MoCRA: what the FDA cosmetics law asks of small makers

What MoCRA requires: the FDA cosmetic regulations in one table

MoCRA is the federal law that added new FDA regulations for cosmetics to the Federal Food, Drug, and Cosmetic Act. It became law on Dec. 29, 2022, and FDA calls it the most significant expansion of FDA's authority to regulate cosmetics since 1938. It sets duties to FDA for cosmetic businesses before and after a product goes on sale.

Most MoCRA duties fall on the responsible person: the manufacturer, packer, or distributor of a cosmetic product whose name appears on the label. If your brand name is on the jar, that is you, even when a contract manufacturer makes the product. Facility registration falls on whoever owns or runs a facility, which MoCRA defines as any establishment, including an importer's, that manufactures or processes cosmetic products distributed in the United States.

There is no fee to register a facility or list a product. FDA also has new powers under MoCRA: FDA can order a mandatory recall if the responsible person refuses to recall voluntarily, FDA can access and copy certain records, including safety records, and FDA can suspend a facility's registration when its products may cause serious harm.

Who the MoCRA small-business exemption covers

MoCRA treats a business as small when it has average US cosmetic sales over the previous 3-year period of less than $1,000,000 a year, adjusted for inflation. The test applies to responsible persons and to owners and operators of facilities. A small business is exempt from GMP, registration and product listing requirements.

The exemption does not apply to anyone who makes or processes certain products, whatever their sales. If even one product in your line falls into these groups, you register the facility and list your products like a large company:

• Eye products: products that regularly come into contact with the mucus membrane of the eye.
• Injected products: products that are injected.
• Internal-use products: products intended for internal use.
• Long-wear products: those intended to alter appearance for more than 24 hours, where removal by the consumer is not part of normal use.

The exemption also stops short of the rules every maker follows. A small business still reports serious adverse events, still keeps adverse event records for 3 years, still keeps safety substantiation records and still puts an adverse event contact on its labels. FDA has a tool to help you decide if you must register a cosmetic product facility, which walks through these questions.

Exempt businesses may still register. FDA welcomes voluntary registration and listing from businesses that are not required to register. FDA does not issue certificates or other documents to verify registration or listing, so there is no FDA document to show a buyer.

FDA cosmetic registration and listing in Cosmetics Direct

Registration covers the place where product is made; listing covers each product. Cosmetics Direct is FDA's electronic tool for cosmetic product facility registration and cosmetic product listing. These are the steps for a maker who is not exempt, or who chooses to register.

1. Get an FEI number

   FDA uses the FDA Establishment Identifier as the facility registration number, and an FEI number is needed before submitting the facility registration. FDA's FEI search portal shows whether a business already has one.

2. Register the facility

   Submit the facility registration in Cosmetics Direct, or on paper using Form FDA 5066 for facility registration and Form FDA 5067 for product listing. A new facility registers within 60 days of first engaging in manufacturing or processing. If a contract manufacturer makes your product, MoCRA requires only a single registration for the facility, which the facility or any responsible person whose products it makes can submit.

3. List each product

   The responsible person lists each product within 120 days of marketing the product in interstate commerce. A listing includes the registration number of each facility that makes the product, the product name as it appears on the label, its category and a list of ingredients, including any fragrances, flavors, or colors. An exempt small facility with no number can give its name and address instead: an exempt small business with no registration number can give the facility name and address on a listing.

4. Keep it current

   Report changes to a registration within 60 days of any changes, and update listings annually. Facilities renew every other year, and renewal dates are based on the initial registration date.

Adverse event reports and records

Under MoCRA, an adverse event is any health-related event associated with the use of a cosmetic product that is adverse. A serious adverse event is one that results in death, a life-threatening experience, inpatient hospitalization or a persistent or significant disability, or significant disfigurement, including serious and persistent rashes, second- or third-degree burns and significant hair loss.

When a customer reports a serious adverse event, the responsible person sends it to FDA within 15 business days, together with a copy of the label on or within the retail packaging. If you learn more later, new information received within 1 year of the first report goes to FDA within 15 business days.

Keep a record of every adverse event report you receive, serious or not, for 6 years. An exempt small business that makes none of the excluded products keeps them for 3 years. One simple way to keep them is a log of the date, customer contact, product, batch and what happened.

Safety substantiation: what to keep on file

Every responsible person must ensure and maintain records supporting adequate safety substantiation. The standard is evidence that experts would accept as enough to support a reasonable certainty that a cosmetic product is safe.

There is no fixed test list: neither the law nor FDA regulations require specific tests for individual products or ingredients, and animal testing is not a requirement. Makers can use relevant safety data that is already available, such as supplier safety data sheets, published ingredient reviews and data on similar formulas. Where that data leaves gaps for a specific formula, a maker may choose to run tests to fill them.

One way to organise this is a file for each product that holds the formula, the source and safety data for each ingredient, any test results such as preservative efficacy or stability, and the reasoning that ties them together. This matters because FDA can access and copy certain records, including safety records.

Label changes under the MoCRA regulations

MoCRA adds one line to every cosmetic label: a domestic address, domestic phone number, or electronic contact information, which may include a website, through which customers can report adverse events. This sits on top of the older label rules, such as the name and place of business of the maker or distributor. FDA notes that a post office box or website address is not adequate for the label address.

MoCRA also adds fragrance allergen labeling: the responsible person must identify on the label each fragrance allergen, as defined by FDA regulation. FDA decides by regulation which substances count, so check FDA's MoCRA page for the current status before you print a large label run.

FDA approval for cosmetics: what registration does not mean

FDA does not approve cosmetics. Under federal law, cosmetic products and ingredients, except color additives, do not need FDA approval before they go on the market. Color additives are the exception: a color additive must be approved by FDA for the intended use.

A registration or listing number is not approval either. FDA describes registration and listing as neither a cosmetic approval program nor a promotional tool, so a label or ad should not call a product FDA registered as if it were a seal of approval.

Claims decide which rules apply. FDA says that a product intended to affect the way the body works, or to treat or prevent disease, is a drug, and drugs must meet different requirements from cosmetics. Example: a face cream sold to moisturize is marketed as a cosmetic, while the same cream sold with a claim to treat a skin disease is marketed as a drug.

What MoCRA does not cover

MoCRA is federal law. FDA's small-business fact sheet says manufacturing cosmetics at home is not against the law, and that FDA does not license cosmetics firms. For a business license, a home-business permit or sales tax, contact your state and local authorities. Requirements vary by state and city.

This page is general information about the federal rules, not legal advice. For a specific product or claim, read FDA's MoCRA pages or ask FDA directly.

Where Nation fits

Questions about MoCRA