The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) gave the FDA its first major expansion of cosmetics authority in more than 80 years. For indie and startup founders, the headline news has been the small business exemption from facility registration and product listing. That exemption is real, but it is also narrow, and it has created a dangerous misconception: that small brands are broadly exempt from MoCRA. They are not.
MoCRA's small business exemption applies to one specific set of obligations. Nearly every other substantive requirement in the statute—safety substantiation, adverse event reporting, labeling, recordkeeping, and FDA's new recall and records-access powers—applies to businesses of every size, including solo founders working out of a kitchen or garage. Below are ten pillars every indie cosmetic brand needs to understand to stay compliant and avoid the kind of exposure that can sink a young company.
1. Know Exactly What the Small Business Exemption Covers
Under MoCRA, a "small business" is generally one with average gross annual U.S. sales of cosmetics under $1,000,000 (adjusted for inflation), calculated over the preceding three years. Qualifying businesses are exempt from facility registration and product listing. That is the entire scope of the exemption.
Importantly, the exemption does not apply if your product falls into one of four statutory carve-out categories, regardless of your revenue:
- Regularly comes into contact with the mucus membrane of the eye under customary conditions of use
- Is injected
- Is intended for internal use
- Is intended to alter appearance for more than 24 hours under customary conditions of use and is not removable by the consumer using water or a water-soluble cosmetic remover
If your product fits any of these categories, you must register and list regardless of size.
2. Safety Substantiation Is Your Non-Delegable Duty
This is the pillar most founders underestimate. MoCRA requires every "responsible person" (typically the manufacturer, packer, or distributor whose name appears on the label) to ensure and maintain records supporting "adequate substantiation of safety" for each cosmetic product. There is no small business exemption for this obligation.
Adequate substantiation generally means tests, studies, research, or other evidence that a qualified expert would consider sufficient to support a determination that the product is safe for its intended use. Relying on a formulator's assurance or an ingredient supplier's general safety data sheet is not enough on its own—you need documentation tailored to your finished product and its labeled use.
3. The 15-Business-Day Adverse Event Reporting Clock
If you receive a report of a serious adverse event associated with your product, MoCRA requires you to notify the FDA within 15 business days of receiving that report. This applies to every responsible person, regardless of company size. Missing this window is a compliance failure independent of whether the underlying product issue is ultimately substantiated.
4. Know What Qualifies as a "Serious Adverse Event"
Founders often assume this only means catastrophic injuries. Under MoCRA, a serious adverse event includes death, a life-threatening experience, inpatient hospitalization, significant disfigurement, a persistent or significant incapacity, a congenital anomaly, or an event requiring medical or surgical intervention to prevent one of those outcomes. Any customer complaint that arguably fits these categories needs to be escalated and evaluated immediately, not filed away as a one-off.
5. Recordkeeping: You Must Be Able to Prove Compliance Years Later
MoCRA requires responsible persons to retain adverse event records for a defined retention period, with a shorter retention period available for qualifying small businesses. The lesson is the same either way: verbal customer service notes and scattered emails are not a recordkeeping system. You need a centralized, dated, and retrievable file for every adverse event report and every safety substantiation document, because FDA can request access to these records.
6. Mandatory Contact Information on Every Label
MoCRA requires that cosmetic product labels include a domestic address, domestic phone number, or electronic contact information where the responsible person can receive adverse event reports. This labeling requirement applies regardless of your registration status and is one of the most commonly overlooked line items when founders design packaging through a graphic designer who isn't tracking regulatory requirements.
7. Fragrance Allergen Disclosure Is Coming—Start Preparing
MoCRA directs the FDA to issue regulations requiring disclosure of fragrance allergens on ingredient labeling, similar in spirit to allergen disclosure frameworks already used in other markets. This rulemaking has not been finalized on the same timeline as other MoCRA provisions, but indie brands should not wait for a final rule to start documenting the allergen content of their fragrance and essential oil blends. Suppliers should be asked now for allergen breakdowns so you aren't scrambling once the rule takes effect.
8. Professional-Use-Only Products Need Distinct Labeling
If you sell any products exclusively to licensed professionals—estheticians, salons, or spas—MoCRA requires that those products be conspicuously labeled for professional use and kept out of direct-to-consumer retail channels without appropriate labeling. Brands that quietly sell "professional" formulations on their retail website without adjusting labeling or usage directions create a labeling violation independent of the product's safety.
9. Good Manufacturing Practices Will Apply to You, Too
MoCRA directs FDA to establish Good Manufacturing Practice (GMP) regulations for cosmetic facilities, with compliance timelines expected to be tiered so that smaller businesses receive additional time to comply relative to larger manufacturers. Even if your facility ultimately qualifies for a delayed compliance date, you should begin building basic GMP habits now: ingredient and batch recordkeeping, sanitation protocols, and documented quality control checks. Retrofitting a GMP program under deadline pressure is far more expensive than building habits early.
10. FDA Can Now Force a Recall and Demand Your Records
Prior to MoCRA, FDA cosmetics recalls were voluntary. MoCRA gives FDA mandatory recall authority when there is a reasonable probability that a cosmetic is adulterated or misbranded in a way that could cause serious adverse health consequences, and the responsible person does not voluntarily recall after being asked. FDA also has authority to request access to safety substantiation and other required records, and responsible persons generally must provide access within a defined timeframe. A brand that cannot quickly produce its substantiation file or adverse event records when FDA calls is in a materially worse position than one that has organized documentation ready to go.
The Bottom Line for Indie Founders
The small business exemption is a genuine benefit, but it covers a narrow slice of MoCRA's requirements. Safety substantiation, adverse event reporting, mandatory labeling, recordkeeping, and FDA's recall and records-access powers apply whether you are selling out of a storage unit or a national retail chain. Founders who treat MoCRA as a registration checkbox are exposing their brand, their inventory, and potentially their personal liability to risks that have nothing to do with whether they filed a facility registration form. Building a compliance file now—safety substantiation, documented ingredient sourcing, a labeling checklist, and an adverse event log—is the single most cost-effective investment an indie brand can make before scaling.