MoCRA split US cosmetic compliance between the factory and the brand. Here is what an FDA-registered facility covers for a Malaysian-made cosmetic, and what stays with you as the responsible person.
Disclosure: This article is published by ORIZI Group and may refer to our own manufacturing experience, services and capabilities. External factual claims are supported by cited sources.
Key takeaways
- Two filings, two owners: the facility registers; the responsible person lists each product, with its ingredients, and updates the listing every year.
- One registration per factory: a contract manufacturer needs a single registration for all the brands it makes, and each brand quotes that registration number in its own product listing.
- The brand can sit outside the US if its name is on the label, but the label still needs a domestic US address, a domestic phone number or an electronic contact such as a website for adverse event reports.
- Claims decide the category: in the US, sunscreen moisturisers, anti-dandruff shampoos and antiperspirant deodorants are drugs as well as cosmetics, with separate rules.
- The right wording is “made in an FDA-registered facility” — FDA states that a registration number does not indicate approval of the facility or its products.
What is MoCRA, and which terms matter?
The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) added facility registration, product listing, adverse event reporting, safety substantiation and new labelling duties to US cosmetic law. Four definitions carry most of the weight:
- A facility registration is the FDA record of a site that manufactures or processes cosmetics for US distribution. Its number is the FDA Establishment Identifier (FEI).
- A product listing is the FDA record of one marketed cosmetic product, including its ingredients and the facilities that make it.
- A responsible person is the manufacturer, packer or distributor whose name appears on the cosmetic’s label. For a private-label product, that is normally the brand owner.
- Cosmetics Direct is FDA’s structured-product-labelling (SPL) authoring tool for submitting registrations and listings.
Facility registration vs product listing: who files what?
| Item | Facility registration | Product listing |
|---|---|---|
| Who files | The owner or operator of the facility; for a contract manufacturer, the factory or a responsible person whose products it makes | The responsible person |
| What it contains | Owner or operator, address and contacts, the US agent for a foreign facility, brand names made there, product categories, and the responsible person for each product | Facility registration number of each site that makes the product, responsible person, product name as on the label, category, and full ingredient list including fragrances, flavours and colours |
| Timing | Within 60 days of starting to make cosmetics for the US; changes within 60 days; renewal every two years | Within 120 days of first marketing; updates annually, including discontinuation |
| Grouping | One registration covers a contract facility for every brand it serves | One listing can cover formulas that differ only in colour, fragrance, flavour or pack size |
Before registering, the facility needs its FEI number; FDA’s guidance says FEI requests for cosmetic facilities are typically processed in 7–10 business days. For a foreign facility such as a Malaysian factory, the registration names a US agent who is physically present in the United States.
What does the responsible person have to do?
MoCRA puts the product-level duties on the brand named on the label. Under FDA’s MoCRA summary and registration guidance, the responsible person must:
- List every marketed product and keep each listing current with annual updates.
- Keep records supporting adequate safety substantiation for each product. FDA notes that animal testing is not a requirement for marketing a cosmetic.
- Report serious adverse events to FDA within 15 business days, and send any new medical information received within a year of the report within another 15 business days.
- Put a reachable contact on the label — a domestic address, domestic phone number or electronic contact such as a website — through which adverse event reports can be received.
- Allow records access when FDA’s conditions for requesting records are met.
A company outside the US can be the responsible person, as long as it is the manufacturer, packer or distributor named on the label. Small businesses with average US cosmetic sales below USD 1 million a year (inflation-adjusted, three-year average) are exempt from registration and listing — but not for products that contact the eye’s mucous membrane, injected or internal-use products, or products that alter appearance for more than 24 hours without being removed.
What must a US cosmetic label carry?
MoCRA adds to the long-standing FDA labelling rules rather than replacing them. FDA’s cosmetics labeling guide sets out the core elements:
| Label element | Where and how |
|---|---|
| Statement of identity | On the principal display panel, in bold type |
| Net quantity of contents | Within the bottom 30% of the principal display panel of the outer container |
| Name and place of business | Corporate name; “Manufactured for” or “Distributed by” when it is not the manufacturer |
| Ingredient declaration | Descending order of predominance on the information panel |
| Warnings and directions | Whenever necessary to prevent a health hazard |
| Country of origin | English name of the country, for imported products |
| Adverse event contact (MoCRA) | Domestic address, domestic phone number or electronic contact |
All required statements must be in English. MoCRA also directs FDA to set fragrance allergen labelling requirements, so check their status before final artwork for a fragranced product.
Does facility registration mean FDA has cleared my product?
No, and that is by design. Under US law, cosmetic products and ingredients do not need FDA premarket approval, with the exception of color additives. On its registration page, FDA states that a registration or listing number does not indicate approval of the facility or its cosmetic products. The accurate, positive way to describe the factory is: “made in a US FDA-registered cosmetic facility.” That wording gives a US importer, marketplace or retail buyer the fact they typically check — that the site is on FDA’s register — without overstating what registration means.
How does a Malaysian-made cosmetic launch in the US, step by step?
- Confirm the category from the claims. A sun-protection claim, an anti-dandruff claim or an antiperspirant claim makes the product a drug as well as a cosmetic in the US, with separate drug rules. See why changing a sunscreen formula means testing the SPF again.
- Decide the responsible person and the US contact that will appear on the label.
- Get the facility details — registration number and FEI — from the manufacturer.
- Screen the formula for US requirements, including color additives, the exception to the no-premarket-approval rule.
- Build the safety substantiation file: stability, compatibility, microbiological and safety data from product testing, plus the safety assessment.
- Finalise English label artwork with all the elements in the table above.
- Submit the product listing within 120 days of first marketing, through Cosmetics Direct or another SPL route.
- Set up adverse event intake and a yearly listing review.
For marketplace launches, our guide to building an Amazon-ready private label product covers the listing and packaging side, and cosmetic export documents explained covers the COA, SDS and free-sale paperwork.
ORIZI perspective: what the FDA registration does for a brand
Within ORIZI Group, cosmetics are manufactured by Dr Orizi (M) Sdn. Bhd., a US FDA-registered cosmetic facility under MoCRA since 2025. The same company holds ISO 22716 (since 2022), NPRA cosmetic GMP (since 2024) and Sedex membership (since 2022), with a SMETA audit completed in 2025. Powder functional food is a separate regime: D&O Nutraceutical Manufacturing Sdn. Bhd. is a US FDA-registered food facility under FSMA (since 2025), not a cosmetic facility.
In practice, the registration means a brand using Dr Orizi does not register the factory again; it quotes the existing facility registration number in its own product listing. What we supply on a US-bound project is the evidence the responsible person needs: the facility registration details, the full ingredient list with names in the form FDA asks for, product category, stability and test reports, and certificates for importer due diligence. The listing, the adverse event intake and the label contact stay with the brand, because MoCRA assigns them to the responsible person.
Risks, limitations and common mistakes
- Overstating the registration. Describe the site as FDA-registered; do not imply the product itself has been reviewed.
- Drug claims on a cosmetic. SPF, anti-dandruff, antiperspirant and similar claims move the product into drug rules.
- A label with no US-reachable contact. A fax number or QR code alone is unlikely to work for adverse event reporting, according to FDA’s guidance.
- Forgetting annual updates. Formula changes and discontinued products must be reflected in the listing.
- Assuming the small-business exemption. It does not cover eye-area, injected, internal-use or long-wear products.
- Pending rules. MoCRA requires FDA to issue cosmetic GMP and fragrance allergen labelling rules; check their status at launch. This guide covers cosmetics only, not OTC drug monographs.
FAQ
Does my brand need its own FDA facility registration?
Not if you only market products made at a registered contract facility. MoCRA needs one registration per facility, which can cover every brand the factory makes; your brand files the product listing and quotes that facility’s registration number.
Can a Malaysian company be the responsible person under MoCRA?
Yes. A company outside the US can be the responsible person if it is the manufacturer, packer or distributor named on the label. The label must still carry a domestic address, domestic phone number or electronic contact for adverse event reports.
Is Dr Orizi registered with the US FDA?
Yes. Dr Orizi (M) Sdn. Bhd. has been a US FDA-registered cosmetic facility under MoCRA since 2025. Registration means the facility is on FDA’s register; FDA does not pre-approve cosmetic products.
When must a new cosmetic be listed with FDA?
Within 120 days of first marketing the product in the US, with updates every year. A single listing can cover formulas that differ only in colour, fragrance, flavour or pack size.
How fast must serious adverse events be reported?
Within 15 business days of the responsible person receiving the report. New medical information received within one year must also be sent within 15 business days.
Sources & references
- US FDA — Modernization of Cosmetics Regulation Act of 2022 (MoCRA) — responsible person, listing, adverse event reporting (15 business days), safety substantiation, records access, small-business exemption, pending GMP and fragrance allergen rules
- US FDA — Registration & Listing of Cosmetic Product Facilities and Products — biennial renewal, annual listing updates, FEI, registration number is not approval
- US FDA — Guidance for Industry: Registration and Listing of Cosmetic Product Facilities and Products — contract manufacturer registration, US agent, 60- and 120-day timelines, listing contents, foreign responsible person, label contact
- US FDA — Cosmetics Direct — submission tool for registration and listing
- US FDA — FDA authority over cosmetics — no premarket approval except color additives
- US FDA — Is it a cosmetic, a drug, or both? — anti-dandruff, antiperspirant and sun-protection products as cosmetic-drugs
- US FDA — Cosmetics Labeling Guide — identity, net quantity, ingredient order, name and place of business, country of origin, English language
Update history: October 2026 — first published.
Planning a US launch? See our export OEM manufacturing overview or send us your product, claims and target channel for a US-readiness review before production.
