What MoCRA rules apply when a spa sells its own skincare?
MoCRA is the most significant expansion of FDA authority over cosmetics since 1938, and it changed the picture for everyone selling cosmetics in the United States, including spas selling their own labeled line. As the brand on the label, the spa is usually the responsible person, with duties for listing, labeling, safety records, and adverse-event reporting.
The Modernization of Cosmetics Regulation Act of 2022 was signed into law on 29 December 2022, as part of the Consolidated Appropriations Act, 2023. It is the most significant expansion of the FDA’s authority over cosmetics since 1938, and it changed the picture for everyone selling cosmetics in the United States — including spas selling their own labeled line.
MoCRA added mandatory facility registration, mandatory product listing, safety substantiation, adverse event reporting, good manufacturing practice requirements, and — for the first time — mandatory recall powers. Two things it did not do are worth knowing first. The FDA does not approve cosmetics, and it never has: registration and listing are filings, not approvals. And the FDA does not issue certificates for those filings — a registration number is not a seal of approval, and it should never be presented as one.
The responsible person is (usually) you
MoCRA’s duties sit on the “responsible person”: the manufacturer, packer, or distributor whose name appears on the product label. For a private-label brand, that is usually the brand owner — you — not the contract manufacturer that made the product. The responsible person handles product listing, adverse event reporting, safety substantiation, and labeling compliance, so it is the first thing to settle before a product ships.
The duties cannot be handed off by contract alone. But the practical work can be assigned: a manufacturer can register its facility, file product listings on your behalf, and keep records. That is the normal shape of a private-label arrangement — the manufacturer does the making and much of the filing, while the brand owner carries the legal duties. If the paperwork is wrong or missing, the brand owner answers for it. Confirm in writing who does what, and verify it.
“The manufacturer handles compliance” is not a plan. A row-by-row assignment is: who registers, who lists, who holds the safety records, who reviews the label. Get it in writing before the first sale.
Facility registration
Any facility that manufactures or processes cosmetics for US distribution must register with the FDA and renew that registration every two years. Facilities that were operating when MoCRA was signed had to register by 1 July 2024; a new facility must register within 60 days of beginning manufacturing. Registrations are updated within 60 days of any change, and the FDA uses the facility’s FEI number as its registration number.
A foreign facility registering with the FDA must also name a US agent — a person or firm that resides in the United States or maintains a US place of business and is physically present here. A mailbox or answering service does not qualify. If your line is made abroad, ask your manufacturer to confirm the facility is registered and the US agent is named.
Product listing
The responsible person lists each marketed cosmetic product with the FDA, including its ingredients, and updates that listing annually. A new product must be listed within 120 days of first going on the market. The FDA’s preferred filing tool is Cosmetics Direct.
Listing is per product, not per brand: every SKU on your line needs its own listing, with its own ingredient list. That is another reason to keep a first line short — every additional SKU is another listing to file, update, and keep accurate.
Safety substantiation and adverse events
The responsible person must hold records adequately supporting that each product is safe — safety substantiation, kept on file per product. And serious adverse events in the United States must be reported to the FDA within 15 business days, with records of all adverse event reports kept for six years. The label must also carry the responsible person’s domestic contact information so a consumer can report an event.
These two duties apply regardless of size. The small-business exemption below does not remove them: do not read a registration exemption as a silence exemption.
Labels
Labels carry more than the brand. The responsible person’s label must display a domestic address, a domestic phone number, or electronic contact information such as a website or email address — mandatory since 29 December 2024. Products marked “For Professional Use Only” must carry that statement clearly and prominently — mandatory since 29 December 2023. Full ingredient disclosure applies as before, and the label is where the responsible person’s identity is established: read the actual label, because the name on it decides who the law holds responsible. Label rules are only one part of getting a product shelf-ready: our guide to skincare product label requirements covers the full label — INCI order, net contents, warnings, and what goes where.
The small-business exemption
MoCRA exempts certain small businesses from facility registration, product listing, and good manufacturing practice requirements. A business qualifies as small if its average gross annual sales of cosmetic products in the United States for the previous three-year period is less than $1,000,000, adjusted for inflation.
The exemption is narrower than it sounds. It does not apply if you manufacture or process, or are the responsible person for, products that regularly contact the mucous membrane of the eye, products that are injected, products intended for internal use, or products intended to alter appearance for more than 24 hours where the consumer does not remove them as part of ordinary use. And it does not remove the other obligations: safety substantiation, adverse event reporting, and labeling rules apply regardless of size. Most small spas will fall under the exemption for registration and listing — but that is the beginning of the compliance picture, not the end of it.
What about my spa itself?
Beauty shops and salons are exempt from facility registration and product listing — unless the establishment manufactures or processes cosmetic products at that location. Retailers and distributors, including individual sales reps and direct sellers, are likewise exempt unless manufacturing on-site. Establishments that solely label, relabel, package, repackage, hold, or distribute — but do not fill product containers — are also exempt from registration.
Selling your own labeled line does not make your spa a manufacturer. But as the brand owner whose name is on the label, you are the responsible person for those products, and the responsible person’s duties — listing, safety records, adverse event reporting, labeling — follow the name on the bottle. Do not assume your brand qualifies for an exemption: check the current criteria, or get professional advice.
What to confirm in writing with your manufacturer
Before your first sale, get a written agreement assigning each MoCRA task, with a named owner and a place where the evidence lives. Work through the MoCRA checklist — eight readiness items, each with a named owner — and confirm these seven points with your manufacturer:
- Is the manufacturing facility registered with the FDA, and is the registration current?
- Who files the product listing for each SKU, and who verifies it is accurate?
- Who holds the safety substantiation records for each product?
- Who reviews the final label, and is regulatory review part of the service or an extra?
- Who receives adverse event reports, and who files them with the FDA within 15 business days?
- What good manufacturing practice procedures does the manufacturer follow, and have you reviewed them?
- Is there a written agreement assigning each task — and does it name the responsible person?
Ask the six questions in our MoCRA guide for brand owners, start the manufacturer conversation with responsibilities assigned in writing, and keep the evidence where you can find it. The med-spa private-label page and the estheticians’ private-label page both carry the same rule: confirm in writing who does what, and verify it.
General information, not legal advice. This guide is general educational information about MoCRA as publicly described by the FDA. Cosmetics regulation is detailed and fact-specific. For decisions about your products, consult a regulatory professional or attorney who works with cosmetics.