What MoCRA is
MoCRA — the Modernization of Cosmetics Regulation Act of 2022 — is the first major update to United States cosmetics law since 1938. Before it, the FDA's authority over cosmetics was narrow: the agency could act against adulterated or misbranded products, but it had little power to require registration, listing, or records before products reached the market. MoCRA changed that. It gave the FDA new authority over facility registration, product listing, safety substantiation, adverse event reporting, good manufacturing practice, and recalls — and it placed the core duties on a defined role called the responsible person.
The law applies to cosmetics marketed in the United States, including products made abroad and imported. Its requirements were phased in through 2023 and 2024, and the FDA has published guidance as the program has rolled out. The details below describe the framework as publicly presented by the FDA. They are not a substitute for the law itself, and where your situation is unusual, professional advice is worth the cost.
The one sentence to remember: putting your name on the label makes you the responsible person in most private-label arrangements — and the responsible person's duties stay yours even when a manufacturer does the practical work.
Who counts as the responsible person
Under MoCRA, the responsible person is the manufacturer, packer, or distributor whose name appears on the product label. In a private-label arrangement, the contract manufacturer makes the product, but the brand owner's name is the one on the label — so the brand owner is usually the responsible person. That single fact drives almost everything else in this guide.
Two consequences follow. First, the duties described below cannot be contracted away: an agreement can assign the work — filing a listing, keeping records, registering a facility — but the legal responsibility remains with the responsible person if the work is not done or is done wrong. Second, the responsible person's name and contact information must appear on the label so consumers can report adverse events. Labeling is not decoration; under MoCRA it is part of the compliance system.
The obligations, one by one
1. Facility registration
Facilities that manufacture or process cosmetic products for distribution in the United States must register with the FDA, and renew that registration every two years. A narrow exemption exists for certain very small businesses, based on average gross annual sales over the prior three years — but it does not cover every product type. Products intended for the eye area, for injection, for internal use, or that alter appearance for more than a day fall outside the exemption even for small sellers. Do not assume you qualify; check the current criteria.
2. Product listing
The responsible person must list each marketed cosmetic product with the FDA, including its ingredients and where it is manufactured. Listings must be kept current: when a product is discontinued, or when its formulation changes in a way that affects the listing, the listing must be updated.
3. Safety substantiation
The responsible person must ensure there is adequate substantiation that the product is safe for its intended use, and keep records supporting that substantiation available to the FDA. Substantiation can come from clinical or laboratory studies, published research, or other adequate evidence — what matters is that it exists, is documented, and matches the product as sold and the claims made for it. A product without adequate safety substantiation must carry a warning statement.
4. Adverse event reporting and records
The responsible person must report serious adverse events — events such as hospitalization, disfigurement, or a life-threatening experience associated with the product — to the FDA within 15 business days of receiving the report, and maintain records of adverse events. That makes two practical systems mandatory before launch: a way for consumers to reach you (the label contact information), and a written internal process for receiving, recording, assessing, and reporting events.
5. Good manufacturing practice
MoCRA directs the FDA to establish good manufacturing practice (GMP) regulations for cosmetics. Until a final GMP rule is in force, the practical standard is the one professional manufacturers already follow: documented procedures, controlled ingredients and processes, batch records, and quality checks. When evaluating a manufacturer, its GMP discipline — written procedures, traceability, and records — is one of the most informative things you can examine.
6. Labeling
Labels must carry the responsible person's contact information for adverse event reporting, an accurate ingredient declaration, and — as fragrance allergen rules are implemented — disclosure of fragrance allergens where required. Labeling errors are among the most common compliance failures for new brands, and they are entirely avoidable: have every label reviewed against current requirements before printing, and re-review it whenever the formula, the responsible person, or the rules change.
7. Records access and recalls
The FDA may access certain records, including safety substantiation and adverse event records. MoCRA also gave the FDA mandatory recall authority: if the agency determines a cosmetic has a reasonable probability of causing serious adverse health consequences and the responsible person refuses a voluntary recall, the FDA can order one.
Who does what: brand owner vs. manufacturer
In most private-label arrangements the manufacturer does the making and much of the filing, while the brand owner carries the legal duties. The table below shows the usual split in general terms. Your agreement should state each row explicitly — "the manufacturer handles compliance" is not a plan; a row-by-row assignment is.
| Obligation | Brand owner (responsible person) | Manufacturer / facility |
|---|---|---|
| Facility registration | Verify the facility is registered and current | Register the facility; renew every two years |
| Product listing | Ensure every SKU is listed accurately; update on changes | Often files listings on the brand owner's behalf |
| Safety substantiation | Ensure adequate substantiation exists; hold the records | Supply testing data and formulation evidence |
| Adverse event reporting | Receive, record, and report serious events within 15 business days | Forward any events it learns of; keep its own records |
| Good manufacturing practice | Verify procedures and records before committing | Follow documented GMP procedures; keep batch records |
| Labeling | Approve final labels; responsible-person contact on the label | Apply labels as specified; flag labeling issues it spots |
| Records and recalls | Maintain records; execute a recall if one is needed | Maintain batch and production records; cooperate on recalls |
The readiness checklist
Work through this before your first sale. Every row should have a named owner and a place where the evidence lives — not just a verbal assurance.
| Item | Owner | Evidence to hold |
|---|---|---|
| Facility registration verified current | Brand owner | Registration confirmation and renewal date |
| Every SKU listed with the FDA | Brand owner | Listing confirmations per product |
| Safety substantiation on file per product | Brand owner | Studies, assessments, or other supporting records |
| Label review completed (ingredients, contact, warnings) | Brand owner | Approved label artwork and review notes |
| Adverse event process written and staffed | Brand owner | Written procedure and a named contact |
| Manufacturer GMP procedures reviewed | Brand owner | Procedures summary and batch-record example |
| Written agreement assigning each MoCRA task | Both | Signed agreement with row-by-row responsibilities |
| Record-keeping system in place | Brand owner | Where records live and how long they are kept |
Five misunderstandings that get brands in trouble
- "My manufacturer handles all of it." A manufacturer can do the work, but the responsible person's duties stay with the brand owner. Verify, don't assume.
- "MoCRA is just registration." Registration is one piece. Listing, safety substantiation, adverse event reporting, GMP, and labeling are separate duties with separate failure modes.
- "Small brands are exempt." The small-business exemption is narrow, sales-based, and does not cover every product type or every duty.
- "Natural or organic products are exempt." There is no exemption for natural, organic, or clean-positioned products. The same duties apply.
- "We will sort out compliance after launch." Registration, listing, labeling, and adverse event systems must exist before the first sale. Retrofitting them under time pressure is how errors happen.
What to ask before you launch
Take these six questions to any manufacturer conversation. The quality of the answers tells you as much as the content.
- Who will be named as the responsible person on the label, and what contact information will appear?
- Is your facility registered, and can you show the current registration?
- Who files product listings, and how will I verify each SKU is listed?
- What safety substantiation exists for each formula, and what records will I hold?
- What is your adverse event process, and how quickly will events reach me?
- What GMP procedures do you follow, and can I review a batch record?
If you are still deciding between the stock-formula route and custom development, read Private label vs. custom formulation: which one fits your business? — the path you choose changes which of these questions matter most. For the minimum-order side of the same decision, see Low MOQ skincare, explained. When you are ready to talk to a manufacturer, the Renaud Naturals funnel covers private-label and custom-formulation programs, and the SASS-EE funnel covers organic sunless tanning products.