MoCRA Cosmetic Facility Registration: What Changed Under the Modernization of Cosmetics Regulation Act

MoCRA cosmetic facility registration is the most significant change to US cosmetics regulation in more than 80 years. The Modernization of Cosmetics Regulation Act, signed into law in December 2022 as part of the Consolidated Appropriations Act, gave the FDA meaningful authority over cosmetic products for the first time since the 1938 Federal Food, Drug, and Cosmetic Act. Before MoCRA, cosmetic facility registration in the United States was voluntary under the Voluntary Cosmetic Registration Program (VCRP). Under MoCRA, it is mandatory — and the consequences of non-compliance are real enforcement actions, not administrative reminders.

What MoCRA cosmetic facility registration actually requires

Every facility that manufactures or processes cosmetic products for distribution in the United States must register with the FDA, regardless of where the facility is physically located. Foreign facilities are subject to the same registration requirement as domestic ones. The registration must include the facility's full legal name and address, a unique facility identifier (Facility ID), the responsible person's contact information, the brand names of products manufactured at the facility, and the product categories produced at the site. Foreign facilities must also designate a US Agent — the requirement mirrors the food facility model under the Bioterrorism Act.

Facility registration is a separate filing from product listing. Under MoCRA, the responsible person — defined as the manufacturer, packer, or distributor whose name appears on the product label — must also list each cosmetic product sold in the US market. The product listing includes the product name as it appears on the label, the product category code, the responsible person's information, the ingredient list, and the manufacturing facility's Facility ID. Registration covers the site; listing covers the product. Both are mandatory, and a facility can be registered without products listed, or products can be listed only after the responsible person's details match a registered facility.

Which products and companies are covered

The definition of a cosmetic under MoCRA follows the FD&C Act definition: any article intended to be rubbed, poured, sprinkled, or sprayed on, introduced into, or otherwise applied to the human body for cleansing, beautifying, promoting attractiveness, or altering the appearance. This covers skincare, makeup, haircare, fragrances, deodorants, nail products, and personal hygiene products that are not classified as drugs. Products making drug claims — such as acne treatments, sunscreens, dandruff shampoos, or antiperspirants — are regulated as drugs under a separate framework, not as cosmetics under MoCRA.

MoCRA includes a small business exemption for facilities with average gross annual US sales of cosmetic products below $1 million over the preceding three years. Small businesses are exempt from facility registration and product listing, but the exemption does not apply to products that come into direct contact with the mucus membranes of the eye under normal or reasonably foreseeable use, products that are injected, products intended for internal use, or products intended to alter appearance for more than 24 hours and are not normally removed by consumers. A small brand selling eye serums or eyelash treatments is not covered by the exemption, even if revenue is below the threshold.

The new adverse event reporting obligation

MoCRA introduced a mandatory adverse event reporting system that did not exist under the old voluntary framework. Responsible persons must maintain records of adverse events associated with the use of their cosmetic products, and must report serious adverse events to the FDA within 15 business days of receipt. A serious adverse event includes death, a life-threatening experience, inpatient hospitalization, persistent or significant disability, congenital anomaly, an infection, or an event requiring medical or surgical intervention to prevent one of the foregoing outcomes. Records of all adverse events — serious or not — must be kept for six years (three years for small businesses).

This represents a fundamental shift in the compliance model. Under the old voluntary framework, the FDA had no systematic insight into product safety issues in the cosmetics market. Under MoCRA, the FDA receives structured reports on serious adverse events and can trace patterns across products, ingredients, and manufacturers. Brands that have never had a formal adverse event tracking system are required to build one — and to have it operational before adverse events occur, not in response to them.

Good Manufacturing Practice and safety substantiation

MoCRA directed the FDA to issue Good Manufacturing Practice (GMP) regulations for cosmetics, with a statutory deadline for a proposed rule and a final rule. The GMP framework is expected to cover facility conditions, equipment controls, process documentation, raw material management, finished product testing, and complaint handling. Foreign facilities that already operate under ISO 22716 will find significant overlap with the expected FDA framework, but ISO 22716 alone is not a safe harbor — the FDA framework will have its own specific requirements once finalized.

MoCRA also requires responsible persons to maintain records demonstrating adequate substantiation of safety for each cosmetic product. 'Adequate substantiation of safety' means tests or studies, research, analyses, or other evidence or information that is sufficient to support a reasonable certainty that a cosmetic product is safe under its labeled use and under reasonably foreseeable conditions of use. This is a documentary requirement, not a pre-market approval — but the records must exist and must be available to the FDA on request. Foreign brands that have relied on general safety assumptions or legacy market history without formal substantiation records face a significant gap.

How MoCRA cosmetic facility registration differs from the EU system

Brands selling into both the US and EU markets often try to map MoCRA requirements onto EU Regulation 1223/2009 and find that the two systems diverge significantly. MoCRA does not require a pre-market safety assessment by a qualified safety assessor — the EU requires a full Cosmetic Product Safety Report signed by a qualified person for every product. MoCRA does not require a Product Information File equivalent. The EU has no facility-level registration at the EU level — it notifies at the product level through CPNP. MoCRA has both facility-level and product-level requirements.

The practical consequence is that MoCRA-compliant documentation is rarely sufficient to satisfy EU CPNP requirements, and EU-compliant PIF documentation rarely contains everything needed for MoCRA adverse event and substantiation records. Brands operating in both markets need parallel compliance files — one for MoCRA, one for CPNP — rather than a single consolidated file. Treating the two as interchangeable is one of the most expensive mistakes a multi-market brand can make.

How FDABridge handles MoCRA cosmetic facility registration

FDABridge manages MoCRA cosmetic facility registration and product listing for foreign cosmetic brands from end to end. Our service includes Facility ID acquisition, US Agent appointment, product listing for each SKU, and ongoing record maintenance as product lines evolve. Visit fdabridge.com/cosmetics to see our MoCRA services or fdabridge.com/apply/cosmetics to begin your filing.