MoCRA Requirements for Cosmetics: The 2026 Checklist for Brands and Overseas Manufacturers

The Modernization of Cosmetics Regulation Act of 2022, known as MoCRA, is the biggest change to US cosmetics law since 1938. It became law on 29 December 2022, and its main obligations have been enforced since mid-2024. Several of its rules are still being written.

This checklist sets out the MoCRA requirements that apply today, who each one falls on, and which parts FDA has not finished. It is written for brands selling cosmetics in the United States and for the overseas manufacturers that make them. We are one of those manufacturers: HE Manufacturing's facility in Malaysia is US MoCRA facility registered.

This is a practical guide, not legal advice. For a specific product, confirm with a US regulatory consultant.

First: who is the "responsible person"?

Most MoCRA requirements fall on the responsible person. That is the manufacturer, packer or distributor whose name appears on the product label.

For a private label product, that is almost always the brand, not the factory. If your brand name is on the pack, product listing, safety records and adverse event reporting are your obligations, even though someone else made the product.

The manufacturing facility has its own separate obligation: registration. Getting this split clear is the most useful thing a brand can do before a US launch.

The MoCRA requirements checklist

1. Facility registration

Every facility that manufactures or processes cosmetics for the US market must register with FDA. This applies to facilities outside the United States too.

• Renew every two years
• Update within 60 days of certain changes, such as ownership or address
• FDA can suspend a registration if a product from the facility has a reasonable probability of causing serious harm

Registration belongs to the facility. A brand that outsources production does not register the factory, but it should confirm the registration exists and is current. Ask your manufacturer for its FDA facility registration number. You need it for product listing.

2. US agent for foreign facilities

A facility outside the US must name a US agent in its registration: a person or company in the United States that acts as FDA's contact. The agent's name and phone number go into the registration. Many overseas manufacturers use a specialist regulatory firm for this.

3. Product listing

The responsible person must list every cosmetic product sold in the US with FDA, including its ingredients and the registration number of the facility that makes it.

• Update the listing every year
• Products that differ only in colour, fragrance or quantity can be listed together

Facility registration and product listing are two different filings. "Our manufacturer is FDA registered" says nothing about whether your product is listed. This is the gap brands most often miss.

4. Safety substantiation

The responsible person must keep records showing the product is adequately substantiated as safe under normal or expected use. MoCRA does not prescribe specific tests, existing data can be used, and animal testing is not required.

In practice this means a safety file: ingredient safety data, stability and preservative efficacy testing, and a documented safety assessment. Brands that already sell into the EU have most of this in their Cosmetic Product Safety Report.

5. Serious adverse event reporting

If a consumer suffers a serious adverse event, the responsible person must report it to FDA within 15 business days of receiving the information, with a copy of the label. New medical information received within a year of the report must also be sent within 15 business days.

Records of all adverse events, serious or not, must be kept for six years, or three years for qualifying small businesses. FDA can inspect them.

6. Label contact information

Product labels must carry a domestic US address, US phone number, or electronic contact such as a website, through which the responsible person can receive adverse event reports. This has been required since 29 December 2024. Many overseas-made products failed this when it took effect, because their labels only carried a foreign address.

7. Professional-use labelling

Products intended only for licensed professionals, such as salon products, must state on the label that they are to be administered or used only by licensed professionals.

8. Mandatory recall and records access

FDA can order a recall if it finds a reasonable probability that a cosmetic is adulterated or misbranded and could cause serious harm, and the company will not recall it voluntarily. FDA can also access and copy certain records, including safety records, when specific conditions are met.

The small business exemption, and its limits

Businesses with average gross annual US sales under US$1 million over the previous three years are exempt from facility registration and product listing, and will be exempt from the future GMP rule.

The exemption does not apply to products that:

• Regularly come into contact with the mucous membrane of the eye
• Are injected
• Are intended for internal use
• Are intended to alter appearance for more than 24 hours and are not removed by the consumer, such as some long-wear products

Small businesses still have to meet adverse event reporting, safety substantiation and labelling requirements.

MoCRA requirements still pending in 2026

Several rules MoCRA told FDA to write have missed their statutory deadlines. As of October 2026, according to FDA's own MoCRA page and its published regulatory agenda:

Good Manufacturing Practice rule: not yet proposed. MoCRA set a deadline of December 2025 for a final GMP rule. It was missed, and FDA has since moved the rule to its long-term actions with no date. FDA's earlier draft guidance on cosmetic GMP still stands as guidance only. In practice, buyers treat ISO 22716, the international cosmetics GMP standard, as the benchmark, and MoCRA itself requires the eventual rule to be consistent, as far as practicable, with national and international standards.

Fragrance allergen labelling: proposal not yet published. The statutory deadline for a proposed rule was June 2024. The rule will require specific fragrance allergens to be named on labels, but the list has not been published. The current agenda points to a proposal in late 2026. Brands that already sell in the EU, which has required allergen labelling for years, are best placed.

Talc asbestos testing: back to the start. FDA proposed a testing rule in December 2024 and withdrew it in November 2025. The legal requirement for a testing standard remains, so a new proposal is expected, with no date.

PFAS report: published. FDA released its report on PFAS in cosmetics on 29 December 2025. It is a report, not a ban, though several US states have passed their own PFAS restrictions.

What MoCRA does not do

• FDA still does not approve cosmetics before sale, with the exception of colour additives. "FDA approved" on a cosmetic is wrong, and "FDA registered" means only that the facility is registered. We explain the difference in what FDA registered really means.
• Some products are drugs, not cosmetics. Sunscreens, anti-dandruff shampoos and antiperspirants are over-the-counter drugs in the US, with separate and stricter rules.
• MoCRA does not cover label format in general. Ingredient declaration and other label rules still come from existing law. See our cosmetic labelling guide for the US, EU and UK.

Who does what on a private label project

• Manufacturer: facility registration, US agent (if overseas), batch records, manufacturing to GMP, supporting the brand's safety file with stability, preservative and ingredient data
• Brand (responsible person): product listing, safety substantiation records, adverse event reporting and record keeping, US contact on the label, recalls
• Importer: customs entry and any import holds; often the same company as the brand, sometimes not

Agree this in writing before the first order. Our manufacturing for the United States page shows how we split it with brands.

Choosing a manufacturer for the US market

Ask any overseas manufacturer for four things before you commit:

• Its FDA facility registration number, and who its US agent is
• Its GMP certification, ideally ISO 22716, with the certificate and issuing body
• The stability and preservative efficacy data it will provide for your safety file
• Proof it is a real manufacturer, not a trader. In Malaysia, the NPRA register of licensed cosmetic manufacturers answers this for free; see how to verify a cosmetic manufacturer in Malaysia

HE Manufacturing is US MoCRA facility registered and works to ISO 22716 cosmetics GMP and ISO 9001:2015, with GMP from Malaysia's NPRA. Our quality system is on our quality page. Minimum order starts at 5,000 units and typical production lead time is 3 to 4 weeks after formula and artwork approval. The exact minimum for a given project depends on the formula, batch size, pack, decoration and labelling method.

Frequently asked questions

What are the main MoCRA requirements?

The main MoCRA requirements are facility registration every two years, annual product listing with ingredients, safety substantiation records, serious adverse event reporting within 15 business days, a US contact on the label, and professional-use labelling where relevant. FDA also gained mandatory recall authority. Rules on GMP, fragrance allergen labelling and talc testing are still pending as of October 2026.

Does an overseas manufacturer need to register under MoCRA?

Yes. Any facility that manufactures or processes cosmetics for sale in the United States must register with FDA, wherever it is located. A foreign facility must also name a US agent as FDA's contact. The registration is renewed every two years and updated within 60 days of certain changes.

Is the brand or the manufacturer responsible under MoCRA?

Both, for different things. The facility registers itself. The responsible person, meaning the company whose name is on the label, handles product listing, safety records and adverse event reporting. For a private label product, that is usually the brand, not the factory.

Do I need a US address on my cosmetic label?

You need a domestic US address, a US phone number, or an electronic contact such as a website through which adverse event reports can be received. This has been required since 29 December 2024. A foreign address on its own does not meet the requirement.

Is there a MoCRA GMP rule yet?

No. As of October 2026 FDA has not proposed the MoCRA GMP rule, and has moved it to long-term actions with no date. FDA's draft guidance on cosmetic GMP remains, and ISO 22716 is the standard most US buyers use when they audit a manufacturer.

Does MoCRA mean FDA approves my cosmetic?

No. FDA does not approve cosmetic products before sale, except colour additives. Facility registration and product listing are notifications, not approvals. Saying a cosmetic is "FDA approved" is inaccurate and can mislead consumers. "MoCRA facility registered" is the correct way to describe a registered factory.