What MoCRA requires of a cosmetics company

The Modernization of Cosmetics Regulation Act (MoCRA) added a set of duties to the Federal Food, Drug, and Cosmetic Act. Most of them fall on the "responsible person": the manufacturer, packer or distributor whose name appears on the product's label (21 U.S.C. 364). A facility that manufactures or processes cosmetic products for the US market has its own duty to register, and that includes an importer's establishment that does so.

Facility registration (21 U.S.C. 364c(a)–(b))

• Each facility that manufactures or processes cosmetic products for distribution in the United States is registered with FDA. A facility that starts doing so registers within 60 days of starting.
• Registration is renewed every two years.
• FDA is told of any change to the registration details within 60 days.
• A contract manufacturer needs only one registration, even when it makes products for several companies. The facility or any of those companies may submit it.
• A registration gives the facility's name, physical address, email and phone; for a foreign facility, its US agent; every brand name sold from products made there; and the product categories and responsible person for each product.

Product listing (21 U.S.C. 364c(c))

• The responsible person lists each cosmetic product with FDA. A product first marketed now is listed within 120 days of being marketed in interstate commerce.
• The listing is updated every year.
• A listing gives the registration number of each facility where the product is made, the responsible person's name and contact number, the product's name as it appears on the label, its category, and its ingredients (including fragrances, flavors and colors).
• One listing can cover several products whose formulas differ only in color, fragrance, flavor or quantity.

Serious adverse events (21 U.S.C. 364a)

• The responsible person sends FDA each report it receives of a serious adverse event in the United States, with a copy of the product's label, within 15 business days of receiving it.
• New medical information about that event received within a year of the first report is sent within 15 business days as well.
• Records of every adverse event report are kept for 6 years, or 3 years for a small business (see below) that does not make the kinds of product listed under the small-business rule.

Safety records (21 U.S.C. 364d)

The responsible person makes sure there is adequate substantiation that each product is safe, and keeps the records that support it. The law defines that as tests, studies, research, analyses or other evidence that qualified experts would consider enough to support a reasonable certainty that the product is safe.

Labels (21 U.S.C. 364e)

• Each product's label carries a domestic address, a domestic phone number, or electronic contact information (such as a website) where the responsible person can receive adverse event reports.
• The law also requires fragrance allergens to be named on the label, with FDA deciding by regulation which substances count. Check FDA's site for where that rule stands.

Small businesses (21 U.S.C. 364h)

A company whose average US sales of cosmetic products over the previous three years is under $1,000,000 (adjusted for inflation) is treated as a small business and is not subject to the registration and listing section or the good-manufacturing-practice section. The exemption does not apply to a company that makes or processes any product that regularly contacts the mucous membrane of the eye, is injected, is meant for internal use, or is meant to change appearance for more than 24 hours where the consumer does not remove it. The adverse event, safety record and labeling duties still apply.

INFO: Aleph does not file anything with FDA. Facility registration and product listing are submitted on FDA's own system; Aleph keeps your details in one place and shows what a listing still needs. It also does not decide whether you are a small business or whether your safety records are adequate. See "Using Aleph's MoCRA pages".