MoCRA in 2026: where indie cosmetics brands actually get caught

The story most indie cosmetics brands have heard about MoCRA is wrong by January 2026. The talc-asbestos testing rule that was the headline panic of late 2024 was formally withdrawn on November 28, 2025. The fragrance allergen labeling rule, originally due June 29, 2024, has slipped to a proposed-rule target of May 2026 with finalization not expected before 2027. A lab director reading the trade press in early 2026 might reasonably conclude that MoCRA enforcement is on hold.

It is not on hold. The provisions that are already in force — facility registration, product listing, responsible person identification, adverse event reporting, safety substantiation, and records — are exactly where FDA inspections are landing. As of January 6, 2026 the public registry shows 14,299 active facility registrations and 992,907 active product listings. That is the population FDA is auditing against. This piece is about the seven enforcement points that actually matter right now, with the gaps we see most often when we audit indie brands preparing for an FDA visit.

1. Facility registration: the biennial trap

Manufacturing and processing facilities had until July 1, 2024 to register with FDA under MoCRA. Most brands that contract a CMO assume the CMO handled it. Most CMOs did, for their own facility. The trap is the biennial renewal cycle.

Registrations expire and must be renewed every two years. Brands that registered their own facility in mid-2024 are due for renewal in mid-2026. The renewal window is December 1 of the renewal year through the end of February of the following year — a three-month window. Miss it and the registration lapses; products sold from a lapsed facility are technically misbranded for the period of the lapse.

Brands that rely on a CMO inherit the CMO's renewal cadence. If the CMO lets it slip, every brand on that line lapses simultaneously. We have seen this happen at one mid-sized contract manufacturer where a registration coordinator left and the renewal calendar was not handed off. Forty-two brands found out three weeks before a planned launch.

The check is straightforward: confirm in writing which facility manufactures each SKU, confirm that facility's registration number, and confirm the renewal date. Put the renewal date on a calendar with a 60-day reminder. If you do not have it in writing today, you do not have it.

2. Product listings: drift after launch

Product listings are the second pillar of MoCRA registration, and they drift faster than any other piece of the compliance file. Listings include the product name, brand, ingredients in descending order, image of the labeling, and the responsible person. They must reflect the product as currently sold.

The drift sources are predictable: a reformulation that updates an ingredient but not the listing; a fragrance house change that swaps one parfum for another with a different allergen profile; a label revision for a marketing claim that does not get re-uploaded; a flanker SKU launched without its own listing.

The MoCRA registry does not auto-detect this. FDA finds it on inspection by comparing the listing in their system to the product on the shelf. Reformulating or relabeling without updating the listing within 60 days creates a misalignment that is straightforwardly enforceable.

The control is procedural. Reformulation triggers and label-change triggers should each route through a single compliance review before going to print. If your reformulation workflow does not have a regulatory checkpoint, you will have drift. We have audited brands with sixty active SKUs and listings that match for fewer than half.

3. Responsible Person on packaging

Since December 29, 2024, every cosmetic product distributed in the US has been required to carry the name and US contact information of the responsible person on the label. This is a labeling requirement, not a registration requirement, and it is verifiable by anyone who picks up the product.

Three patterns get caught on this:

• EU brands expanding to US with EU-style labels that list a UK or French responsible person address but no US point of contact. The label is non-compliant the moment it crosses the border.
• Brands using a CMO's name as the responsible person when the CMO has not formally agreed to that role. The responsible person is a regulatory function with adverse-event-reporting and recordkeeping obligations. If the CMO is not aware they hold that role, they will not perform it, and the brand inherits the gap.
• Old SOH inventory on shelf with pre-MoCRA labels. There is no general grandfathering. Product distributed after December 29, 2024 with a missing or inadequate responsible person designation is misbranded.

The fix is mechanical: pick the responsible person, get a signed agreement that defines the role (especially if they are a contracted CMO or a parent entity), update labels at the next print run, and inventory remaining stock against a stop-distribute date.

4. Serious adverse event reporting: 15 business days

Responsible persons must report any serious adverse event associated with a cosmetic product to FDA within 15 business days of receiving information. They must maintain records of all adverse events — serious and non-serious — for six years (three years for small businesses).

"Serious" under MoCRA mirrors the medical-device definition: death, life-threatening event, hospitalization, persistent or significant disability, congenital anomaly, or any event requiring medical or surgical intervention to prevent the foregoing. Non-serious events include rashes, mild irritation, and unsubstantiated complaints — these are kept on file but not reported.

Two things go wrong here in practice. First, the intake channel: customer service teams treat complaints as quality issues and never escalate them to the regulatory function within the 15-day window. Second, the record itself: even non-serious complaints have to be recorded with enough detail to reconstruct what happened, what the consumer experienced, the lot involved, and the response. A spreadsheet without the lot number does not survive an audit.

5. Safety substantiation

MoCRA requires that responsible persons ensure adequate substantiation of safety for each cosmetic product before it is marketed. "Adequate" is defined as tests, studies, research, analyses, or other evidence sufficient to demonstrate that the product, as labeled and as customarily used, is not injurious to health.

FDA has not published a prescriptive list. The expected substantiation file typically includes:

• Ingredient-level toxicology assessments (literature review, supplier data, CIR conclusions where applicable)
• A formula-level safety assessment by a qualified safety assessor
• Stability testing demonstrating product integrity over its claimed shelf life
• Compatibility testing for packaging interactions where relevant
• Microbiological challenge testing for water-containing products
• Use-condition assessment (rinse-off vs leave-on, exposure surface, frequency)

The gaps we see most often are stability and microbiology. Brands launch with two-month accelerated stability and call it three years. They skip preservative challenge testing because the formula passed in a similar product. Both shortcuts work until they don't — and the failure mode is a recall, not a slap on the wrist.

For brands operating multiple SKUs, the substantiation file rapidly becomes a document-management problem rather than a science problem. A LIMS specialized for cosmetics — like our cosmetics module — pins each safety assessment to the formula version it covers, so a reformulation triggers a substantiation review rather than silently invalidating the existing file.

6. Records: the six-year tail

Records under MoCRA — adverse events, safety substantiation, manufacturing batch records — must be kept for six years (three years for businesses meeting the small-business definition). They must be available to FDA on request, typically within a few business days of an inspection.

The retention period is not the hard part. The hard part is integrity: ensuring records are not silently overwritten as systems change, that batch records survive a CMO transition, that adverse event logs migrate when customer-service software is replaced.

We have seen records lost in three predictable ways:

• CMO change without explicit transfer of historical batch records — the new CMO does not have them, the old CMO archived them somewhere unreachable.
• Customer service platform migration where the export only included open tickets, not closed ones, and three years of adverse event intake disappeared.
• Spreadsheet-based safety files stored on a single founder's laptop, lost when the laptop was replaced.

These are not edge cases. They are the median experience of indie brands at the three-year mark.

7. Small business exemption: read the definition carefully

MoCRA exempts "small businesses" — defined as those with average gross annual sales of cosmetic products in the United States of less than $1,000,000 over the past three years — from facility registration and product listing requirements. The exemption does not cover adverse event reporting, safety substantiation, responsible person labeling, or records.

Two traps in the definition. First, the threshold is on cosmetics revenue specifically — a brand with $700K cosmetics and $500K supplements is still under for cosmetics-only purposes. Second, certain product categories are excluded from the exemption regardless of revenue: products that come into contact with the eye's mucous membrane, internal use products, products that alter appearance for more than 24 hours, products injected into the body, and products intended for routine use over an extended period.

For most prestige and treatment categories — eye products, long-wear color, leave-on treatments — the exemption does not apply at any revenue level.

What FDA enforcement is actually doing

FDA's enforcement posture in early 2026 is best read from the warning letters and import refusals, both of which are public. Warning letters in the cosmetics category in 2025-2026 cluster around drug-claim violations (products marketed with structure-function claims that push them across the cosmetic-drug line), CGMP violations at facilities also producing OTC drugs, and adulteration findings on import.

What is not yet showing up at scale: facility-registration enforcement actions and adverse-event-reporting actions. That does not mean they will not. FDA has historically given new programs an enforcement runway of 18-24 months from the compliance date, and MoCRA registration hit its first compliance date in July 2024. The runway closes in mid-2026.

What to do this quarter

The compliance posture that survives 2026-2027 enforcement looks like this:

1. Verify facility registration in writing, with renewal dates on a calendar.
2. Reconcile every active SKU against its product listing — name, ingredients, image, responsible person.
3. Confirm the responsible person on every label distributed after December 2024 includes a US contact.
4. Audit the adverse-event intake channel. Test it with a fake complaint to verify the routing actually reaches the regulatory function.
5. Inventory the safety substantiation file — one folder per SKU, with formula version pinned to safety assessment version.
6. Confirm the six-year records retention plan, including what happens at CMO transition or customer-service-platform migration.
7. Walk the small-business exemption logic if you are claiming it. Document the reasoning. FDA will ask.

The brands that are calm about MoCRA in 2026 are the ones that did the boring registration and listing work in 2024, treat adverse event intake as a regulatory function rather than a customer-service function, and have a single document-management spine that survives staff turnover. The ones that are panicking are the ones still hoping that "the rule got pulled" means the regime is paused. It does not. The talc rule got pulled. MoCRA itself is fully in force.