15,300 cosmetic facilities and 1.1 million products on its books. For a private label aftercare brand, MoCRA compliance is no longer optional. If your line is not on that list, U.S. customs can hold your shipment at the border and retailers can drop you from their systems. The name printed on your jar is the name the agency holds accountable.
This piece covers the four duties that decide whether your products clear customs, the label detail most brands miss, and a checklist you can run this quarter.
MoCRA in 2026: What Already Took Effect
MoCRA became law in 2022, but its duties carried phased effective dates. The registration and listing rules went mandatory first. The labeling contact requirement took effect on December 29, 2024. Each date moved a task from "should do" to "must have on file." Brands that treated these as pending items are now out of step with the law.
MoCRA compliance is a live obligation now, not a forecast. Registration is not a one-time checkbox: facilities renew every two years and listings update annually. A brand that registered in 2023 but skipped the 2024 window is not current, even if its old certificate still looks valid.
The Dates You Can No Longer Delay
The biggest misunderstanding is that MoCRA is still coming. It is here. The registration and listing duties are active, and the label contact rule has been enforceable since late 2024. Treat every date in this article as already live.
What Enforcement Looks Like Now
Enforcement has moved past warning letters. The FDA can place imported cosmetic shipments on hold at the border and issue detention without physical examination for products from facilities that are not registered. Adverse event data also feeds the agency's risk picture. FDA Voices noted a roughly threefold rise in cosmetic adverse event reports after the reporting rule took hold.
An officer will not show up at your studio tomorrow. The real cost of being wrong shows up at the port and in your product record, not in a letter.
Is Aftercare a Cosmetic Under MoCRA
This is the question most aftercare founders never ask, and it decides your whole compliance path. The product you sell and the pigment in the needle sit in two different regulatory boxes.
Ink and Aftercare Sit in Two Boxes
The FDA treats tattoo ink as a color additive under its own framework and has signaled it will address ink through a separate framework rather than the cosmetic definition. Aftercare is different. A balm, soap, or lotion you sell to heal or protect tattooed skin is a cosmetic under MoCRA.
The ink in the needle sits outside this rule, but the product you put on the skin after sits squarely inside it. Your ink supplier carries its own obligations. Your aftercare SKU carries MoCRA's.
When a Balm Crosses Into OTC Drugs
A product stays a cosmetic while it only cleans, moisturizes, or protects skin. The moment a label claims it treats, heals, or prevents infection, the FDA can reclassify it as an over-the-counter (OTC) drug. DailyMed shows aftercare-style ointments built on lanolin or petrolatum registered as OTC drugs once the claim crosses that line.
Cosmetic or drug is decided by what the label promises, not by the formula. Our piece on covers the fuller picture.
Four Duties That Gate Market Access
MoCRA compliance rests on four duties. None is optional, and each runs on its own clock.
Facility Registration and Renewal
Every facility that manufactures or packs your product for U.S. sale must register with the FDA through the Cosmetics Direct portal. Registration renews every two years in even-numbered years. Miss the window and your facility drops out of the active list. The agency's count sits above 15,300 registered facilities.
Product Listing Every Year
Each product needs its own listing: identity, label, and the responsible person. The FDA's listed-product count passed 1.1 million. Listings refresh annually, and a reformulation or label change can trigger an update you did not plan for.
Serious Adverse Events in 15 Days
If a serious adverse event ties to your product, report it to the FDA within 15 business days. A serious event means a hospital stay, significant disability, or a life-threatening outcome. The clock starts when you know. Brands without a complaint-intake path are the ones caught flat footed.
Safety Records the FDA Can Ask For
You must hold records showing each product is safe under its intended use. The FDA can request them; you do not file them up front. Keep them for six years. A compliant factory hands you the underlying test data so the responsible person is not scrambling to build a file after the fact.
The Responsible Person Is the Brand
MoCRA compliance puts the duty on the brand, not the factory. The responsible person is the entity whose name appears on the label. For a private label brand, that is usually you, not your contract manufacturer. The factory may pack the balm, but the brand whose name sells it owns the duty to register, list, and report.
The Name on the Label Owns the Duty
Under 21 U.S.C. §364, the responsible person is defined by the name on the label. A founder who assumed the factory "handles compliance" is often surprised to learn the obligation sits with their own company. Your brand name is the legal hook, not a marketing detail.
What Your Manufacturer Must Provide
You cannot meet the duties alone. Your factory should give you its FDA establishment registration, the product's listing support, and the safety substantiation behind the formula. Ask for these before launch, not after a retailer or customs officer asks. A supplier that cannot produce a current registration is a liability you will wear on your label.
For the wording side of the same risk, see our guide to .
The Label Contact Most Brands Miss
The labeling rule that took effect December 29, 2024, requires a domestic contact for U.S. consumers to report adverse events. The address or phone must point to someone who can actually receive a report. The FDA has flagged that the URL must lead to a working adverse-event form, not a homepage. Many brands bolt this on last and point it at a generic inbox nobody monitors.
That single missing detail is one of the easiest ways to be technically non-compliant while believing you are done. It is also the cheapest to fix, which makes skipping it hard to defend.
What a Ready Supply Chain Looks Like
Our own facility is FDA-registered (VCRP Establishment ID 1010147) and packs aftercare products such as YCR020 hand balm under its own registration. We run GMPC and ISO 22716 systems and supply MSDS and COA documents that feed your safety substantiation file. For a private label line, that paperwork is the difference between a clean launch and a scramble. The shows the full list runs longer than most founders expect.
GMP Is Still in Rulemaking
MoCRA compliance does not stop at registration. The GMP rule is still moving through rulemaking, so there is no final GMP text to certify against yet. Until it lands, require your factory to show GMPC or ISO 22716 evidence and a documented process audit. That is the practical stand-in for GMP today, and it signals a supplier that will still be standing when the rule finalizes.
MoCRA-Ready vs Not: A Quick Check
Readiness area Brand that skips it Brand that is MoCRA-ready Facility registration No active FDA registration on file Facility registered, renewal current Product listing SKUs unlisted or stale Each SKU listed, refreshed yearly Label contact Homepage link, dead inbox Working adverse-event form, monitored Adverse events No intake path 15-day report process in place Safety records Test data missing Six-year substantiation on hand Renewal cadence One-time, then forgotten Two-year and one-year reminders set
Your 2026 MoCRA Action List
Confirm your facility registration is active and the latest biennial renewal is on file.
List every SKU you sell, including variants, sizes, and scent options.
Add a domestic contact and a working adverse-event form to every label.
Stand up a complaint intake path that can hit the 15-business-day report window.
Collect safety substantiation from your factory and store it for six years.
Ask your contract manufacturer for current GMP or ISO 22716 evidence.
Set calendar reminders for the two-year registration and annual listing cycles.
Treat these duties as a quarterly calendar item, not a launch-day task. Registrations renew every two years, listings refresh every year, and a 15-business-day clock can start with one bad reaction. Walk the list above, then check the questions below for the edge cases your own catalog raises.
FAQ
What Is MoCRA Compliance?
MoCRA compliance means meeting the FDA's Modernization of Cosmetics Regulation Act duties for U.S. cosmetics. The law added facility registration, product listing, adverse event reporting, safety substantiation, and a label contact rule. For an aftercare brand, it makes the balm or soap you sell a regulated product with a named responsible person. It does not replace drug-claim rules, which follow a separate path.
Who Is the Responsible Person Under MoCRA?
The responsible person is the business whose name appears on the product label, defined under 21 U.S.C. §364. For a private label aftercare brand, that is normally the brand owner, not the contract manufacturer. This entity registers the facility, lists the product, and reports serious adverse events. A founder who assumed the factory handles compliance often finds the obligation sits with their own company.
Do Private Label Brands Need FDA Facility Registration?
Yes. Every facility that manufactures or packs your aftercare products for the U.S. market must register, and your brand must be linked as the responsible person through the listing. Registration runs in the FDA's Cosmetics Direct system and renews every two years. A private label deal does not move this duty off your label. The listing that names your brand is what makes you market-ready.
How Often Do You Renew MoCRA Facility Registration?
Facility registrations renew every two years, in even-numbered years, through the FDA portal. Product listings update annually. Many brands register once and forget, then discover a stale certificate during an import check or retailer audit. Set separate reminders for the two-year registration cycle and the one-year listing cycle so neither lapses. Treat renewal as a recurring calendar item, not a launch-day task.
What Counts as a Serious Adverse Event Under MoCRA?
A serious adverse event means death, a life-threatening outcome, inpatient hospitalization, significant disability, or surgery to prevent harm. If your aftercare product links to such an outcome, the responsible person must report it to the FDA within 15 business days. A mild rash that clears on its own does not qualify, but when in doubt, document the case and consult counsel.
Does MoCRA Apply to Tattoo Aftercare Products?
Yes. Aftercare balms, soaps, and lotions are cosmetics under MoCRA, while tattoo ink follows a different FDA path. The law covers the product you apply after a session, not the pigment in the needle. If your label claims the product treats or heals skin, it may cross into OTC drug territory, which carries its own rules. Most aftercare brands fall fully inside MoCRA's cosmetic duties.
What Happens If You Miss MoCRA Registration?
Skipping registration puts your facility and products outside the FDA's active records, which can trigger import detention and removal from retailer systems that require proof of compliance. The agency can detain shipments without physical examination and issue enforcement actions against non-compliant products. The fix is retroactive catch-up plus renewed cycles, which costs more than staying current from the start.
MoCRA turns paperwork into a gate at the border. If your 2026 plan includes U.S. sales, the cheapest time to close the gaps is before your first shipment, not after a hold.
