1. MoCRA: The Biggest US Cosmetic Law Change Since 1938
On December 29, 2022, President Biden signed the Modernization of Cosmetics Regulation Act (MoCRA) into law as part of the FY2023 omnibus appropriations bill. This was not a minor amendment — it was the most significant overhaul of US federal cosmetics regulation since the Federal Food, Drug, and Cosmetic Act (FD&C Act) was enacted in 1938. For 84 years, cosmetics were the least-regulated category under FDA jurisdiction. Manufacturers were not required to register their facilities, list their products, report adverse events, follow mandatory GMP standards, or grant the FDA mandatory recall authority. MoCRA changed all of that.
For lash brands importing from China, Vietnam, Korea, or elsewhere into the US, MoCRA fundamentally shifts the compliance landscape. You can no longer simply order from a factory, slap your brand name on the tray, and ship it to an Amazon FBA warehouse — not without understanding and fulfilling a new set of federal obligations. The law applies to all cosmetic products, and false eyelashes, lash adhesives, lash serums, and related eye-area cosmetics fall squarely within its scope.
| Area | Pre-MoCRA (Before 2023) | Post-MoCRA (2024 Onward) |
|---|---|---|
| Facility Registration | Voluntary (VCRP program) | Mandatory — every facility must register with FDA and renew biennially |
| Product Listing | Voluntary (VCRP program) | Mandatory — each cosmetic product SKU must be listed with ingredients |
| Adverse Event Reporting | No federal requirement | Mandatory — serious events within 15 days; records retained 6 years |
| GMP Standards | No enforceable federal GMP for cosmetics | FDA must establish mandatory GMP regulations (final rule expected 2025-2026) |
| Recall Authority | FDA could only request voluntary recalls | FDA has mandatory recall authority if product is adulterated or misbranded |
| Safety Substantiation | Not explicitly required | Manufacturers and brand owners must maintain records showing "adequate substantiation of safety" |
| Fragrance Allergen Disclosure | Not required | FDA must issue a rule identifying fragrance allergens requiring label disclosure |
| PFAS in Cosmetics | No specific requirement | FDA must assess PFAS use in cosmetics and report to Congress |
MoCRA does not mean the FDA will suddenly be knocking on every Bangkok warehouse door. But it does mean that US Customs and Border Protection (CBP), working with FDA, now has a legal framework to detain non-compliant cosmetic shipments at the port of entry. It also means that in the event of a consumer injury or a competitor complaint, you as the brand owner need documented proof that you met your MoCRA obligations. Operating without that proof is a legal and commercial risk no serious lash brand should accept.
2. Facility Registration: Every Factory Must Register with FDA
Under MoCRA Section 607, every facility that manufactures or processes cosmetic products for distribution in the United States must register with the FDA. This applies to both domestic US facilities and foreign facilities exporting into the US. For a lash brand working with a factory in Qingdao, Guangzhou, or Ho Chi Minh City, the factory must be FDA-registered — and the obligation renews every two years during the October 1 to December 31 biennial registration window.
What Must Be Submitted for Facility Registration
- Facility name, physical address, and contact information — the factory's legal entity name and the actual production address (not a sales office or trading company address).
- US Agent designation — every foreign facility must designate a US Agent who resides or maintains a place of business in the United States and is physically present in the US. This US Agent serves as the communication channel between FDA and the foreign facility. The US Agent's name, address, phone, and email must be provided. This is not optional and cannot be a PO box.
- Brand names of cosmetic products manufactured or processed at the facility — this is a significant change from the old VCRP, where only the manufacturer's own brand was listed. Under MoCRA, the factory must list every brand name under which its products are sold, including private-label brands.
- Product categories — the facility must identify which categories of cosmetic products it manufactures. For a lash factory, the applicable category is typically "eye-area cosmetics" or the specific subcategories FDA establishes in its electronic submission portal (Cosmetics Direct).
- Responsible Person contact — the name and contact information of the Responsible Person for each cosmetic product manufactured at the facility. The Responsible Person is defined as the manufacturer, packer, or distributor whose name appears on the product label.
Failure to register carries consequences. The FDA can deem non-registered cosmetic products "misbranded" under the FD&C Act. Misbranded products are subject to detention at the port of entry by CBP, refusal of admission, and potentially mandatory recall. Beyond the regulatory risk, many US-based wholesale buyers, retail chains, and online platforms now require proof of FDA facility registration as part of their vendor qualification process. Without it, you simply cannot do business with the largest US beauty retailers.
3. Product Listing: Each Lash SKU Must Be Listed
Under MoCRA Section 607(c), the Responsible Person for each cosmetic product must submit a product listing to the FDA. A product listing is required for each individual cosmetic product — meaning each unique SKU, style, variant, or formulation. For a lash brand that offers 30 styles in 3 lengths each, that is 90 product listings. This is not a trivial undertaking, and it is the brand owner (the Responsible Person whose name is on the label), not the factory, who bears the legal obligation to submit product listings.
What Information Must a Product Listing Contain
- The facility registration number of each facility where the cosmetic product is manufactured or processed.
- The Responsible Person's name and contact information — typically the brand owner or the US-based distributor whose name appears on the product label.
- The cosmetic product's name as it appears on the label, including the brand name and product name.
- The product category or categories — FDA has established a standardized list of cosmetic product categories in its electronic listing system.
- A list of ingredients — including fragrances, flavors, and colors, with each ingredient identified by its INCI (International Nomenclature of Cosmetic Ingredients) name or other recognized name. Ingredients must be listed in descending order of predominance.
- The product listing number assigned by FDA upon initial listing, which must be included in any subsequent updates or renewals.
| Scenario | Who Is the Responsible Person | Who Submits the Listing |
|---|---|---|
| Brand owner (US-based) importing from China under own label | Brand owner (name on label) | Brand owner — with ingredient data from the factory |
| Factory selling direct to US consumer under factory's own brand | Factory (or its US subsidiary/distributor) | Factory or its designated US Agent |
| US distributor white-labeling factory products | US distributor (name on label) | US distributor — with factory providing ingredient and facility data |
| Amazon FBA seller reselling generic private-label lashes | Seller (name on label) | Seller — bears full compliance responsibility |
| Contract manufacturer producing for multiple brands | Each brand whose name is on label | Each brand independently; factory provides shared ingredient and facility data |
A critical practical point: the factory must provide the brand owner with accurate, complete ingredient information — including the exact INCI names, percentage ranges, and the function of each ingredient — in order for the brand owner to complete the product listing. If your factory cannot or will not provide this information, you cannot complete a compliant product listing. This is why working with a GMP-certified factory with experience in international compliance matters. At Aurevia Lashes, we provide every OEM and private-label client with a complete ingredient disclosure document formatted for direct entry into the FDA Cosmetics Direct portal.
4. Adverse Event Reporting: What to Do When a Customer Complains
MoCRA Section 605 imposes mandatory adverse event reporting requirements on cosmetic companies for the first time in US history. An "adverse event" is defined as any health-related event associated with the use of a cosmetic product. This includes allergic reactions, skin irritation, eye redness or swelling, infections, chemical burns, or any other adverse health outcome reported by a consumer or healthcare professional.
Serious vs. Non-Serious Adverse Events
MoCRA distinguishes between two categories of adverse events, and the reporting obligations differ significantly:
- Serious adverse event: An adverse event that results in death, a life-threatening experience, inpatient hospitalization, a persistent or significant disability or incapacity, a congenital anomaly or birth defect, an infection, or significant disfigurement (including serious rashes, burns, or eye injuries). The Responsible Person must submit a serious adverse event report to the FDA within 15 business days of receiving the report. If new medical information is received within one year of the initial report, a follow-up report must be submitted within 15 business days of receiving that new information.
- Non-serious adverse event: An adverse event that does not meet the "serious" criteria — such as mild skin irritation that resolves within a few hours, slight redness, or temporary discomfort. Non-serious adverse events do not require individual reporting to the FDA, but records of all adverse events (both serious and non-serious) must be maintained by the Responsible Person for 6 years (3 years for small businesses as defined by the SBA).
For a lash brand selling 10,000 units per month, statistically, you will receive some number of adverse reaction reports — even with perfectly manufactured products, because individual sensitivities vary. A customer using a new lash adhesive for the first time may experience an allergic reaction to cyanoacrylate, the primary bonding agent in most lash glues. That is an adverse event. If the reaction involves significant eyelid swelling that requires a doctor visit, it is likely a serious adverse event and must be reported to FDA within 15 business days. The key is having the systems in place to capture, categorize, and report these events before you need them — because once a serious adverse event occurs, you do not have time to build the system from scratch.
5. GMP (Good Manufacturing Practice): FDA's New Quality Standard
MoCRA Section 606 directs the FDA to establish mandatory Good Manufacturing Practice (GMP) regulations for cosmetic products. This is a departure from the previous framework, where cosmetic GMP was addressed through voluntary guidance documents (such as the FDA's 1997 "Cosmetic Good Manufacturing Guidelines" and ISO 22716). Under the new mandatory GMP regime, failure to comply with FDA GMP will render a cosmetic product "adulterated" under the FD&C Act — with all the legal and commercial consequences that entails.
What FDA GMP Will Require (Based on FDA's Proposed Rule)
While the final rule is expected in 2025-2026, the FDA published its proposed rule in January 2025, and it largely aligns with ISO 22716 — with several additions specific to US regulatory priorities. The key requirements include:
- Buildings and facilities: Adequate size, design, and construction to allow proper cleaning, sanitation, and organized material flow. Specific requirements for ventilation, air filtration, lighting, washing facilities, and segregation of raw materials from finished products. For lash factories, this means temperature and humidity-controlled production rooms, HEPA-filtered air in critical areas, and separate storage areas for fibers, adhesives, and finished trays.
- Equipment: Equipment must be of appropriate design, adequately maintained, and calibrated. Surfaces that contact cosmetic products must be non-reactive, non-absorptive, and cleanable. Equipment cleaning and sanitizing procedures must be documented.
- Personnel: Workers must wear appropriate protective clothing (hairnets, masks, gloves, clean uniforms). Personnel with communicable diseases or open lesions must be excluded from production areas. Training in GMP principles, hygiene, and job-specific procedures must be documented and renewed periodically.
- Raw materials and components: Incoming materials must be inspected, tested (or verified via supplier Certificate of Analysis), quarantined until approved, and stored to prevent contamination or degradation. Each raw material must have a defined specification and a documented acceptance/rejection procedure.
- Production and in-process controls: Written master manufacturing instructions and batch production records. In-process quality checks at defined critical control points. Line clearance procedures to prevent product mix-ups. For OEM/ODM lash production, this is especially critical — when 30+ private-label brands are being produced simultaneously, documented line clearance is the only reliable defense against cross-labeling.
- Laboratory controls: Finished product testing against specifications (microbiological, physical, performance). Stability testing to establish shelf life. Retention samples from each production batch held for the shelf life of the product plus one year.
- Documentation and records: All GMP-related documents — standard operating procedures, batch records, test results, training logs, equipment calibration records — must be retained, controlled, and accessible for FDA inspection. Electronic records are acceptable if they meet data integrity standards.
| GMP Element | ISO 22716 (Existing) | FDA Proposed GMP (MoCRA) | Key Difference |
|---|---|---|---|
| Scope | Cosmetics — voluntary unless required by national regulation | Cosmetics — mandatory for all products sold in the US | ISO 22716 is voluntary unless adopted by regulation; MoCRA GMP is federal law |
| Enforcement | Certification body audit; no government enforcement authority | FDA can inspect, issue 483 observations, warning letters, and initiate enforcement actions | FDA has legal enforcement authority — government, not private certifier |
| Safety Substantiation | Not an explicit element of ISO 22716 (covered under separate regulatory framework) | Explicit requirement — records demonstrating "adequate substantiation of safety" must be maintained | FDA adds explicit safety substantiation documentation requirement |
| Documentation Period | Defined by manufacturer but typically 3-5 years | Minimum 3 years from date of manufacture; retention samples for shelf life + 1 year | FDA specifies minimum retention periods |
| Audit Frequency | Annual surveillance by certifier; recertification every 3 years | FDA conducts risk-based inspections; frequency not specified in statute | FDA frequency is risk-based and not predictable; could be every 2-5 years or triggered by complaints |
In practice, a lash factory that is already fully compliant with ISO 22716 will be well-positioned for FDA GMP compliance under MoCRA. The two standards are highly aligned, with FDA's version adding explicit US-specific requirements around safety substantiation and record retention. The biggest operational difference is the enforcement mechanism — ISO 22716 is enforced by your chosen certifier (who has a commercial relationship with you), while FDA GMP is enforced by a federal agency with the power to detain your shipments, issue warning letters, and initiate mandatory recalls. The stakes are fundamentally different.
6. Mandatory Recall Authority: FDA Can Now Force Recalls
Before MoCRA, the FDA could only request that a cosmetic company voluntarily recall a product. If the company refused, the FDA's primary recourse was to issue a public warning and pursue a court-ordered seizure — a slow, resource-intensive process. MoCRA Section 611 grants the FDA mandatory recall authority for the first time in cosmetics regulation. If the FDA determines there is a reasonable probability that a cosmetic product is adulterated or misbranded, and that exposure to the product will cause serious adverse health consequences or death, the FDA can order a mandatory recall.
What Triggers a Recall and Who Is Responsible
A mandatory recall could be triggered by: (a) microbiological contamination discovered through FDA testing (e.g., Pseudomonas aeruginosa or Staphylococcus aureus detected in lash adhesive or lash trays), (b) chemical contamination (e.g., excessive heavy metals in lash pigments, undeclared allergens, prohibited substances), (c) labeling violations that pose a health risk (e.g., failure to declare a known allergen in the ingredient list, resulting in consumer allergic reactions), or (d) a cluster of serious adverse event reports indicating a systemic quality failure.
The financial implications of a mandatory recall for a lash brand can be catastrophic. You are responsible for: public notification (FDA press release), consumer communication (email, social media, point-of-sale notices), product retrieval from retail shelves and distribution centers, disposal of recalled product, and potentially consumer refunds and liability claims. A mandatory recall involving 50,000 lash trays distributed across 2,000 US retail locations could easily cost $200,000 to $500,000 — not including reputational damage and lost future sales. No insurance policy fully covers the commercial impact.
Critically, the recall responsibility falls on the Responsible Person (the brand owner whose name is on the label), not the factory in China. If your factory's quality failure triggers an FDA mandatory recall, you — the brand owner — bear the cost and execution burden. Your recourse against the factory is through your commercial contract and purchase agreement, not through FDA enforcement channels. This reality underscores why the quality assurance provisions in your factory contract — including third-party inspection rights, liability for quality failures, and recall cost responsibility — are among the most important commercial terms you will negotiate.
7. MoCRA vs EU 1223/2009 vs ISO 22716: Global Compliance Comparison
For lash brands operating in multiple markets, understanding how MoCRA compares to other major regulatory frameworks is essential. Each framework has different requirements, and compliance with one does not automatically mean compliance with another — though significant overlap exists.
| Requirement | MoCRA (USA) | EU 1223/2009 (Europe) | ISO 22716 (International GMP) |
|---|---|---|---|
| Facility Registration | Mandatory — all facilities, biennial renewal | Not a centralized EU requirement; national registration in some member states | Not addressed (quality standard, not regulatory) |
| Product Notification / Listing | Mandatory — each SKU with ingredient list | Mandatory — CPNP notification before market placement, per product | Not addressed (product notification is regulatory, not GMP) |
| Safety Assessor | Not explicitly required; "adequate substantiation of safety" can be internal | Mandatory — CPSR must be signed by qualified safety assessor (specific qualifications defined) | Not addressed |
| Responsible Person | Responsible Person = name on label; no requirement to be US-based | Responsible Person = must be established in the EU (legal entity in an EU member state) | Not addressed |
| Adverse Event Reporting | Mandatory — 15 business days for serious events | Mandatory — Undesirable Effects (UE) reporting; Serious Undesirable Effects (SUE) within 20 calendar days | Not addressed; covered by national regulations |
| GMP Requirement | Mandatory — FDA to establish enforceable GMP | Mandatory — compliance with Article 8 GMP; ISO 22716 is the harmonized standard | Voluntary (unless adopted by national regulation) |
| Mandatory Recall | Yes — FDA has mandatory recall authority | Yes — national competent authorities can order withdrawal/recall | Not addressed |
| Animal Testing | Not banned at federal level (state-level bans exist in California, Nevada, Illinois, etc.) | Banned — no animal testing of finished cosmetic products or ingredients for cosmetics within the EU | Not addressed |
| Ingredient Restrictions | Few specific restrictions; general prohibition on adulterated/misbranded products | Annexes II-VI — comprehensive lists of prohibited, restricted, and permitted substances | Not addressed (handled by national cosmetic regulations) |
| Labeling: INCI Names | Required — ingredient declaration under 21 CFR 701.3 | Required — INCI nomenclature under Article 19; must be in a language understood by consumers | Not addressed (labeling is regulatory, not GMP) |
The practical takeaway for lash brands: if you are compliant with EU 1223/2009, you are well-prepared for MoCRA — but you still need to separately complete the FDA-required facility registration and product listing in the FDA Cosmetics Direct portal, as EU CPNP notification does not substitute for FDA listing. If you are only compliant with MoCRA, you have significant additional work to do for the EU market (CPSR by a qualified EU safety assessor, EU-based Responsible Person, CPNP notification). ISO 22716 GMP certification serves as an excellent operational foundation for both frameworks but does not, by itself, fulfill any regulatory notification or registration requirement.
8. Compliance Timeline & Penalties
MoCRA implementation is phased, with different provisions taking effect on different dates. Some deadlines have already passed; others are approaching. Here is the complete timeline and the penalties for non-compliance.
| Provision | Statutory Deadline | Status as of July 2026 | Penalty for Non-Compliance |
|---|---|---|---|
| Facility Registration (existing facilities) | December 29, 2023 | Enforced; FDA Cosmetics Direct portal is live | Products deemed misbranded; subject to detention, refusal of admission, mandatory recall; civil monetary penalties |
| Product Listing (existing products) | December 29, 2023 | Enforced; FDA Cosmetics Direct portal is live | Products deemed misbranded; same enforcement consequences as facility registration failure |
| Adverse Event Reporting | December 29, 2023 | Enforced — serious events within 15 business days | Violation of FD&C Act Section 301; potential civil and criminal penalties for knowing violations |
| Safety Substantiation | December 29, 2023 | Enforced — records must be maintained | Product deemed adulterated; same consequences as GMP non-compliance |
| Mandatory Recall Authority | December 29, 2023 | FDA can exercise mandatory recall authority | Failure to comply with mandatory recall order can result in civil monetary penalties and injunctive relief |
| FDA GMP Proposed Rule | FDA published proposed rule January 2025 | Final rule expected late 2025 or 2026 | Not yet enforceable as final regulation; voluntary compliance recommended |
| FDA GMP Final Rule | FDA must issue final rule; transition period expected | Pending; industry expects 1-2 year transition period after final rule publication | Upon effective date: products manufactured in non-GMP facilities deemed adulterated |
| Fragrance Allergen Disclosure Rule | FDA must issue proposed rule by June 2024; final rule by June 2026 | FDA issued proposed rule; final rule timeline under review | Pending final rule; label non-compliance after effective date will render product misbranded |
| PFAS Assessment and Report | FDA must publish report by December 2025 | Report submitted to Congress | Not a direct enforcement provision against individual companies; informs future regulatory action |
FDA has indicated that it will exercise enforcement discretion during the transition period, prioritizing cases involving serious health risks, knowing violations, repeated non-compliance, or refusal to engage with FDA communications. However, enforcement discretion is not a guarantee, and the agency has demonstrated through recent Warning Letters that it will act when it identifies significant non-compliance. As of early 2026, FDA has issued multiple Warning Letters to cosmetic facilities for failure to register and failure to list products — indicating that facility registration and product listing compliance are active enforcement priorities.
The penalty structure is significant. Violations of the FD&C Act (including MoCRA provisions) can result in: civil monetary penalties, product detention at the port of entry, refusal of admission (product is exported back or destroyed), injunctions (court orders to cease manufacturing or distribution), and criminal prosecution for knowing and willful violations (applicable to individuals as well as companies). For a small or mid-sized lash brand, the financial and operational impact of a single enforcement action — even one that does not proceed to full prosecution — can be severe, involving legal fees of $10,000 to $50,000+, supply chain disruption, and lost revenue during resolution.
9. Partner with an FDA-Registered, MoCRA-Ready Lash Factory
MoCRA compliance starts at the factory level. If your factory does not have its FDA registration in order, cannot produce GMP-compliant batch documentation, and cannot support your product listing with complete ingredient disclosures, then every downstream compliance step becomes difficult or impossible. Your brand's MoCRA obligations depend on a supply chain that understands and can execute against FDA requirements.
At Aurevia Lashes, our Qingdao manufacturing facility is fully FDA-registered (registration renewed biennially), ISO 22716 GMP-certified, and operationally aligned with the FDA's proposed GMP rule. We support our private-label and OEM clients with: FDA facility registration number for product listing submissions, complete INCI ingredient disclosures for every product (formatted for direct entry into FDA Cosmetics Direct), batch-level microbiological test reports (TAMC, TYMC, pathogen screening), batch traceability documentation from raw material through finished tray, and CPSR-ready safety data for brands pursuing simultaneous EU and US compliance. We are not just a factory — we are your compliance partner for the US market.
Request a quotation and ask for our MoCRA compliance support package — including our FDA registration verification, sample batch documentation, and a checklist of the 12 documents you will need for your own MoCRA compliance file. You can also tour our factory virtually or request product samples to verify quality before placing your first order.