MoCRA Explained: What US Cosmetics Facility Registration Actually Requires

What changed: from voluntary to mandatory

Before December 2022, US cosmetics facility registration through the FDA's Voluntary Cosmetic Registration Program was, as the name says, optional. The Modernization of Cosmetics Regulation Act (MoCRA) — the first major expansion of FDA's cosmetics authority since 1938 — made registration and product listing mandatory for any facility manufacturing or processing cosmetic products sold in the US, domestic or overseas. Enforcement discretion pushed the deadline out after passage, but the requirement itself is now permanent, not voluntary.

Facility registration: who has to register, and how often

Any facility — including contract manufacturers outside the US — that manufactures or processes a cosmetic product for the US market must register with the FDA, renew that registration every two years, and update it within 60 days of certain changes such as ownership, name, or address. A brand that owns the formula but outsources production doesn't register the facility itself — the manufacturer does — but the brand needs to confirm that registration actually exists and is current, since MoCRA gives FDA authority to suspend a facility's registration if it identifies a reasonable probability of serious health consequences.

Product listing: a separate requirement from registration

Registering the facility doesn't register the product. Each cosmetic product, or product family sharing the same formulation, sold in the US needs its own listing, including its ingredients, and the listing must be renewed annually. This is the part brands most often miss when they assume 'our manufacturer is FDA registered' covers everything — facility registration and product listing are two separate filings, and a manufacturer's registration status alone says nothing about whether a specific product has been listed.

Safety substantiation: the part that surprises brands

MoCRA requires 'responsible persons' — typically the brand or its US agent — to maintain records supporting that a cosmetic product is safe, and to make that substantiation available to FDA on request: testing data, safety assessments, or a documented rationale based on comparable products and ingredients. This didn't exist as a codified federal requirement before, and it moves the US closer to the substantiation file requirements that have applied under EU Cosmetics Regulation 1223/2009 for over a decade.

Adverse event reporting and recordkeeping

Responsible persons must report serious adverse events to FDA within 15 business days and keep records of all adverse events, serious or not, for six years — three years for small businesses. This is a hard deadline with legal consequences, not a best-practice guideline, and it requires the brand and manufacturer to have a working process for adverse event reports to actually reach the right person quickly.

Good Manufacturing Practice rules still being finalized

MoCRA also directs FDA to establish formal cosmetic GMP regulations, covering much of the same territory ISO 22716 already addresses internationally: facility, personnel, and process controls. Until FDA's specific rule is finalized, ISO 22716 certification remains the most widely recognised proof that a facility already operates to that standard — one reason it's increasingly treated as a baseline expectation, not a nice-to-have, for manufacturers selling into the US.

What 'FDA registered' should mean when you're vetting a manufacturer

When evaluating a contract manufacturer's claim of being FDA registered, ask for the facility registration number, confirm it's current, and ask separately how product listing and safety substantiation are handled for your specific formula — not just the factory. Our private label programs include facility registration, batch documentation, and export-ready compliance labeling as part of the standard process, not an add-on.