Is Korean Skincare Safe? A 7-Point FDA, MOCRA, and KFDA Verification Protocol for Indie Brand Founders (2026)
By the ALTA MEET editorial team | K-beauty ODM consulting
If you have spent any time in the indie K-beauty founder forums in 2026, you have seen the same question phrased five different ways. Is Korean skincare actually safe? Are the safety standards really as tight as the FDA? My investor asked me what regulator signs off on the formula and I froze. The phrasing keeps shifting, but the underlying nervousness is constant: a founder is about to put a brand name on a product they did not manufacture, in a country whose regulator they cannot pronounce, and they want a checklist.
This post is that checklist. It is written for the indie founder who has a Korean ODM quote in hand, a launch date in the calendar, and a slightly anxious lawyer in the group chat. We will not argue whether one country's standards are "better" than another's. We will give you a 7-point verification protocol you can walk through with any Korean manufacturing partner, with the exact documents to request, the regulator names to spell correctly, and the specific 2026 deadlines and amendments that should change how you ask.
The Short Answer
A Korean-manufactured cosmetic that is finished, registered, and shipped through a reputable Korean ODM working with an ISO 22716 GMP-certified facility is held to ingredient-list and manufacturing standards that are, on the whole, stricter than the U.S. federal floor and broadly comparable with what your safety assessor would expect in the EU. Korea operates under a negative-list ingredient system, meaning everything is allowed except what is specifically prohibited or restricted. The Ministry of Food and Drug Safety (MFDS, often still called "KFDA" in industry shorthand) maintains a prohibited-substance list of roughly 1,030 ingredients, sits between the U.S. floor of about 11 banned categories and the EU's 1,703 prohibited substances as of May 2025.
That is a regulatory snapshot. It does not, by itself, tell you whether the specific bottle landing on your retailer's shelf was made safely. That is a manufacturer-level question, and the rest of this post answers it.
Why "Safe" Has Three Different Definitions
When a US founder asks "is it safe", at least three different questions are usually mixed together:
Ingredient safety. Are the actives, preservatives, fragrances, and colorants legal and within concentration limits in the markets you will sell into?
Manufacturing safety. Was the product actually made in a facility that controls microbiological contamination, cross-contamination, equipment cleaning, and batch traceability?
Regulatory safety. Are the registrations, listings, and renewals current in every jurisdiction where the product is sold, so that a customs hold or an FDA letter is unlikely?
A formula can be ingredient-safe but manufactured in a facility with sloppy GMP. A facility can be ISO 22716 certified but make a product whose claims do not match its actual filing. A regulator can have signed off on the formula in Korea but not on the importer record in the US. Your verification protocol needs to touch all three.
Now to the protocol. Seven steps. Each one is something you can ask your ODM for in an email and reasonably expect a same-week answer. If they cannot answer in a week, that is your first signal.
Step 1: Verify MFDS/KFDA Functional Cosmetic Certification (If Your Product Claims a Function)
Korea splits cosmetics into "general cosmetics" and "functional cosmetics". The functional category currently covers sunscreens, anti-aging products, whitening products, hair-loss prevention, anti-acne products, atopic-relief skin-conditioning products, stretch-mark relief products, and a few others. Each functional category requires pre-market evaluation and approval by MFDS before the product can be sold or exported as making that claim. The evaluation involves submitting safety and efficacy data through the Integrated Drug Information System, including research and development records, ingredient origin documentation, SPF level testing (for sunscreens), and the specific test methodologies used. This is a formal pre-approval, not a self-affirmation.
What to request from your ODM:
The MFDS functional cosmetic notification/approval number for your specific formula, if your claim falls in a functional category.
The approval certificate (it will list the functional category, the active ingredients with declared concentrations, and the approval date).
If your product is not in a functional category, ask the ODM to confirm in writing that all your claims are within the general-cosmetic boundary and do not trigger functional pre-approval.
Why this matters in 2026: On March 31, 2026, MFDS amended the Enforcement Rule of the Cosmetics Act, with the amendments taking effect on April 2, 2026. The amendment strengthens safety supervision of directly purchased overseas cosmetics (cross-border e-commerce flowing into Korea), but the practical signal for indie founders is that MFDS is in an active enforcement-tightening cycle. Functional claims that were tolerated loosely two years ago are getting more documentary scrutiny. If your ODM tells you "we just label it however the brand wants", that is your second signal.
Step 2: Confirm the ODM's ISO 22716 GMP Status (and Read the Audit Report)
ISO 22716 is the international Good Manufacturing Practice standard for cosmetics. It is the document that the EU Cosmetics Regulation references as the GMP benchmark, and it is what most safety assessors expect to see referenced on a product information file. It covers personnel training, facility design and maintenance, equipment validation, raw material handling, production processes, quality control, storage, and shipment. Critically, it does not cover research and development or the distribution of finished products, so an ISO 22716 certificate is not a "the formula is good" certificate; it is a "the factory is run correctly" certificate.
Most reputable Korean ODMs that supply export-grade products will hold an ISO 22716 certification from one of the major certification bodies operating in Korea (SGS, Intertek, TÜV SÜD, DQS, Bureau Veritas, and others all run audits there).
What to request:
The current ISO 22716 certificate scan. Check the certification body's name, the certificate number, the issue date, and the next surveillance audit date. Surveillance audits typically happen annually; the full re-certification audit happens every three years.
The scope statement on the certificate. It will list which product categories the certification covers (e.g., "manufacture of cosmetic skincare creams, lotions, serums, and toners"). If your product category is not on that scope, the certificate does not cover you.
The most recent surveillance audit summary, or at minimum the list of nonconformities (NCs) raised and closed. An ODM that has had zero nonconformities in three years is either extraordinary or is not auditing aggressively. A handful of minor NCs that were closed within the timeline is a healthier signal than a clean sheet.
ODM perspective: When we review a Korean ODM partner for an ALTA MEET client, we typically ask for the last two surveillance reports side-by-side. The pattern of how NCs are written, addressed, and closed tells you more about quality culture than the certificate itself. A facility that documents minor deviations openly is the one we want our clients building with.
Step 3: Pull a Recent Microbial Certificate of Analysis (ISO 17516)
ISO 17516:2014 sets the microbiological limits that most non-EU cosmetic markets, including Korea, treat as the working benchmark. The standard recognizes two categories. Category 1 (products for children under three, eye area, and mucous membranes) caps total aerobic mesophilic bacteria at 100 CFU/g or mL and yeasts/molds at 10 CFU/g. Category 2 (all other cosmetics) caps both at 1,000 CFU/g (10³). In both categories, four pathogens must be absent: Escherichia coli, Staphylococcus aureus, Pseudomonas aeruginosa, and Candida albicans.
A reputable Korean ODM runs microbial testing on every production batch and keeps the results on file. The Certificate of Analysis (CoA) is the document that translates those internal test results into a one-page export-ready summary.
What to request:
The CoA for a recently completed batch in your product category (it can be a different SKU, you just need to see the format and the values).
Confirmation of which microbial standard the CoA is based on. The line should reference ISO 17516:2014 or ISO 17516 (currently being updated; ISO/DIS 17516 is in draft revision as of 2026).
The pathogen panel, confirming that all four pathogens (E. coli, S. aureus, P. aeruginosa, C. albicans) are explicitly listed as "not detected" or "absent in 1g/mL", not just an aggregate "total count".
If your product is destined for the EU, you will also want the preservative efficacy test (PET / challenge test) per ISO 11930. That is a separate test, run on the finished formula, not just the bulk.
Step 4: Cross-Check the INCI List Against KFDA, FDA, and EU Ban Lists
This is the step that catches the most reformulation surprises. Three regulators, three negative lists, three sets of allowed-but-restricted concentrations.
KFDA/MFDS maintains a negative list of approximately 1,030 prohibited ingredients for cosmetics manufactured in or sold in Korea. Hydroquinone and formaldehyde are banned or sharply restricted. Steroids, radioactive materials, and antibiotics are prohibited.
EU Cosmetics Regulation (EC 1223/2009) prohibits approximately 1,703 substances as of May 2025 (Annex II). Annex III adds roughly 370–380 substances with concentration, product-category, or labeling restrictions. New 2025 additions tightened fragrance allergens, hair dyes, and several preservative categories.
US FDA, by statute, prohibits or restricts roughly 11 ingredient categories: bithionol, mercury compounds, vinyl chloride (aerosols), halogenated salicylanilides, zirconium complexes in aerosols, chloroform, methylene chloride, chlorofluorocarbon propellants, hexachlorophene, and a few additional state-level rules (California's Toxic-Free Cosmetics Act adds 24 more, with more states following suit).
A formula compliant for Korean retail is usually compliant for US sale, because the US baseline is so much lower. The reverse is not always true. A formula compliant for US sale may include ingredients that are restricted in Korea (some sunscreen UV filters, some preservative concentrations) or in the EU (fragrance allergens that need disclosure or removal).
What to request:
The full INCI list with declared concentrations (the ODM may share concentration ranges rather than exact percentages for IP reasons; ranges are workable for compliance review, exact values are needed for safety assessor sign-off).
A regulatory cross-check document confirming the formula is compliant for each market you plan to sell into. Reputable ODMs maintain in-house regulatory affairs teams that run this check before quoting; ask for the report.
A flag list of any ingredients that sit in the "restricted but allowed within limits" bucket (Annex III equivalents). These are the ingredients most likely to trigger a reformulation request if your launch markets shift.
ODM perspective: When we line up Korean ODM quotes for a US-launching indie client, we always ask for the EU compliance status even if the brand has no EU plans yet. EU readiness is the cheapest insurance against later reformulation cost. Adding 12% to the development timeline at the spec stage is fractional next to redoing a stability program after launch.
Step 5: Verify the ODM Will Support Your MOCRA Filings and the 2026 Renewal Cycle
The Modernization of Cosmetics Regulation Act (MOCRA) came into force on December 29, 2023, with FDA enforcement of facility registration and product listing starting July 2024. Manufacturers and processors of cosmetic products distributed in the US had to file initial registrations by July 1, 2024.
Here is the 2026 piece most US indie founders have not internalized: the first biennial renewal deadline is July 1, 2026. Every facility that registered in mid-2024 must renew this summer. On February 11, 2026, FDA announced updates to the Cosmetics Direct electronic submission portal to support that renewal cycle. After 2026, renewals happen every two years anchored to your initial registration date.
For a US indie brand sourcing from a Korean ODM, MOCRA touches you in three places:
Facility registration. The Korean manufacturing facility itself must be registered with FDA if it manufactures or processes cosmetics for US distribution. This is the ODM's filing, not yours.
Product listing. The product (your branded SKU) must be listed with FDA. This is your filing as the responsible person, though many ODMs will support the data submission.
Adverse event reporting setup. You need a US contact and a serious adverse event reporting system. This is a small operational lift but it is a hard regulatory requirement.
What to request from your ODM:
The Korean manufacturing facility's FDA registration number and the current registration status.
Written confirmation of whether the ODM has completed (or plans to complete) the July 2026 biennial renewal for that facility.
The data set the ODM will provide for your product listing: INCI list in FDA-acceptable format, labeling claims as filed, allergen disclosures, and any restricted-ingredient flags.
If your ODM does not know what MOCRA is, that is a major signal. It is not 2023 anymore. Compliance with MOCRA in 2026 is table-stakes for any Korean ODM that supplies US brands.
I'm Liz, I run ALTA MEET out of Manhattan, NYC. The conversation I have most often with first-time indie founders is the one right after they realize their July 2026 MOCRA renewal is on their ODM, not on them, and they have no idea whether the ODM is on top of it. If you want a quick gut-check on whether your Korean manufacturing partner is ready for this renewal cycle, grab 15 minutes free with Liz. I will not pitch you. I will tell you whether the answer you got from your ODM matches the answers I am hearing from the 20-plus facilities we work with on the Seoul side.
Step 6: Audit the Stability Testing Records (ICH Q1A and the MFDS 40°C/75% RH Protocol)
Stability testing is the bridge between a formula that works in the lab and a formula that holds up on a shelf in Phoenix in August. The technical reference most Korean ODMs use is ICH Q1A(R2), the International Council for Harmonisation guideline for pharmaceutical and cosmetic stability testing, combined with the Korean MFDS reference protocol of 40°C / 75% relative humidity / 90 days for accelerated aging. Sunscreens and other functional categories often run the more aggressive 45°C protocol for the same 90 days, depending on the functional claim being supported.
A reputable Korean ODM will run, at minimum:
Centrifuge test at roughly 3,000 rpm for 30 minutes to screen for emulsion separation.
pH stability with ±0.5 unit acceptance from time-zero across the 90-day window.
Viscosity stability with ±15% acceptance from time-zero.
Microbial count and pathogen panel per ISO 17516 at day 0, day 30, and day 90.
Sensory consistency (color, odor, application feel) graded against time-zero retains.
What to request:
The full stability protocol document for your category (not just your formula; the protocol itself).
The most recent stability report for a comparable product (a serum if you are making a serum, a cream if you are making a cream).
Confirmation that your formula will go through the same protocol before commercial release.
If the ODM's response to "can I see your stability protocol" is a one-paragraph email, dig deeper. A real protocol is 8-15 pages with sample storage diagrams, sampling cadence tables, and pass/fail criteria.
Step 7: Ask for the Allergen and Heavy Metal Test Panel
The last step is often skipped by first-time founders but it is the cheapest insurance against a future recall.
Fragrance allergens. The EU requires individual disclosure of 26 fragrance allergens (with the 2025 amendment expanding several entries). Even if you do not plan to sell in the EU, the 26-allergen panel is a useful sniff-test for whether your formula will hold up against a future EU expansion. Ask the ODM for the fragrance allergen breakdown if your product contains parfum/fragrance.
Heavy metals. Lead, arsenic, mercury, cadmium, and nickel are the standard panel. Each market has slightly different limits, but the practical floor most Korean ODMs work to is:
Lead: ≤10 ppm (some markets ≤20 ppm)
Arsenic: ≤3 ppm
Mercury: ≤1 ppm
Cadmium: ≤5 ppm
Nickel: typically tested in eye products and lip products
Korean ODMs producing for export typically run heavy metal panels on raw materials at incoming inspection and on finished product per batch. Ask for the most recent heavy metal CoA for a comparable product. If the ODM only tests at the raw-material stage, that is a partial program. Finished-product heavy metal testing per batch is the export-ready standard.
Common Mistakes Indie Founders Make at This Stage
Five patterns we see repeatedly on calls with first-time founders:
Treating the ISO 22716 certificate as the only credential needed. It is a foundation, not a ceiling. A certified facility can still ship a poorly-formulated product if your formula brief was vague.
Asking the sales rep instead of the regulatory affairs team. Most Korean ODMs have a separate RA team that can answer in 24 hours; the sales rep often gives a guess. Ask to be introduced to RA directly.
Confusing the MFDS functional approval with general product safety. The functional approval is a claim approval, not a general safety license. A product can be perfectly safe and not need a functional approval if its claims stay general.
Skipping the EU compliance cross-check. Even if you have no EU plans, EU compliance at the formula stage is cheap. Reformulating later is expensive.
Treating MOCRA as something to figure out later. The July 2026 biennial renewal is the first real enforcement gate. If your ODM is not actively managing it, your launch is at risk for any US shipment after that date.
A Decision Framework: When to Walk Away
You are not obligated to use an ODM just because you have already paid for samples. Three patterns are walk-away signals, in our experience working with Korean ODM partners:
Step 1 unanswered. If after a week the ODM cannot tell you whether your claim falls in a functional category and produce the approval if it does, the regulatory affairs function is too thin to support a US launch.
Step 2 nonconformity history hidden. If the ODM refuses to share their last surveillance audit summary "for confidentiality reasons", that is a flag. The surveillance summary should not contain confidential client data; it is your right as a prospective customer to see it.
Step 5 MOCRA unfamiliarity. If "what is MOCRA" is a real question from the ODM in mid-2026, the facility is not ready to supply the US market. Walk away.
Steps 3, 4, 6, and 7 are almost always answerable. If an ODM fails one of those four, it is usually a fixable documentation gap, not a structural weakness. Ask, wait two weeks, ask again. Many Korean ODMs over-deliver once they understand the brand is serious.
Key Takeaways
Korea operates a negative-list ingredient system with roughly 1,030 prohibited ingredients, sitting between the US federal floor (~11 categories) and the EU (~1,703 prohibited substances as of May 2025).
The MFDS functional cosmetic category is a claim-level pre-approval, not a general safety license. Confirm whether your claims fall in a functional category in Step 1.
ISO 22716 is the GMP standard most Korean export-grade ODMs hold. Ask for the certificate, the scope statement, and at least one recent surveillance audit summary.
ISO 17516 microbial limits (Category 1: 100 CFU/g for eye/baby/mucosal; Category 2: 10³ CFU/g for everything else; four pathogens absent) are the working benchmark. Pull a CoA before you sign.
KFDA, FDA, and EU ban lists differ substantially. EU compliance at the formula stage is cheap insurance against future reformulation.
MOCRA biennial renewals begin July 1, 2026. Confirm your ODM is managing the facility registration renewal on time.
Stability testing (ICH Q1A + MFDS 40°C/75% RH protocol) and a finished-product heavy metal panel close the gap between "the formula is safe" and "every batch is safe".
FAQ
Is the FDA stricter than the KFDA when it comes to cosmetic safety? Generally, no. The US FDA prohibits roughly 11 ingredient categories at the federal level (state-level rules in California and elsewhere add more). KFDA/MFDS prohibits roughly 1,030 ingredients. On ingredient-list strictness, the KFDA system is closer to the EU than to the US baseline. On enforcement of finished-product registration, MOCRA (post-2024) is closing some of that gap on the US side.
Do I need MFDS approval if my brand is only sold in the US? You do not need MFDS approval for US-only sales, but if your product is manufactured in Korea, the facility itself operates under MFDS oversight. Your US-side filings are MOCRA (facility registration and product listing). If the formula makes claims that would be classified as "functional" in Korea (whitening, SPF, anti-aging, etc.), the ODM often runs through the MFDS functional approval anyway because their domestic clients need it.
What is the cheapest piece of due diligence that catches the most problems? Pulling one recent batch CoA for a product in your category. The CoA shows microbial results, pH, viscosity, heavy metals (if the ODM runs them at finished-product level), and the testing standards referenced. If the CoA is well-formatted, properly referenced, and signed by a named QA manager, you have learned a lot about the facility in one document.
How long does the 7-step protocol actually take? For a responsive Korean ODM with a real regulatory affairs team, two to three weeks. Documents trickle in: ISO certificate same day, recent CoA in 2-3 days, stability protocol in 5-7 days, allergen/heavy metal data in 7-10 days. For an ODM that does not have a real RA function, the timeline stretches past four weeks, which is itself a signal.
What if I am sourcing through a trading house, not directly from the ODM? The trading house should still be able to produce every document on this list, because they obtained them from the ODM. If the trading house is unable to produce them, ask them to obtain them from the ODM. If they are unwilling, that is a sourcing-channel transparency problem that goes beyond this checklist; you may want to read our piece on Korean ODM direct vs trading house vs US broker sourcing.
Does Korean skincare get inspected when it lands at US customs? Yes. US Customs and Border Protection (CBP) inspects cosmetic shipments and refers any concerns to FDA. MOCRA gives FDA new authority to refuse entry to products from facilities that are not properly registered. The practical effect for indie founders is that a properly-registered ODM with current MOCRA filings makes customs largely routine. An ODM with lapsed filings creates customs holds.
My ODM says they cannot share their audit reports for confidentiality. Is that normal? Internal audit reports can be confidential. The surveillance audit summary from the certification body (SGS, Intertek, TÜV SÜD, etc.) is not internal; it is a third-party document and is typically shareable with prospective customers under a normal NDA. If the ODM refuses to share it even under NDA, treat that as a transparency flag.
Working With ALTA MEET
ALTA MEET is a New York–based K-beauty manufacturing partner. We operate out of Manhattan and run a Seoul-side hands-on partnership with over 20 Korean ODM facilities. We have walked first-time founders through this 7-point protocol more times than we have written it down, and we keep the documentation templates we use with brands on file.
If you have an ODM quote in hand and want a second pair of eyes on the safety and regulatory side before you sign, book a free 15-min gut-check with Liz. Two questions in the booking form route the conversation directly; you will not get a generic sales pitch.
Reviewed for accuracy by ALTA MEET's formulation and regulatory consulting team.
