under MoCRA

US regulatory guide

Selling cosmetics in the US under MoCRA.

A practical guide to the Modernization of Cosmetics Regulation Act: facility registration, annual product listing, the US Agent role and what changed.

Cosmetics on a US retail shelf, guide banner

Reviewed by Cassandra Maddocks, chemist & biochemist · last reviewed 26 July 2026

For most of its history the US cosmetics market was lightly regulated at the federal level compared with Europe. The Modernization of Cosmetics Regulation Act, known as MoCRA, changed that. It introduced a federal registration regime that places new, enforceable obligations on companies that manufacture, process or sell cosmetics in the United States. Brands used to the older, looser rules face a real change, and so do international brands meeting US requirements for the first time. This guide explains what MoCRA requires, who is responsible for each part, the documents and portals involved, the deadlines that matter, the mistakes that get products flagged, and how a brand outside the US sets itself up correctly.

What MoCRA requires
  • FDA registration for facilities that make or process US-market cosmetics.
  • A current product listing for each marketed product, including its ingredients.
  • A US Agent for facilities located outside the United States.
  • A US contact for adverse-event reporting on the product label.
  • Safety substantiation, recordkeeping and serious adverse-event reporting.
  • Registrations and listings kept current and renewed every two years.

What MoCRA is and who it covers

MoCRA is the Modernization of Cosmetics Regulation Act, the largest expansion of the FDA's authority over cosmetics in decades. It defines a Responsible Person as the manufacturer, packer, or distributor whose name appears on the product label, under section 609(a) of the Federal Food, Drug, and Cosmetic Act and section 4(a) of the Fair Packaging and Labeling Act. That Responsible Person carries the core obligations: listing each product with the FDA, keeping safety substantiation, and reporting serious adverse events. The regime applies to companies that make, process, or sell cosmetics for the US market, whether they are based in the United States or abroad.

The FDA registration and listing page with the biennial facility registration requirement highlighted
The FDA's Registration and Listing page for cosmetic product facilities, with the registration and biennial renewal requirement highlighted. Captured 26 July 2026. View the official text.

One point causes trouble more than any other. Listing a product with the FDA does not mean the product is "FDA approved". The FDA does not approve cosmetic products before they go on the market. Listing records what is being sold; it is not a stamp of approval, and describing a product as FDA approved is itself a labeling problem.

Facility registration

MoCRA requires that the facilities which manufacture or process cosmetics for the US market be registered with the FDA. Registration identifies the facility to the regulator and is a precondition for lawfully supplying the US market. Both domestic and foreign facilities fall within scope where their products are marketed in the United States. There is no FDA fee to register a facility under section 607 of the Federal Food, Drug, and Cosmetic Act. Before a facility can be registered it needs an FDA Establishment Identifier, known as an FEI number, which the submission depends on. Registrations are not permanent; they must be renewed every two years. CIG handles this through its US Agent and MoCRA service.

Product listing

Separately from facility registration, the Responsible Person must submit a product listing for each cosmetic, identifying the product and its ingredients, and keep that listing current. Listing is also free of charge. The timing depends on whether the product was already on sale. For a product already marketed as of the compliance deadline, the initial listing was due by that deadline. For a new product, the initial listing is due within 120 days of the product being marketed in the United States. This is an ongoing obligation, not a one-time filing, and the listing has to reflect the products actually on the market. The who, when and how are in our product listing guide.

The small-business exemption, and what it does not cover

MoCRA defines a small business as one whose average gross annual US cosmetic sales over the previous three-year period are under $1,000,000, a figure the FDA adjusts for inflation. A qualifying small business is exempt from good manufacturing practice requirements, facility registration, and product listing. That sounds like a clean way out, and it is where many indie founders relax too early. The threshold, the voiding categories and what still applies are unpacked in our small-business exemption guide.

Two limits matter. First, the exemption is voided for a business that makes any product in a higher-risk category: products that regularly contact the mucous membrane of the eye, products that are injected, products intended for internal use, or products that alter appearance for more than 24 hours where removal is not part of ordinary use. A single eyeliner, eye cream, or long-wear tint can knock a whole business out of the exemption. Second, the exemption only removes registration and listing. Adverse-event reporting, labeling rules, and safety substantiation still apply to every brand, including the smallest. An exempt maker still has to hold a safety substantiation record for every product.

A common trap: drug claims

Cosmetics are regulated as cosmetics. A product that claims to treat, cure, or change the structure or function of the body is regulated as a drug, which sits outside MoCRA under stricter rules. Claims such as "treats eczema", "repairs the skin barrier", or "reduces inflammation" on a Shopify page, a TikTok video, or a label can reclassify a cosmetic as an unapproved drug and have triggered FDA warning letters. If a claim describes a therapeutic effect, review it before publishing.

The US Agent for foreign facilities

A facility located outside the United States that must register has to designate a US Agent. The US Agent resides in or maintains a place of business in the United States and is physically present there; a mailbox or an answering service does not satisfy the requirement. The US Agent is the facility's point of contact with the FDA and handles communications with the regulator. An international brand without its own US presence has to appoint one, much as it would appoint a Responsible Person in Europe.

The US Agent is a separate thing from two roles brands often confuse it with. It is not the same as the Responsible Person, which is defined by whose name is on the label and can sit outside the US. And it is not the same as the US contact for adverse-event reporting, which must appear on the product label so a US consumer can report a problem. A foreign brand can end up needing all three: a Responsible Person doing the listing, a US contact printed on the label, and a US Agent for the foreign facility. CIG can act as your US Agent.

Safety substantiation and records

MoCRA sets duties for safety substantiation, recordkeeping and adverse-event reporting. The documentary regime is structured differently from the European PIF and CPSR, but the expectation is familiar: a brand must be able to stand behind the safety of what it sells and produce records when asked. Safety substantiation means holding evidence that a product is safe under normal and expected conditions of use. It does not always require clinical trials; it means the right tests and reasoning for the product, kept on file. Even a business that is exempt from registration and listing has to keep this for every product. Our safety assessment (CPSR) work supports that substantiation.

Adverse-event duties run alongside. The Responsible Person must report a serious adverse event to the FDA within 15 business days, and submit any follow-up information within a further 15 business days. Records of adverse events are kept for six years, or three years for smaller businesses. A serious adverse event includes outcomes such as hospitalization, a life-threatening reaction, disfigurement, or a persistent significant disability. These duties apply regardless of the small-business exemption.

The Cosmetics Direct portal and the SPL format

Registrations and listings are submitted through Cosmetics Direct, the FDA's free electronic tool. It authors submissions in Structured Product Labeling, an XML format the FDA uses across its systems. Brands unfamiliar with FDA systems find the SPL format the hardest part of the process, because a small structural error can bounce a submission. Paper alternatives exist: Form FDA 5066 for facility registration and Form FDA 5067 for product listing. The FEI number has to be in place before a submission can go through.

Step by step: how a foreign brand sets up under MoCRA

The order below is the practical sequence for a brand based outside the United States. A domestic brand skips the US Agent step.

  1. 1Confirm your role. Identify the Responsible Person (whose name is on the label) and the facility or facilities that make or process the product.
  2. 2Check the small-business position. Work out whether average annual US cosmetic sales sit under the $1,000,000 threshold, and whether any product falls into a higher-risk category that voids the exemption.
  3. 3Obtain an FDA Establishment Identifier (FEI) for each facility that has to register.
  4. 4Appoint a US Agent for each foreign facility that has to register.
  5. 5Register the facility through Cosmetics Direct in the SPL format, or on Form FDA 5066.
  6. 6List each marketed product with its ingredients, through Cosmetics Direct or on Form FDA 5067, within the applicable timing.
  7. 7Add the required US contact for adverse-event reporting to the product label.
  8. 8Assemble and hold safety substantiation for every product, and set up adverse-event recordkeeping.
  9. 9Diarise the biennial renewal date and the 60-day window for reporting registration changes.

Renewals and deadlines

Because registrations and listings must be kept current and renewed, MoCRA compliance is continuous rather than a single event. Some background helps here. The statutory compliance date was 29 December 2023, but the FDA delayed enforcement of facility registration and product listing by six months, moving the effective date to 1 July 2024. The US-contact label requirement for adverse-event reporting applied from 29 December 2024.

Facilities must renew registration every two years. Each facility's renewal is due two years from its initial registration date, and every two years after that. The detail brands miss is that a facility's own renewal date falls two years from its own initial registration date, which gives every facility its own recurring date rather than one shared deadline. Separately, a facility must notify the FDA within 60 days of any change to its registration information. A full biennial renewal applies when details have changed; an abbreviated renewal applies when nothing has changed. Missing a renewal can put a facility, and the products that depend on it, out of compliance. We cover the renewal mechanics in MoCRA facility-registration renewals briefing, and ongoing tracking is part of Compliance Care.

What is in force today, and what is still pending

Not everything MoCRA announced is a requirement yet, and conflating the two is a common source of bad compliance advice. In force now: facility registration with biennial renewal, product listing by the Responsible Person, safety substantiation records, serious adverse-event reporting within 15 business days, the US contact on the label, and the FDA's mandatory recall authority. Those are the obligations described throughout this guide.

Still pending, as of our last review: fragrance allergen labelling: MoCRA required the FDA to propose a rule by June 2024, but the proposed rule has been repeatedly delayed and no labelling requirement is in force yet (products still list "fragrance" collectively); cosmetic GMP regulations: the FDA's rulemaking has been pushed back with no finalisation date, so there is no binding federal cosmetic-GMP rule yet, though ISO 22716 remains the de-facto expectation; and talc asbestos testing: the FDA's 2024 proposed rule on standardised test methods was formally withdrawn on 28 November 2025, with the agency stating it intends to reissue a revised proposal. Until it does, there is no mandatory federal test method, and asbestos screening of talc-containing products rests on voluntary testing. Pending rules impose no obligations, but they are worth tracking, because each one will eventually mean label or documentation changes.

Common mistakes that put brands out of compliance

  • Assuming the contract manufacturer "handles all the FDA stuff". Registration and listing are split: the manufacturer registers the facility, but the Responsible Person named on the label has to do the product listing and the adverse-event reporting.
  • Treating the small-business exemption as a full pass. It only removes registration and listing, and one higher-risk product voids it entirely.
  • Skipping safety substantiation because the business is exempt. Every brand has to hold a substantiation record for every product.
  • Confusing the US Agent with the Responsible Person or with the label contact. They are three separate things and a foreign brand can need all three.
  • Using a mailbox or answering service as a US Agent. The agent has to be physically present in the United States.
  • Making drug claims on a label, a product page, or social media, which reclassifies a cosmetic as an unapproved drug.
  • Assuming one shared renewal date, when each facility renews on the anniversary of its own registration.
  • Describing a listed product as "FDA approved", which the FDA does not do for cosmetics.

What marketplaces and states expect

MoCRA is federal, and it sits on top of a state patchwork. The Act explicitly allows states to keep making their own cosmetics rules, so a brand selling nationally can face state-level requirements, California being the most cited example, in addition to the federal layer. On the commercial side, a US contact for adverse-event reporting has to be on the label before a product reaches a shelf or a listing, and retailers increasingly ask brands to evidence their compliance position before onboarding.

What this means in practice

To sell cosmetics in the US under MoCRA a brand needs its facilities registered, a current product listing, a US Agent if its facility is foreign, a US contact on the label, safety substantiation and records, and a way to keep registrations and listings renewed on time. The regime is still new to most brands, and the obligations continue year after year, so many appoint a partner to handle registration, act as US Agent, and track renewals. That is the role CIG plays. For a market-level overview, see selling in the US under MoCRA.

How this whole regime compares with the EU’s pre-market model, and what transfers between the two, is mapped in our US vs EU comparison.

Put this into practice

From reading to selling in the US.

Questions

MoCRA questions brands ask.

MoCRA is the Modernization of Cosmetics Regulation Act. It gave the FDA expanded authority over cosmetics and introduced federal duties for facility registration, product listing, safety substantiation, recordkeeping, and adverse-event reporting. The Responsible Person under MoCRA is the manufacturer, packer, or distributor whose name appears on the product label.

No. There is no FDA fee to register a facility or list a product under section 607 of the Federal Food, Drug, and Cosmetic Act. The cost is in preparing the submissions correctly and, for a foreign facility, in appointing a US Agent. Before you can submit, the facility needs an FDA Establishment Identifier (FEI number).

The statutory date was 29 December 2023, but the FDA delayed enforcement of facility registration and product listing by six months, moving the effective compliance date to 1 July 2024. For a product already on sale as of the deadline, the initial listing was due by the deadline. For a new product, the initial listing is due within 120 days of it being marketed in the US. As of 2026 the initial registration and listing deadlines have already passed, so a brand that has not filed is non-compliant now.

Facilities renew every two years, with each facility's renewal due two years from its own initial registration date. But each facility's specific renewal date is two years from its own initial registration date, so deadlines are staggered through 2026 rather than falling on one shared date. Separately, you must notify the FDA within 60 days of any change to your registration information.

A small business under MoCRA is one whose average gross annual US cosmetic sales over the previous three-year period are under $1,000,000, adjusted for inflation. A qualifying small business is exempt from good manufacturing practice requirements, facility registration, and product listing. Adverse-event reporting, labeling, and safety substantiation still apply to everyone.

The exemption does not apply to products that regularly contact the mucous membrane of the eye, are injected, are intended for internal use, or alter appearance for more than 24 hours where removal is not part of ordinary use. It is all-or-nothing: a single eyeliner, eye cream, or long-wear product in a higher-risk category voids the exemption for the whole business.

Yes. Safety substantiation applies to every product regardless of the exemption. An exempt brand still has to hold, for each product, evidence that the product is safe under normal and expected use. It is required even when registration and listing are not.

Yes to both. A foreign facility that has to register must designate a US Agent who is physically present in the United States; a mailbox or answering service does not qualify. The US Agent is the FDA communication liaison for the foreign facility. The Responsible Person is a different role, defined by whose name is on the label, and it can sit outside the US. A foreign brand can need both, plus a US contact printed on the label for adverse-event reporting.

Yes. The two duties are split. The manufacturer registers the facility, but the Responsible Person named on the label has to submit and maintain the product listing and handle adverse-event reporting. Assuming the manufacturer handles everything is one of the most common ways a brand ends up non-compliant.

No. The FDA does not approve cosmetic products before they go on the market. Listing records what is being sold; it is not an approval. Describing a cosmetic as FDA approved is itself a labeling problem.

No. The US Agent requirement applies to facilities located outside the United States. A domestic facility registers directly without appointing an agent, though it still has the same listing, substantiation, and renewal duties.

The Responsible Person must report a serious adverse event to the FDA within 15 business days, and submit any follow-up information within a further 15 business days. Records of adverse events are kept for six years, or three years for smaller businesses.

Not necessarily. Safety substantiation means holding adequate evidence that the product is safe under normal and expected conditions of use. The right evidence depends on the product and its ingredients, and for many cosmetics it does not require clinical trials. What matters is that the tests and reasoning are appropriate for the product and kept on file.

A cosmetic is intended to cleanse or beautify. A product that claims to treat or cure a condition, or to change the structure or function of the body, is a drug and sits outside MoCRA under stricter rules. Claims like "treats eczema" or "reduces inflammation" can move a product into the drug category and have triggered FDA warning letters, so review therapeutic-sounding claims before you publish them.

Entering the US market?

CIG can register your facilities, act as your US Agent and track your renewals, at a fixed price.

In practice

Compliance, in the real world.

Cosmetics on a US retail shelfMoCRA facility registration screenUS product listing paperwork