MoCRA Compliance for Amazon Beauty Sellers: Registration, Listing, Labels

For most of the history of US cosmetics regulation, a brand could launch a face cream, sell it on Amazon for years and never tell FDA it existed. The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) ended that. It added facility registration, product listing, safety substantiation, adverse event reporting and new label requirements to the FD&C Act, and every one of them lands on the "responsible person", which for a brand-owned product is you, not your contract manufacturer.

Amazon has not written a MoCRA policy of its own, and it does not need one. Its cosmetics restricted-products page prohibits products lacking FDA-required labeling, and its Beauty approval process can ask for MoCRA registration and listing documentation alongside GMP certificates and Certificates of Analysis. This guide covers each MoCRA duty, who it applies to, the deadlines, and what to have ready when Amazon asks.

What MoCRA added

MoCRA inserted a set of new sections into the FD&C Act, codified at 21 USC 364 and following. The ones a seller deals with directly:

• Facility registration (21 USC 364c(a), (b)): every facility that manufactures or processes cosmetics for US distribution registers with FDA and renews every two years.
• Product listing (21 USC 364c(c), (d)): the responsible person lists each cosmetic product marketed in the US, with its ingredients and the facility where it is made, and updates the listing annually.
• Safety substantiation (21 USC 364d): records showing adequate substantiation that each product is safe.
• Adverse event reporting and records (21 USC 364a): serious adverse events reported within 15 business days, and records kept for every adverse event.
• Labeling (21 USC 364e): a responsible-person contact on every label, and a professional-use statement on products meant for licensed professionals.

FDA's MoCRA overview page tracks implementation. The sections below follow the order a new brand meets them.

Facility registration: who registers and when

Registration attaches to the facility, not the brand. If a contract manufacturer makes your products, the manufacturer registers its facility and you rely on that registration; hold a copy of it, with the FEI number, because Amazon and retail buyers ask for it. If you make product yourself, even in a small space, you register.

The statutory deadline was 2023-12-29, and FDA's compliance policy deferred enforcement to 2024-07-01. A facility that first begins manufacturing after that date registers within 60 days of starting. Registrations renew every two years, and changes to the registration information are reported within 60 days. FDA's registration and listing page is where submissions happen, and the statute itself is at 21 USC 364c.

Product listing: every cosmetic, within 120 days

The product listing is the brand's own duty. Each cosmetic product marketed in the US is listed with FDA, including its ingredients and the facility where it is made. Products first marketed after the 2024-07-01 enforcement date are listed within 120 days of going on sale, and listings are updated annually, with changes reported.

Two things trip Amazon sellers here. First, "each product" follows the formula, not the ASIN family: a new shade or scent with a different ingredient list needs its own entry. Second, a product that is both a cosmetic and a drug (a tinted moisturizer with SPF, an antiperspirant deodorant) is not listed under MoCRA at all. It falls under the drug listing rules instead (21 USC 364j), which is one more reason to settle the cosmetic-versus-drug question before you file anything.

The small-business exemption and its limits

MoCRA exempts small businesses from facility registration and product listing: a responsible person or facility owner whose average gross annual US cosmetic sales over the prior three years were under $1,000,000. That covers many Amazon brands, but the exemption falls away if the product:

• regularly comes into contact with the mucus membrane of the eye under customary use,
• is injected,
• is intended for internal use, or
• is intended to alter appearance for more than 24 hours under customary conditions and is not removed by the consumer.

Mascara, eyeliner, lash products and semi-permanent brow tints are the obvious casualties: a small brand selling only mascara still registers and lists. And the exemption covers registration and listing only. It does not touch safety substantiation, adverse event duties or the label contact requirement.

Safety substantiation: the file with no exemption

Under 21 USC 364d, the responsible person must ensure, and keep records showing, adequate substantiation that each product is safe: tests, studies, research, analyses or other evidence sufficient to support a reasonable certainty of no harm under customary or expected conditions of use. A product without this is adulterated. There is no small-business carve-out.

In practice the file is a dossier assembled from the manufacturer and your own testing:

• Ingredient safety data for the formula as marketed.
• Stability and shelf-life data supporting the period-after-opening and any expiry date shown.
• A preservative efficacy (challenge) test for water-based rinse-off, oral-liquid and children's products.
• Patch or RIPT dermatology reports where the copy claims "hypoallergenic" or "dermatologist tested".
• Certificates of Analysis (micro, heavy metals) by batch where a claim or a buyer requires them.

If you have read our guide to supplement compliance documents, the shape is familiar: the regulator does not ask for the file until something goes wrong, and then it asks for all of it.

Adverse events: the 15-business-day clock

A serious adverse event must be reported to FDA within 15 business days of the responsible person receiving it, and new medical information received within a year goes in within a further 15 business days (21 USC 364a). Records of every adverse event, serious or not, are kept for 6 years, or 3 for qualifying small businesses.

The clock starts when you receive the report, and on Amazon a customer message or a review describing a reaction can start it. You need a written SOP that routes those messages to someone who knows the duty, and a log. The contact line on the label, covered next, exists so these reports reach you.

The label: contact line and professional-use statement

Since 2024-12-29, every cosmetic label must bear a domestic address, a domestic telephone number, or electronic contact information through which the responsible person can receive adverse event reports (21 USC 364e(a)). This sits alongside the long-standing name and place of business requirement in 21 CFR 701.12. A foreign address on its own does not satisfy it; a foreign address plus a US phone number or an email address does.

Separately, a cosmetic intended for use only by a licensed professional (keratin treatments, lash adhesives, chemical peels, backbar products) must carry a clear and prominent statement that it is to be administered or used only by licensed professionals (21 USC 364e(b)), and it must still carry the full consumer labeling. A listing positioned as "salon professional" that never says "only by licensed professionals" is missing a required statement, and the phrase belongs in the listing copy as well as on the box so buyers see it before purchase.

Because these are label requirements, they are visible to anyone who zooms in on your packaging images, which is how both FDA and a compliance scan will check them.

What Amazon asks for

Amazon's Beauty selling page describes the approval process for gated brands and sub-categories: supplier invoices dated within 180 days showing 10 or more units, product images showing all sides of the packaging, and on request GMP certificates, Certificates of Analysis and MoCRA registration and listing documentation. Which brands are gated changes without notice.

The GMP certificate is worth a note. FDA's own MoCRA good manufacturing practice rule, which will sit at 21 CFR 711, had not been finalised when this was written, so Amazon is asking for ISO 22716 or an equivalent audit ahead of the regulator. Get it from the manufacturer now rather than when a gating application stalls.

The practical checklist for a brand on Amazon:

1. A copy of the facility registration (yours or the manufacturer's) with the FEI number, and the renewal date two years out.
2. A product listing confirmation for every formula, with the annual update date.
3. The safety substantiation dossier per product.
4. An adverse event SOP and log.
5. A responsible-person contact line on every current label, and the professional-use statement where it applies.
6. The GMP certificate and COAs Amazon may request at gating.

Keeping those dates and documents current across a catalogue is a tracking problem as much as a regulatory one. Verid8 holds the MoCRA obligations per account and per listing, with the 60-day, 120-day, biennial and annual clocks, checks label images for the contact line and the professional-use statement, and files the documents against each product. The Beauty & Personal Care page lists what the check covers.

MoCRA did not make cosmetics harder to sell. It made it necessary to show, on paper and on the label, who stands behind the product. Have that ready before Amazon or FDA asks.