U.S. Cosmetics Regulatory Brief: What MoCRA Requires Now

The most consequential recent FDA development for cosmetics companies is its September 9 warning that it does not issue certificates, verification letters, exemption letters, or any other proof of MoCRA registration or listing. That clarification lands directly on sellers navigating TikTok Shop and other marketplaces that have been requesting "FDA certificates."

The principal near-term compliance work is operational rather than interpretive:

• Track each facility's individual two-year renewal date.
• Complete annual product-listing reviews and updates.
• Maintain a functioning 15-business-day serious-adverse-event workflow.
• Prepare products sold in Washington for the January 1, 2027 prohibition on intentionally added formaldehyde-releasing chemicals.
• Treat FDA's pending GMP, fragrance-allergen, and talc rules as preparation items — not as present federal labeling or manufacturing mandates.

Immediate compliance items

FDA rejects "registration certificates" and verification letters

On September 9, FDA clarified that it does not issue:

• Certificates proving cosmetic-facility registration or product listing
• Letters or emails verifying registration or listing
• Documents confirming that a facility or responsible person qualifies for an exemption

FDA specifically acknowledged that ecommerce platforms — including TikTok Shop — have been requesting such documents. It also emphasized that registration and listing are neither product approval nor permissible promotional credentials.

What to do:

• Remove any reference to an "FDA certificate," "FDA-approved facility," or "FDA-approved cosmetic."
• Preserve Cosmetics Direct acknowledgments, submitted SPL files, facility-registration numbers, listing numbers, submission dates, and portal-status screenshots as business records.
• When a marketplace requests an FDA certificate, provide the FDA clarification, an accurately described submission record, and — if appropriate — a company attestation that does not imply FDA verification.
• Scrutinize third-party consultants selling purported FDA certificates.

Facility-renewal dates are individualized and already arriving

Facility registration must be renewed every two years from the facility's actual initial-registration date, not during one universal renewal season. Cosmetics Direct now displays registration status and renewal date, sends reminders, and permits abbreviated renewal when nothing has changed. More than 14,000 facilities were registered as of February 2026.

Responsible persons must separately review and update product listings annually.

What to do:

• Pull the portal-displayed renewal date for every manufacturing or processing facility.
• Calendar 90-, 60-, and 30-day alerts.
• Confirm whether an abbreviated or changed-information renewal is appropriate.
• Conduct annual SKU-by-SKU reconciliation against current formulas, labels, product status, responsible-person information, and manufacturing facilities.
• Discontinue obsolete listings and relist products returned to market.

Serious-adverse-event reporting is now electronically operational

Responsible persons must report serious cosmetic adverse events within 15 business days, attach the relevant label, and report qualifying additional information received during the following year within another 15 business days. FDA now accepts electronic industry submissions through either database-to-database XML transmission through ESG, or manual entry through the Safety Reporting Portal after account setup. FDA's public AEMS cosmetics dashboard is updated with submitted adverse-event information.

What to do:

• Designate a responsible employee and a backup decision-maker.
• Route complaints from email, social media, customer service, retailers, distributors, and marketplaces into one intake system.
• Create automatic business-day calculations and escalation rules.
• Preserve the marketed label, lot information, photographs, medical information, correspondence, seriousness assessment, submission confirmation, and follow-up history.
• Test the process with a simulated infection, serious burn, persistent rash, or significant hair-loss complaint.

Washington's formaldehyde-releaser deadline is approaching

Beginning January 1, 2027, Washington will prohibit cosmetic products containing intentionally added formaldehyde-releasing chemicals identified under its Toxic-Free Cosmetics Act rule. The rule identifies 25 formaldehyde releasers and applies to manufacturers, distributors, ecommerce sellers, retailers, and cosmetology businesses. In-state retailers receive a limited sell-through period for qualifying preexisting inventory through December 31, 2027.

Washington already restricts intentionally added formaldehyde, methylene glycol, PFAS, specified phthalates, mercury, triclosan, and other listed substances.

What to do before January 1:

• Screen every formula and supplier specification against Washington's 25-chemical list.
• Obtain written supplier confirmation addressing intentionally added substances, not merely the finished-product INCI declaration.
• Reformulate, withdraw Washington distribution, or create defensible state-specific inventory controls.
• Document when existing Washington retail inventory was received; the sell-through protection does not broadly authorize continued post-deadline distribution.

Longer-term regulatory and market shifts

FDA's records-access posture is becoming inspection-oriented

FDA's January 2026 draft guidance states that inspectors may access adverse-event files and, when the serious-health-threat threshold is met, manufacturing records, raw-material receipts, laboratory results, distribution records, customer lists, recall documents, complaints, and safety-substantiation records. The guidance discusses six-year adverse-event retention, reduced to three years for qualifying small businesses.

Even before the guidance is finalized, fragmented records and undocumented safety conclusions present substantially greater enforcement risk than they did a year ago.

Federal GMP regulation remains pending

FDA's current cosmetics materials still point to its existing draft GMP guidance and prior consultation concerning ISO 22716; FDA's cosmetics update page does not show a proposed MoCRA GMP rule.

Companies should not claim that ISO 22716 is presently the final MoCRA regulation. They should nevertheless implement risk-based controls for suppliers, specifications, batches, sanitation, training, deviations, complaints, stability, microbiology, change control, and recalls. Waiting for the proposed rule is commercially unwise and makes later remediation more expensive.

Fragrance-allergen rulemaking has slipped

The federal Unified Agenda had projected a proposed fragrance-allergen rule for May 2026, but no proposal appears in FDA's current cosmetics rulemaking updates. The statutory target was June 29, 2024. There is not yet a final federal list or an operative federal MoCRA fragrance-allergen disclosure regime.

Brands should nonetheless collect quantitative fragrance-allergen data now, because reformulation, artwork revision, supplier coordination, and inventory depletion take far longer than editing an ingredient field.

PFAS regulation is splitting between federal uncertainty and state prohibition

FDA found 51 PFAS used in 1,744 listed cosmetic formulations. Its review of the 25 most frequently used PFAS found major toxicological-data gaps; five appeared to present low concern under intended use, while one presented a potential concern subject to substantial uncertainty. FDA did not reach a class-wide federal safety determination.

States such as Washington already prohibit intentionally added PFAS in cosmetics. Federal compliance alone is increasingly insufficient — what matters commercially is a jurisdiction-sensitive formula assessment showing where a single national SKU can and cannot be sold.

Talc-testing rule remains unresolved

FDA withdrew its proposed standardized asbestos-testing rule in November 2025 after comments raised scientific, definitional, statutory-authority, and implementation concerns. FDA stated that it would issue another proposal to meet MoCRA's mandate. Talc users should continue documented supplier qualification and defensible testing rather than treating the withdrawal as a substantive finding that testing is unnecessary.

Enforcement and recall check

We did not identify a consequential new cosmetics-specific FDA recall, warning letter, or mandatory-recall action in the current FDA cosmetics updates following the September 9 registration-document clarification.

Prioritized watchlist

1. Facility renewals. Identify all registrations reaching their two-year anniversary during the next 120 days.
2. Washington's January 1 deadline. Complete formaldehyde-releaser screening and disposition plans.
3. FDA fragrance-allergen proposal. Expect substantial label-data and supplier-disclosure consequences when it appears.
4. FDA GMP proposal. Watch scope, small-business provisions, record requirements, contract-manufacturer allocation, and compliance periods.
5. Talc/asbestos replacement proposal. Watch the definition of asbestos, required analytical methods, sampling, records, and application to cosmetic-drug products.
6. AEMS signals. Monitor product- and ingredient-level complaint patterns, because adverse-event data are now far more visible to regulators, competitors, plaintiffs, retailers, and consumers.
7. Misleading FDA claims. Audit marketplace listings and consultant-created "certificates" before FDA converts its clarification into enforcement.