exempt from facility registration and product listing. The exemption is narrower than it sounds. It does not apply to products that regularly come into contact with the mucus membrane of the eye under customary use, products that are injected, products intended for internal use, or products intended to alter appearance for more than twenty four hours and that consumers do not normally remove. So a small brand selling body butter and lip balm may be exempt from registration and listing; the same brand selling mascara or eyeliner is not. Qualifying small businesses are also outside the coming GMP rules for the same products. But no brand of any size is exempt from safety substantiation, adverse event reporting and labeling duties, since those exist to protect public health regardless of company size.
Safety substantiation
MoCRA requires the responsible person to ensure and maintain records supporting adequate substantiation that each product is safe, meaning tests, studies, research, analyses or other evidence that qualified experts would consider sufficient. There is no prescribed format and no submission to the FDA, but the records must exist and be available on request. For a UK or EU brand, the CPSR and the Product Information File are exactly this kind of evidence, and a well maintained PIF will usually satisfy the substantiation requirement with little adaptation, provided it reflects the US version of the product and its label.
Brands without a CPSR or equivalent assessment have no substantiation to point to, which is why the two markets' requirements are best planned together.
Adverse event reporting
The responsible person must report serious adverse events associated with the product to the FDA within fifteen business days of receiving the information, using the FDA's MedWatch form, and must submit new medical information received within a year within a further fifteen business days. Serious means death, life threatening experience, hospitalisation, persistent or significant disability, congenital anomaly, or significant disfigurement including serious and persistent rashes, second or third degree burns and significant hair loss, or an event requiring medical or surgical intervention to prevent one of these. Records of all adverse events, serious or not, must be kept for six years. The label contact through which consumers report is what makes this system work for public health, and its absence is itself a labeling violation.
Labeling and GMP
MoCRA added the responsible person contact to the existing US labeling rules set out under the Code of Federal Regulations, requires professional use only products to be labeled as such, and directs the FDA to require fragrance allergen labeling by rule, aligning the US closer to the EU's allergen declaration approach. It also directs the FDA to establish good manufacturing practice regulations for cosmetic facilities, consistent with national and international standards, which will bring US expectations close to ISO 22716. Brands already operating to the harmonised GMP standard for the UK and EU are well placed; brands without documented GMP should start now rather than wait for the rule.
What to have ready before you log in to Cosmetics Direct
- Company details. Legal name, address, contact and, for foreign facilities, the US agent's details.
- Facility details. Address, an FDA establishment identifier if one has been issued, the product categories made and the brand names.
- For each product. Its exact name as labelled, the responsible person, the manufacturing facility, the FDA product category, the complete ingredient list and, optionally, a label image.
- Ingredient names in US format. Common or usual names as the FDA expects, which for most ingredients follow the same nomenclature but differ for some, and colour additives by their US names.
- Fragrance and flavor. Declared as such in the listing, with any allergen information ready for when the allergen rule applies.
- Variants. A clear statement of which products are flexible variants of one listing and which need separate listings.
What MoCRA does not require
MoCRA is often described as bringing US cosmetics regulation into line with the EU, which overstates it. There is no premarket approval and no submission of the safety assessment to the FDA; the FDA does not review your listing for safety, it records it. There is no requirement to appoint an independent safety assessor with prescribed qualifications, although the substantiation must be evidence a qualified expert would accept. There is no equivalent of the EU's positive and negative ingredient annexes beyond the US colour additive rules and a shorter list of prohibited and restricted ingredients. And the GMP and allergen labeling requirements exist as directions to the FDA to make rules, with the detailed obligations following when those rules take effect. Brands should meet the letter of what MoCRA requires today while building towards the standards the pending rules will bring.
What UK and EU makers need to do differently
- Register the facility. Your UK or EU manufacturing site is a foreign facility and must register and appoint a US agent.
- Name a US contact. The label needs a responsible person with a US address, phone or electronic contact for adverse events.
- List each product. Even products already notified through SCPN or CPNP must be listed separately with the FDA.
- Check the label conventions. US ingredient labeling uses different nomenclature rules and declaration formats from INCI as used in the EU, and some UK or EU permitted ingredients are restricted in the US and vice versa.
- Adapt claims. Claims that are cosmetic in the UK or EU may be drug claims in the US, particularly around sun protection, acne and dandruff, which are regulated as drugs.
- Reuse your evidence. Your CPSR and PIF are your safety substantiation; keep them current for the US version of the product.
Common mistakes
- Assuming SCPN or CPNP notification covers the US. It does not; MoCRA listing is separate.
- Assuming small means exempt. Eye area, injectable, internal and long wear products lose the exemption regardless of sales.
- No US contact on the label. A labeling violation and a broken adverse event system.
- Listing before the facility is registered. The facility must be registered first.
- Letting listings lapse. Annual updates are required.
- Sunscreen or acne claims. These are drugs in the US and cannot be listed as cosmetics.
If you are planning a US launch, a regulatory consultation maps which of your products can move across as cosmetics, which need reformulation or relabeling, and who your responsible person should be.
Myths we hear
- MoCRA only applies to US brands. Foreign facilities that make cosmetics for the US market must also register.
- Small businesses are fully exempt. Qualifying small businesses are exempt from some requirements, such as registration and listing, but not from adverse event reporting or safety substantiation.
- Software alone makes you compliant. Software helps with submissions, but you still need accurate data, safety substantiation and labels.
- Non-cosmetic products have no safety rules. General product safety rules still apply.
- A product sold in a beauty shop is a cosmetic. Classification depends on purpose.
What to do this week
- Check whether the small-business exemption applies.
- Register facilities and list products through Cosmetics Direct.
- Keep records of safety substantiation.
- Add a US contact on the label for adverse event reports.
- Confirm product classification.
- Check that no claim (SPF, acne, dandruff) turns the product into a US drug.
Frequently asked questions
What is MoCRA?
The Modernization of Cosmetics Regulation Act of 2022, the US law that introduced mandatory FDA facility registration and product listing for cosmetics, defined the responsible person, and required safety substantiation, serious adverse event reporting and new labeling and GMP rules.
Do I need to register with the FDA to sell cosmetics in the US?
The facility that manufactures your products must be registered, and each product must be listed by the responsible person, unless the small business exemption applies and the products are not in the excluded categories. Safety, adverse event and labeling duties apply regardless.
What is MoCRA product listing?
The submission to the FDA, through Cosmetics Direct, of each cosmetic product's name, responsible person, manufacturing facility, category and full ingredient list, with an optional label image. It must be done before marketing or within 120 days, and updated annually.
Who is the responsible person under MoCRA?
The manufacturer, packer or distributor whose name appears on the label. That entity lists the product, holds the safety substantiation, receives and reports adverse events and keeps the records.
Does the small business exemption cover all products?
No. It exempts very small businesses from registration, listing and the coming GMP rules, and not for products used near the eyes, injected, for internal use or that alter appearance for more than 24 hours. Safety substantiation, adverse event reporting and labeling apply to everyone.
Does my UK or EU CPSR count as MoCRA safety substantiation?
In most cases, yes. MoCRA requires adequate evidence of safety that qualified experts would accept, without a prescribed format, and a current CPSR with its Product Information File is exactly that kind of evidence, provided it covers the product as sold in the US.
Does a foreign manufacturer need a US agent?
Yes. Every foreign facility that registers must designate a US agent, a person or business located in the United States, as its point of contact with the FDA.
Join the conversation