MoCRA Compliance for Cosmetics: What Brands Must File in 2026

Chart by GZ Cosmetics Lab · Free to reuse with a link back to this page.

If you sell cosmetics in the United States, MoCRA compliance is no longer something your manufacturer handles quietly in the background. The Modernization of Cosmetics Regulation Act of 2022 gave the FDA its first meaningful set of powers over cosmetics since 1938, and it split the resulting paperwork between two parties: your factory has to register its facility, and you have to list your products. Brands that assume the factory covers both are the ones who get caught.

This guide is written for brand owners and sourcing managers who are producing overseas and shipping into the US. It covers what each side actually owes, the dates that matter, what you should demand from a manufacturer in writing, and two claims about FDA registration that circulate constantly in supplier sales decks and are simply not true. We include our own registration details as a worked example, because it is easier to explain what a real registration looks like than to describe one in the abstract.

What MoCRA Changed, in One Paragraph

MoCRA was signed on 29 December 2022 as part of Public Law 117-328. Before it, cosmetics were the least regulated product category the FDA touched: there was no mandatory facility registration, no mandatory product listing, and no requirement to hold safety substantiation on file. MoCRA introduced all three, added mandatory serious adverse event reporting, gave the FDA mandatory recall authority, and directed the agency to write binding good manufacturing practice regulations. The old Voluntary Cosmetic Registration Program, which some brands still reference, stopped accepting submissions on 27 March 2023 and its data was not carried across to the new system. If your compliance file still says "VCRP", it is three years out of date.

One structural point matters more than any individual rule: MoCRA does not create product approval. The FDA does not approve cosmetics, does not approve facilities, and does not issue certificates for either registration or listing. Everything below is notification and record-keeping, enforced after the fact. That distinction shapes how you should read any supplier claim about being "FDA approved".

The Split: Facility Registration Is the Factory's Job, Product Listing Is Yours

This is the single most expensive misunderstanding we see, so it is worth being precise.

Facility registration is owed by the owner or operator of any facility that manufactures or processes cosmetics distributed in the United States, including facilities outside the country. That is your manufacturer's obligation, not yours. A contract manufacturer registers once for the facility; it does not register separately for each brand it produces for, and one registration can cover work done for many different clients.

Product listing is owed by the "responsible person", which the statute defines as the manufacturer, packer or distributor whose name appears on the label. For a private label or white label brand, that is almost always you. Your factory's name is not on the label; yours is. The listing has to include the product's ingredient list in INCI names and the registration number of the facility where it was made — which means you need a specific number from your supplier before you can complete your own filing.

Read those two paragraphs together and the practical consequence appears: a factory cannot do your product listing for you, and you cannot do its facility registration. If a supplier tells you "we handle all FDA compliance", either they misunderstand the law or they are describing something narrower than they are implying. The useful question is not "do you handle FDA compliance" but "what is your facility registration number, and can you show me the submission receipt". If you are still at the stage of comparing suppliers, this belongs on your manufacturer selection checklist alongside GMP evidence.

The Dates, Including the One Most Articles Get Wrong

Three dates run this timeline, and the middle one is routinely misreported.

29 December 2022 — enactment. Every statutory deadline in MoCRA counts from this date.

29 December 2023 — the statutory deadline for existing facilities to register and existing products to be listed. Serious adverse event reporting also became live on this date, with a reporting window of 15 business days from when the responsible person receives the report, plus a further 15 business days for significant new medical information received within a year of the initial report.

1 July 2024 — when enforcement actually started. In November 2023 the FDA issued a compliance policy stating it did not intend to enforce the registration and listing requirements for a further six months beyond the statutory deadline. This is why you will see both "December 2023" and "July 2024" quoted as the deadline, and why some suppliers still describe registration as "becoming mandatory". It is not becoming mandatory. It has been enforced since July 2024, and failure to register is a prohibited act under the FD&C Act, which puts products from unregistered facilities at risk of import refusal.

After the initial filing, the cadence is: facility registration renewed every two years from the date of initial registration, registration changes updated within 60 days, product listings updated annually, and any product first marketed after enactment listed within 120 days of entering interstate commerce. Note that the 60-day rule attaches to facility registration changes, not to routine product listing updates; those two get conflated often enough that it is worth keeping them separate in your own calendar.

Two Supplier Claims That Are Not True

We are including this section because we have been on the receiving end of both claims from competitors' sales material, and because the second one appeared in our own site copy until we corrected it while writing this article.

"Here is our FDA registration certificate"

There is no such document. The FDA does not issue certificates for cosmetic facility registration or product listing, and it states plainly that registration is neither an approval programme nor a promotional tool. What genuinely exists is a submission and its receipt from the FDA's Cosmetics Direct portal. If someone shows you an official-looking certificate with an FDA logo on it, it was produced by the supplier or a third-party agent, not by the FDA. That does not automatically mean the registration is fake — but the certificate is not the evidence.

"You can look up our registration on the FDA website"

You cannot, and this one is worth understanding properly because it changes how you verify a supplier. Cosmetics Direct is a submission portal, not a search tool. The FEI Search Portal is for companies to find or confirm their own FEI number by company name and address; it does not report MoCRA registration status. The FDA publishes aggregate statistics — total active facility registrations, total active product listings, and a breakdown of facility counts by country and US state — but no company names, addresses or facility-level detail.

That is not an oversight. The statute restricts disclosure: product listing numbers are not made public, and brand names submitted in a facility registration, along with the facility registration number submitted in a product listing, are withheld from FOIA release. The link between brand and factory is exactly what the law protects. So a competitor cannot discover who manufactures your product through FDA records, and equally, you cannot self-serve a check on your supplier's registration.

What to do instead. Ask the supplier for the Cosmetics Direct submission receipt or registration record. Get the facility registration number in writing and make it a term of your supply agreement, because you will need it for your own product listing anyway. Give the number to your US agent, importer of record or regulatory consultant, who can pursue confirmation through channels available to them. And verify the credentials that are independently checkable — a GMP certificate from a named certification body can be checked in that body's own database, which is a different and stronger kind of evidence. We cover what those certificates do and do not prove in our guide to ISO 22716 and GMPC certification.

Our Own Registration, as a Worked Example

Our facility is registered with the FDA under MoCRA with FEI number 3038966060, valid through 29 July 2028. We publish the number in full because it is the number you would need for your own product listing, and because it lets you do the sanity checks that are available: our legal entity is Jiumei (Guangzhou) Biomedical Co., Ltd., which is the name printed on our Intertek ISO 22716 and GMPC certificates (HBPCER20260352 and HBPCER20260353, valid to 15 July 2029, verifiable at Intertek's own certificate database). That matters more than it sounds — a trading company can show you a certificate belonging to a factory it does not own, and matching the entity name across documents is how you catch that.

What our registration means: our facility is known to the FDA, our registration is current, we renew it biennially, and as a foreign facility we maintain a US agent as the statute requires. What it does not mean: the FDA has not approved or endorsed our facility, our formulas or any finished product. Nobody's registration means that. If we described it as an approval, you would be right to discount everything else we told you.

For context on scale, the FDA's published aggregates as of 30 June 2026 show roughly 16,400 active facility registrations worldwide, of which about 8,100 are in China. Registration is a baseline, not a differentiator. It tells you a supplier has done the minimum filing to be legally usable for the US market. Everything you actually care about — whether they can hold a formula stable, whether their documentation survives a customer audit — sits on top of that. Our note on how to verify a manufacturer's formulation capability deals with that second layer.

What Else MoCRA Puts on You as Responsible Person

Registration and listing get the attention because they have deadlines. The obligations without deadlines are the ones that bite during an FDA inquiry.

Safety substantiation. You must hold adequate substantiation of safety for each product. There is no prescribed test list; the standard is evidence a qualified expert would consider sufficient. In practice this is where your manufacturer's technical file becomes yours: challenge testing, stability data, and toxicological assessment of the formula. Agree at the quotation stage who produces what and who keeps the originals, because retrieving this two years later from a factory you no longer order from is unpleasant. This is one of several places where the difference between an OEM and an ODM arrangement changes who holds the underlying data.

Adverse event reporting and records. Serious adverse events go to the FDA within 15 business days, and you keep adverse event records for six years, or three years if you qualify as a small business.

Labelling. Labels must carry contact information through which adverse events can be reported to you, alongside existing Fair Packaging and Labeling Act requirements. Professional-use products carry their own labelling requirement.

Fragrance allergens. MoCRA directed the FDA to require disclosure of fragrance allergens on labels. Watch this one if you are running fragranced lines, and design your artwork with room to add a list rather than assuming your current layout is final.

Where the Small Business Exemption Applies, and Where It Does Not

If your average gross annual US cosmetic sales over the previous three years fall below one million dollars, adjusted for inflation, you may be exempt from the good manufacturing practice requirements and from registration and listing. Two cautions before you rely on that.

First, the exemption is disapplied for certain product types regardless of your size, including products that regularly contact the mucus membrane of the eye under normal use, injected products, products intended for internal use, and products intended to alter appearance for more than 24 hours where consumer removal is not part of normal use. Eye products are the category most launch-stage brands trip over.

Second, the exemption never covers safety substantiation, adverse event reporting or labelling. Those apply to every responsible person. And the FDA does not issue small business exemption certificates or ask you to file anything to claim it — which means the determination, and the risk of getting it wrong, sits entirely with you.

Sunscreen Is a Different Regime Entirely

If your range includes sunscreen, do not file it as a cosmetic. In the United States sunscreen is regulated as an over-the-counter drug, through the OTC monograph system, and MoCRA specifically exempts cosmetics and facilities already subject to the drug requirements of Chapter V from the cosmetic registration, listing, GMP and safety substantiation provisions. Your sunscreen goes down the drug route, with drug establishment registration, drug listing and pharmaceutical GMP; your moisturiser goes down the cosmetic route. A facility making both handles both regimes in parallel.

This is a real planning problem for brands used to Asian or European markets, where the same product is often a cosmetic. A sunscreen developed for an ASEAN launch cannot be redirected to the US on the same documentation. We deal with the formulation side of that split in our piece on sunscreen OEM for Southeast Asia.

The GMP Rule That Has Not Arrived Yet

MoCRA required the FDA to publish a proposed cosmetic GMP regulation within two years of enactment and a final rule within three years. Both of those statutory dates have now passed and, as of this writing, no proposed or final MoCRA cosmetic GMP rule has been published. The FDA held a public listening session on cosmetic GMP in 2023, and the only GMP document on the books remains a draft guidance from 2013, which predates MoCRA entirely.

Our read, and it is a judgement rather than a fact: plan against ISO 22716 now. The draft guidance and the international standard cover substantially the same ground, and a facility running to ISO 22716 with a genuine third-party audit behind it is unlikely to be badly positioned when the rule does land. What we would not do is wait for the rule before asking your supplier for GMP evidence — the safety substantiation obligation on you already depends on the quality of their manufacturing records, rule or no rule.

A Sequence That Avoids Rework

The order below reflects where projects actually stall, which is almost always at a missing number or a document nobody agreed to produce.

1. Before you order: confirm the facility is registered and get the registration number in writing. Ask who the facility's US agent is. Confirm which party produces stability, challenge and toxicological data, and who keeps the originals.
2. During development: lock the ingredient list in INCI names, because that is what your listing needs and a late formula tweak means a late listing amendment. Design labels with the adverse-event contact detail and room for allergen disclosure.
3. Before first shipment: appoint your US agent or importer of record. Confirm your own responsible person status and prepare the listing.
4. Within 120 days of first marketing: file the product listing.
5. Ongoing: annual listing updates, biennial facility renewal on the factory's side, 60 days for registration changes, 15 business days for serious adverse events. Put all four in a calendar, not in an email thread.

For a full launch view that folds these steps into costs and lead times, see our guide to starting a private label skincare line.

What a US-Bound Project Looks Like From Our Side

Concretely, for brands shipping into the US, we work to a minimum order quantity of 3,000 units per SKU, sample lead time of 5 to 7 days, and production lead time of 20 to 35 days once the formula and packaging are locked. We supply our facility registration number for your listing, our INCI ingredient breakdown, and stability and challenge test reports for the file you are required to keep. We do not file your product listing for you — legally we cannot, since you are the responsible person — but we will tell you exactly which fields we can supply and which need your input.

One thing we will push back on: if you ask us to describe our FDA registration as approval or certification in your marketing, we will decline, and you should treat any supplier who agrees to it as a supplier who will be similarly relaxed about other claims.

Frequently Asked Questions

Does my Chinese manufacturer need to register with the FDA?

Yes, if the products it makes are distributed in the United States. Facility registration applies to foreign facilities, and a foreign facility must also identify a US agent in its registration.

Can I check my supplier's MoCRA registration myself?

No. There is no public FDA database of cosmetic facility registrations. Cosmetics Direct is a submission portal, and the statute keeps listing numbers and brand-to-facility links out of public release. Request the submission receipt and put the registration number in your contract.

Who files the product listing — me or the factory?

You, if your brand name is on the label. The responsible person is the manufacturer, packer or distributor named on the label, and product listing is that party's obligation.

Is a MoCRA registration the same as FDA approval?

No. The FDA does not approve cosmetics or cosmetic facilities and does not issue certificates for registration or listing. Registration means the facility is known to the agency and subject to inspection.

What happened to the VCRP?

It stopped accepting submissions on 27 March 2023 and was replaced by MoCRA's mandatory registration and listing. VCRP data was not migrated, so a previous VCRP filing does not satisfy the current requirement.

Do I need to renew anything, or is registration once and done?

Facility registration is renewed every two years from the initial registration date, with changes updated within 60 days. Your product listings are updated annually, and new products are listed within 120 days of first marketing.

Does MoCRA apply if I only sell on Amazon or through a US distributor?

The obligations attach to the responsible person named on the label and to the manufacturing facility, not to the sales channel. If your brand is on the label, selling through a marketplace or a distributor does not move the listing obligation off you.

The Short Version

Your factory registers its facility and renews every two years. You list your products, update annually, and file new products within 120 days. You hold safety substantiation and report serious adverse events within 15 business days. Enforcement has been live since July 2024, so treat any "becoming mandatory" language as a signal the person using it has not read the current position. There is no FDA certificate and no public lookup, so verify through documents you can put in a contract and credentials you can check in an independent database. Sunscreen goes down the drug route, not this one.

If you are choosing between manufacturers for a US launch and want a straight answer on what we can and cannot supply for your filing, send us your product list and we will map the paperwork against your timeline before you commit to an order.