MoCRA Compliance Checklist for U.S. Skincare Brands

The Modernization of Cosmetics Regulation Act of 2022, or MoCRA, expanded federal oversight of cosmetics sold in the United States. Its requirements apply to many skincare products, including imported private-label products, but the obligations do not all sit with the same company.

The brand name on the label can make a brand the responsible person even when a third-party factory develops, fills, tests, or ships the product. The factory may own facility-registration and manufacturing records, while a foreign facility’s U.S. agent performs a narrower communication role. This checklist reflects federal requirements and implementation information available on September 14, 2026. It is operational guidance, not legal advice; classifications, exemptions, claims, and state requirements may need qualified counsel.

Assign the Responsible Person, Facility, and U.S. Agent Roles

Begin with the label and the actual supply chain. The responsible person is the manufacturer, packer, or distributor whose name appears on the cosmetic label. A facility is an establishment that manufactures or processes cosmetics for U.S. distribution. A foreign facility must provide U.S.-agent information in its registration, but that agent is not automatically the product’s responsible person.^[1]

Do not use “manufacturer,” “brand,” “distributor,” “responsible person,” and “U.S. agent” as interchangeable terms. Build a signed responsibility matrix for each SKU and facility. The commercial agreement should also state how quickly the manufacturer must disclose formula, supplier, site, process, label, or safety changes.

Check Whether the Small-Business Exemption Applies

MoCRA defines a small business using average gross annual U.S. sales of cosmetic products for the previous three-year period below the statutory $1,000,000 base amount, adjusted for inflation. Eligible small businesses may be exempt from cosmetic GMP, facility-registration, and product-listing requirements.^[2]

The exemption is not available for businesses or facilities that manufacture or process certain higher-risk categories, including products that regularly contact the eye’s mucous membrane, injected products, products intended for internal use, and products intended to alter appearance for more than 24 hours when consumer removal is not part of customary use.^[1]

Use a written exemption memo rather than a verbal assumption. Record:

• the legal entity relying on the exemption;
• the three-year U.S. cosmetic-sales calculation and current inflation adjustment;
• every product and use condition reviewed;
• whether any excluded category is manufactured or processed;
• which duties remain in force; and
• the date and owner of the next review.

Small-business status does not erase the responsible person’s safety-substantiation, labeling, or adverse-event obligations. It should also be reassessed after acquisitions, rapid sales growth, a new product category, or a manufacturing-site change.

Complete Facility Registration and Product Listing

Facility registration and product listing are separate records with different owners and maintenance triggers. Neither record is an FDA approval, certificate, license, or endorsement. The agency states that it does not issue certificates verifying facility registration or product listing, and the assigned numbers must not be presented as proof that a product is approved.^[3]

Facility registration

Every owner or operator subject to the requirement must register each facility within 60 days after it first begins manufacturing or processing cosmetics for U.S. distribution. Required registration information changes must be submitted within 60 days, and registration must be renewed every two years.^[2]

For cosmetics, the renewal date is calculated from the initial registration date. It is not the October-through-December even-year renewal window used for FDA food-facility registration. A facility initially registered on February 20, 2024, for example, had a February 20, 2026 renewal date under current agency instructions.^[4]

A foreign facility registration includes a U.S. agent. Before launch, confirm the facility’s legal name, physical address, FEI, registration status, renewal date, U.S.-agent details, and whether the site listed is the one actually manufacturing or processing the product.

Cosmetic product listing

The responsible person must submit or ensure submission of a product listing for each covered cosmetic product. A product first marketed after December 29, 2022 is generally expected to be listed within 120 days after marketing, and the listing must be updated annually, including when a product is discontinued.^[2]

The submission includes the responsible person, labeled product name, cosmetic category, ingredient list, and the registration number for each manufacturing or processing facility. Certain products with identical formulations, or formulas differing only in color, fragrance, flavor, or quantity, may be included in one submission when the statutory conditions are met.^[2]

Maintain a listing ledger that connects each market SKU to its formula version, label version, facilities, listing number, initial submission, last annual update, and discontinuation status. Samples and gifts intended for consumers generally still require product listing unless an exemption applies; internal research and product-development samples are treated differently under current guidance.^[2]

Build an Adequate Safety Substantiation File

The responsible person must ensure and maintain records supporting adequate substantiation of safety.^[1] Federal law does not prescribe one universal test package for every cosmetic, so a file should be risk-based and sufficient for the exact formula, packaging, intended users, use area, frequency, directions, warnings, and foreseeable exposure.^[5]

A defensible skincare safety file may include:

• final quantitative formula and formula history;
• raw-material specifications, supplier documentation, impurities, restrictions, and relevant toxicological data;
• finished-product specifications and batch-release criteria;
• stability, microbiological, preservative-efficacy, and packaging-compatibility evidence appropriate to the product;
• exposure and margin-of-safety reasoning where needed;
• support for warnings, directions, sensitive-use areas, and target-user limitations;
• claim-substantiation records; and
• deviations, complaints, investigations, corrective actions, and change-control decisions.

Testing should answer product-specific risks rather than satisfy a decorative certificate list. ZICAIL’s skincare product testing guide explains how stability, microbiological, compatibility, safety, and claim-support work serve different decisions. Buyers can use the manufacturer document guide to define the records requested before approval.

Do not assume that a manufacturer’s standard formula, prior sales, “natural” ingredients, or registration number proves adequate safety for your branded product and intended use. The responsible person should be able to retrieve the supporting record promptly and explain why it covers the marketed formula.

Update Labels and Control Product Claims

Every cosmetic product must carry a domestic address, domestic telephone number, or electronic contact information, which may include a website, through which the responsible person can receive adverse-event reports.^[6] The contact channel should reach a monitored intake process, not an unattended marketing inbox.

MoCRA does not replace the rest of U.S. cosmetic labeling law. Retail cosmetic labels generally still need an accurate statement of identity, net quantity, name and place of business, ingredient declaration, and any necessary directions or warnings. Imported articles also require country-of-origin marking under separate customs law.^[7] Cosmetics intended only for licensed professional use have an additional professional-use statement requirement.^[6]

Run label review against the locked formula and the final selling pack:

• confirm the labeled responsible-person name matches the compliance owner;
• verify the adverse-event contact route works from the United States;
• reconcile every ingredient declaration with the marketed formula;
• confirm required information remains readable after artwork scaling, labels, cartons, overlabels, and translations;
• check warnings, directions, net contents, business address, and country of origin as applicable;
• control website, retailer, social, influencer, and sales-deck claims as well as pack claims; and
• approve new artwork only after regulatory, formula, and listing records agree.

Claims can change a product’s regulatory category. Language that a moisturizer “hydrates” can support cosmetic positioning, while claims to treat acne or another disease may make the product a drug or a drug-cosmetic combination. Use the skincare product claims guide to separate cosmetic appearance claims from therapeutic claims before artwork and advertising are released.

Create an Adverse-Event and Recall Workflow

The responsible person must maintain records for adverse-event reports associated with U.S. use, not only complaints already judged serious.^[8] Serious events include outcomes such as death, a life-threatening experience, inpatient hospitalization, significant disability, infection, significant disfigurement, or medical or surgical intervention needed to prevent such an outcome.^[1]

A serious adverse event must be reported within 15 business days after receipt, with a copy of the label on or within the retail packaging. New and material medical information received within one year after the initial report must also be submitted within 15 business days.^[1] Adverse-event records are generally retained for six years; qualifying small businesses covered by the statutory recordkeeping provision retain them for three years.^[8]

Create one intake and escalation procedure across email, telephone, website forms, retailers, distributors, social media, and the manufacturer. It should define:

• the date of receipt that starts the reporting clock;
• minimum information captured about the reporter, user, product, lot, use, and event;
• medical and regulatory review for seriousness;
• duplicate detection and follow-up requests;
• access to the exact retail label and formula version;
• the authorized reporter and backup;
• record retention and privacy controls;
• escalation to investigation, corrective action, market withdrawal, or recall; and
• rapid cooperation duties for the brand, manufacturer, distributor, and U.S. agent.

Run a tabletop exercise before launch. A written SOP that cannot retrieve the correct lot, label, distribution record, and decision owner within the 15-business-day window is not operationally ready.

Prepare for GMP and Other Pending MoCRA Rules

As of September 14, 2026, do not present all MoCRA-mandated rulemakings as final requirements. Current agency materials still describe cosmetic GMP regulations, fragrance-allergen labeling regulations, and standardized asbestos-testing methods for talc-containing cosmetics as implementation work the agency is required to establish. The December 2024 talc proposal was withdrawn in November 2025, while the statutory mandate remains.^[1]

The absence of a final cosmetic GMP rule does not remove existing duties to market safe, non-adulterated, and properly labeled products. Brands should maintain controlled manufacturing and quality systems now, monitor official rulemaking, and reserve change capacity in supplier contracts and label inventories. The agency’s May 2026 implementation update reported that cosmetic GMP development was still being informed by a listening session rather than announcing a final GMP regulation.^[9]

ZICAIL’s cosmetic GMP and ISO 22716 guide explains how a voluntary quality framework can support supplier evaluation without being described as a substitute for a future binding U.S. rule. For fragrance and talc-containing products, maintain supplier composition data and monitor the Federal Register before formula, label, or testing decisions are locked.

MoCRA Compliance Checklist by Owner and Trigger

Use this matrix as a control register. Replace generic role names with legal entities and named employees or service providers.

The matrix does not transfer legal responsibility by itself. Contracts can allocate work and access, but the statutory role still determines who remains accountable to the agency.

Common Private Label MoCRA Compliance Gaps

• Calling a facility number an FDA certificate: Registration and listing do not mean that the agency approved the factory or product.
• Leaving the responsible person undefined: A manufacturing agreement may describe who submits files without identifying who is named on the label and legally owns the duties.
• Using a manufacturer’s product listing without confirming the brand record: The listed product name, formula, ingredients, facilities, and responsible-person data must match the marketed product.
• Missing the facility-specific renewal date: Cosmetic facilities renew every two years from initial registration, not automatically during the food-registration renewal window.
• Treating safety documents as a generic bundle: A certificate of analysis or stability report alone may not address intended use, cumulative exposure, microbiological risk, packaging, warnings, and formula changes.
• Monitoring only customer-service email: Events reported to retailers, distributors, social channels, or the factory can still start an escalation problem if agreements and intake procedures do not route them promptly.
• Freezing packaging too early: Contact information, professional-use statements, claim changes, and pending rulemaking can create artwork and inventory exposure.
• Assuming a small-business exemption removes MoCRA entirely: The exemption is limited, product-dependent, and does not eliminate core safety, labeling, and adverse-event duties.

Discuss Your U.S. Skincare Project

ZICAIL can discuss private-label skincare formulation, manufacturing, testing documentation, packaging, and quality-control inputs for a U.S.-market project. The brand should still appoint its responsible person, confirm its legal and regulatory pathway, and decide what evidence its compliance file requires.

Prepare your target products, formulas or reference samples, claims, selling channels, responsible-person details, destination market, packaging, and required records before the supplier discussion. Review ZICAIL’s private label skincare service or contact the team with a defined project brief.