Let's Talk About MoCRA and What It Means For Indi/Small Businesses!

MoCRA is the biggest shake-up in U.S. cosmetic law since 1938, and it affects both big beauty houses and tiny indie brands selling via Etsy, Shopify, or wholesale into the U.S.

Below is a practical breakdown in plain “formulator” language: what MoCRA actually requires, how it treats large vs indie brands, and exactly what small brands are exempt from (and what they absolutely are not exempt from).

1. Quick overview: what is MoCRA and who does it apply to?

The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) amended the U.S. Federal Food, Drug, and Cosmetic Act (FD&C Act). It gives FDA much stronger oversight over:

• Facility registration and product listing
• Good Manufacturing Practices (GMP)
• Adverse event reporting
• Safety substantiation
• Labelling (including future fragrance allergen disclosures) (Congress.gov+1)

MoCRA applies to:

• Any business that manufactures or processes finished cosmetic products for distribution in the U.S. (including contract manufacturers) (Pharmadocx Consultants+1)
• Any “responsible person” – usually the manufacturer, packer, or distributor whose name appears on the label, even if they don’t physically manufacture the product (kslaw.com)
• Domestic and international brands – if you market into the U.S. from overseas, you still fall under MoCRA and must appoint a U.S. agent for facility registration. (SGSCorp)

So an Australian, UK, or EU indie brand shipping to U.S. customers is still “in scope”.

2. Key concept: “small business” vs everyone else

MoCRA does not use the word “indie”; instead, it defines “small business” in section 612:

You are a “small business” if:

• Your average gross annual sales in the U.S. of cosmetic products is under USD $1 million over the previous three years, adjusted for inflation, and (Worldover+2Registrar Corp+2)
• You do not manufacture or process any of these higher-risk product types:
• Products that regularly contact the mucous membrane of the eye (e.g. mascara, liquid eyeliner, lash adhesives)
• Products that are injected
• Products for internal use
• Products that alter appearance for more than 24 hours and are not normally removed by the consumer (certain long-wear dyes, tattoo inks, some nail products) (U.S. Food and Drug Administration+1)

If you make those high-risk products, you do not get the small business exemptions, no matter how tiny your revenue is.

Also, the revenue test is rolling. If your 3-year average crosses the threshold in future, you lose the exemption going forward and must come into full MoCRA compliance. (Registrar Corp+1)

In practice:

• Large / established brands (multi-million turnover): almost always non-exempt
• Most indie soap/skincare/body brands under USD $1M and making low-risk products: likely qualify as “small business”

3. Requirements that apply to everyone (including small indie brands)

Even if you qualify as a “small business”, you are not invisible to FDA. MoCRA exemptions are quite narrow.

3.1 Safety substantiation (no one is exempt)

Every cosmetic product marketed in the U.S. must have adequate substantiation of safety for its intended use. This is now written clearly into law (FD&C §608). (Congress.gov+1)

In practice, for any brand size, you should be able to show:

• A toxicological/safety assessment of the formula and its ingredients
• Consideration of exposure, concentration, vulnerable populations, impurities, etc.
• That the product is not adulterated (e.g. contaminated with pathogens, heavy metals, asbestos in talc, etc.)

FDA can request your safety records; if you cannot provide them, the product may be considered misbranded or adulterated.

3.2 Serious adverse event reporting

MoCRA introduces mandatory serious adverse event reporting:

• A “responsible person” must report serious adverse events to FDA within 15 business days of receiving the report.
• You must include any new and material medical information received within one year. (ProPharma Group+1)

Record-keeping:

• Standard requirement: keep records for 6 years
• Small business relief: if you qualify as a small business, you may keep records for 3 years instead of 6. (ProPharma Group+1)

Small brands are not exempt from:

• Taking complaints seriously
• Determining whether an event is “serious” (hospitalisation, disability, major disfigurement, etc.)
• Reporting these to FDA within the legal timeframe

3.3 Labeling changes

MoCRA adds/expands labeling elements for all brands:Congress.gov+1

1. Contact details for adverse events

• Labels must include a U.S. domestic address, phone number, or electronic contact (e.g. website) so consumers can report adverse events.

2. Professional-use labeling

• Products only for professional use (e.g. salon-only peels) must be clearly labeled as such.

3. Fragrance allergens (future)

• MoCRA requires FDA to create a rule identifying fragrance allergens that must be declared on labels, similar to EU practice. FDA was tasked with proposing a rule and then finalising it after public comment. (kslaw.com)
• Indie brands will have to comply once this rule is final, regardless of size.

3.4 Records, inspections, and recalls

MoCRA gives FDA new powers that apply to everyone: (Congress.gov+1)

• Records access: FDA can request certain records relating to your products’ safety and manufacturing.
• Mandatory recall authority: if FDA considers a cosmetic product to be adulterated or misbranded and posing serious risk, they can order a recall if a voluntary recall is not sufficient.
• Inspections: FDA can inspect facilities and records to verify compliance.

Small businesses are not exempt from:

• Having their products recalled if safety concerns arise
• Responding to FDA inquiries or inspections
• Ensuring products are not adulterated or misbranded

4. Extra MoCRA obligations for large / non-exempt brands

If you do not qualify as a small business (or you make the high-risk products), you’re in the full MoCRA bucket.

4.1 Facility registration

Under section 607, every facility that manufactures or processes cosmetic products for U.S. distribution must register with FDA and renew every 2 years. (U.S. Food and Drug Administration+2Pharmadocx Consultants+2)

Key points:

• Existing facilities had to register by the end of 2023; enforcement of registration & listing requirements began 1 July 2024. (Certified Laboratories -)
• New facilities must register within 60 days of starting manufacturing or processing. (Pharmadocx Consultants+1)
• Non-U.S. facilities must appoint a U.S. agent as a point of contact in their registration. (SGSCorp)
• Registration is done via FDA’s “Cosmetics Direct” system (SPL format); no FDA fee currently. (U.S. Food and Drug Administration+1)

Small business exemption: qualifying small businesses are exempt from facility registration unless they make any of the high-risk product types (eye, injected, internal, long-lasting non-removable). (U.S. Food and Drug Administration+2duanemorris.com+2)

4.2 Product listing

MoCRA also requires product listing for each cosmetic marketed in the U.S.: (U.S. Food and Drug Administration+2Federal Register+2)

• A responsible person must submit:
• Brand and product name(s)
• Product category
• Ingredient list
• Facility information (unless exempt)
• Listings must be updated annually to reflect changes (e.g. discontinuation, reformulation).

Again, small businesses are exempt from product listing, provided they meet the revenue and product-type criteria. (Obelis Group+2U.S. Food and Drug Administration+2)

4.3 Good Manufacturing Practices (GMP)

MoCRA requires FDA to issue mandatory cosmetic GMP regulations (section 606): (Frost Brown Todd+1)

• FDA must publish a proposed GMP rule and then finalise it (deadline for final rule by 29 December 2025). (Frost Brown Todd)

• These GMPs will likely align with concepts in ISO 22716 and FDA’s existing cosmetic GMP checklist:
• Defined procedures and batch records
• Proper equipment and facility hygiene
• In-process controls and finished product testing
• Complaint handling and investigation

For non-exempt brands, compliance with these GMP requirements will become mandatory once the final rule is effective.

For small businesses, section 612 states they are not subject to section 606 (GMP) if they qualify as small and do not produce the high-risk products. However, FDA has signalled that simplified GMP concepts may still be recommended even for small entities. (U.S. Food and Drug Administration+2Global Compliance News+2)

5. What indie / small brands must do vs what they’re exempt from

5.1 What indie / small brands are exempt from (if they qualify)

If your indie brand meets the small business definition (under ~$1M average U.S. cosmetic sales over 3 years, adjusted for inflation, and no high-risk products), MoCRA exempts you from: (Worldover+5U.S. Food and Drug Administration+5Worldover+5)

1. Facility registration
2. Product listing
3. Compliance with the upcoming GMP regulations (section 606)
4. Maintaining adverse event records for 6 years – you only need to keep them for 3 years

Note: if you start making eye products, injectables, internal-use products, or long-lasting non-removable products, you lose these exemptions, even if your revenue remains small. (U.S. Food and Drug Administration+2U.S. Food and Drug Administration+2)

5.2 What indie / small brands are not exempt from

Even the tiniest indie brand must still:

• Ensure products are safe and maintain adequate safety substantiation (section 608) (Congress.gov+1)
• Ensure products are not adulterated or misbranded
• Report serious adverse events to FDA within 15 business days and maintain those records (3 years for small businesses, 6 for others) (ProPharma Group+1)

• Comply with labelling requirements, including:
• INCI ingredient declaration
• Net contents
• Name and place of business
• Required contact details for adverse event reporting
• Future fragrance allergen disclosures once FDA finalises the rule (Congress.gov+1)

• Cooperate with FDA inspections, records requests, and recalls, if needed (Congress.gov+1)

So an indie brand cannot say “I’m exempt from MoCRA so I don’t need to worry about FDA.” You still have a legal duty of care for safety, labeling, and serious adverse events.

6. Practical checklists

6.1 If you are an indie / small brand

1. Confirm if you qualify as “small”

• Calculate your average annual U.S. cosmetic sales for the last 3 years.
• Check your product range: avoid high-risk MoCRA product types if you want to keep the exemption.

2. Set up a safety file for each product

• Formula, raw material specs, CoAs, SDS
• Toxicological/safety assessment
• Stability and micro testing data (where relevant)
• Label copy and claims support

3. Build a basic GMP-style system anyway

• Written procedures, batch records
• Ingredient and packaging traceability
• Cleaning, calibration, and complaint handling logs
• This is not legally mandated under MoCRA if you qualify for the small business exemption, but it is strongly recommended and prepares you for growth.

4. Implement adverse event procedures

• Add a clear U.S. contact to your labels (address, phone, or website).
• Create a simple SOP: how complaints are logged, evaluated, and when to report to FDA.
• Keep those records at least 3 years.

5. Consider voluntary facility registration and product listing

Even if exempt, some small brands voluntarily register/list to:

• Show retailers/distributors that they’re serious about compliance
• Smooth future transitions when they grow beyond the small business threshold (Registrar Corp+1)

6.2 If you are a larger / non-exempt brand

Your to-do list is everything above plus:

• Register all manufacturing / processing facilities with FDA and renew every 2 years.
• List all cosmetic products marketed in the U.S. and update annually. (U.S. Food and Drug Administration+2Pharmadocx Consultants+2)
• Prepare for formal cosmetic GMP once FDA publishes the final rule (target by end of 2025). (Frost Brown Todd)
• Maintain adverse event records for 6 years instead of 3. (ProPharma Group+1)

7. Bringing it together

In short:

• MoCRA is not just for big beauty. Any brand touching the U.S. market must think about safety substantiation, serious adverse event reporting, and correct labeling.
• Small indie brands do get meaningful relief, particularly from the administrative load of facility registration, product listing, and upcoming formal GMP rules, but only if they stay under the revenue threshold and out of the high-risk product categories.
• No one is exempt from safety. Whether you’re a kitchen-scale indie making 200 units a month or a global conglomerate, MoCRA expects you to back your products with real safety data and to respond properly if something goes wrong.

Download my free basic checklists today to help you manage your business to comply with MoCRA.