MFDS, KFDA, MOCRA, CPNP: Korean Cosmetics Regulation Hub for US Indie Founders (2026)
If you are an indie K-beauty founder selling in the United States, considering Europe, and sourcing from a Korean ODM, four acronyms keep showing up in your inbox: MFDS, KFDA, MOCRA, and CPNP. They read like a random string of letters. They are not. They are four separate regulatory frameworks that every founder shipping cross-border must understand before the first purchase order lands.
This guide walks through what each one actually is, which agency owns it, when it applies to your brand, and the exact order to tackle registrations if you are launching in Korea, the US, and the EU. It is written for founders who need a working mental model in one sitting, not a compliance memo.
The four acronyms decoded: what each one actually is
The first source of founder confusion is that two of these acronyms name the same agency. MFDS stands for the Ministry of Food and Drug Safety, the Korean government body that regulates cosmetics, food, and pharmaceuticals. KFDA is the older English shorthand, Korea Food and Drug Administration, that many founders and even some Korean ODM sales teams still use out of habit. The agency renamed itself to MFDS in 2013 when it was elevated from a subordinate administration to a full ministry (see mfds.go.kr). If a Korean ODM sends you a document referencing KFDA approval, MFDS approval, or MFDS notification, they all point at the same regulator.
MOCRA is different. It stands for the Modernization of Cosmetics Regulation Act of 2022, the first major overhaul of US cosmetics law in more than eighty years. MOCRA is administered by the US Food and Drug Administration, and it introduced mandatory facility registration, product listing, safety substantiation, and adverse-event reporting obligations that never existed under the old Federal Food, Drug, and Cosmetic Act framework (see fda.gov MOCRA overview).
CPNP stands for Cosmetic Products Notification Portal. It is the European Union's centralized database where every cosmetic product placed on the EU market must be notified before sale, under Regulation (EC) No 1223/2009. The portal is run by the European Commission, and a Responsible Person established inside the EU must submit each notification (see ec.europa.eu cosmetics regulations).
So the clean mental map: two Korean identities that mean the same agency, one US framework passed in 2022, and one EU notification portal running since 2013. Four labels, three regulators, three continents.
Which regulator applies when: the founder decision matrix
The regulator that owns your product is decided by where the product is sold, not where it is made. A Korean ODM in Incheon manufacturing your serum does not automatically bring MFDS jurisdiction over your US retail listing. If the serum is only sold at a Sephora US door, MOCRA is the primary framework. If it also ships from Amazon UK to a customer in Frankfurt, CPNP applies in parallel. If you also open a Korean D2C store or list on Olive Young, MFDS applies for the Korean shelf.
Three practical rules follow. First, your ODM's KFDA/MFDS work only satisfies the Korean shelf. It is a starting point for building safety files, but it is not portable to the US or EU without additional testing and dossiers. Second, MOCRA does not recognize prior EU registrations. A CPNP notification does not give you a MOCRA product listing. Third, CPNP does not accept US safety substantiation as a substitute for a Cosmetic Product Safety Report signed by a qualified assessor.
The upshot is that for a founder selling in all three regions, you are running three parallel registration workstreams, not one. Your Korean ODM can help with the Korean piece and often provides raw data useful for the other two, but the US and EU workstreams need country-specific work.
MFDS (Korea): what founder-side compliance looks like
If you plan to sell in Korea, MFDS applies. There is no product-by-product pre-approval for general cosmetics, but the Ministry keeps a functional cosmetics category that includes whitening, anti-wrinkle, sunscreen, and hair color products, which do require pre-market approval and clinical substantiation of the functional claim (see mfds.go.kr English functional cosmetics guidance).
For a general cosmetic, the practical work is not a notification but a compliance file that your ODM builds. It includes the full ingredient list checked against the MFDS-negative list, safety data on each component, stability testing per Korean guidelines, microbiological testing, container compatibility data, and Korean-language labeling. The label must show the ingredient list in Korean, the manufacturing date or expiration date in the Korean format, and the responsible seller's name and address.
For a functional cosmetic, the same file plus a functional-claim substantiation study is submitted for MFDS review before market launch. Timelines run several months and cost varies with the depth of clinical data required. Your Korean ODM can either handle the review directly if they carry manufacturer status, or work with an in-country responsible seller entity that you register through a Korean partner.
The founder mistake here is assuming a "KFDA approval" stamp from the ODM equals a portable seal of quality. It does not. It confirms only that the product meets Korean rules for a Korean shelf.
MOCRA (US): facility registration, product listing, safety substantiation
MOCRA introduced four obligations that indie founders now share with every US brand owner. Facility registration requires any facility that manufactures or processes cosmetic products for the US market to register with the FDA. Registration renews every two years. This includes your Korean ODM's manufacturing site, which must be listed as a facility in the FDA's registration system (see fda.gov facility registration guidance).
Product listing requires the responsible person, which for indie brands is typically the brand owner or importer of record, to submit a product listing for each cosmetic product marketed in the US. The listing captures the brand name, product category, full ingredient list, and the facility registration number of the manufacturer.
Safety substantiation requires the responsible person to maintain records establishing that each product is safe under labeled or customary conditions of use. This is not a filing to the FDA. It is a record the brand keeps and produces on request. Substantiation can rest on test data, published literature, or scientific reasoning by a qualified expert. For a K-beauty brand, this typically means combining the Korean ODM's stability and preservative-efficacy data with a US-qualified safety assessor sign-off.
Adverse-event reporting requires responsible persons to submit reports of serious adverse events to the FDA within fifteen business days. Serious adverse events include hospitalization, disfigurement, and life-threatening reactions. Brands must maintain records of all adverse events, serious or not, for six years.
Founder note: the FDA has published detailed MOCRA guidance and the facility registration portal is live. There is no "MOCRA approval" letter. It is a submission-and-record system, not a permit system.
I am Liz, I run altameet from Manhattan, NYC, and I have watched indie founders spend a full launch quarter chasing an FDA "approval" that does not exist under MOCRA. It is a registration and record-keeping regime, not an approval regime. If you want a fifteen-minute gut check on how MOCRA maps to your specific ODM setup and product line, email liz@altameet.com and I will book a call.
CPNP (EU): the notification, the Responsible Person, and the CPSR
The EU framework rests on three interlocking pieces. The Cosmetic Product Notification Portal is the submission database. The Responsible Person is a legal entity established in the EU who owns compliance for the product. The Cosmetic Product Safety Report is the dossier that must be complete and signed by a qualified assessor before notification.
The Responsible Person can be the brand owner if it has an EU legal presence, the importer if the product comes from outside the EU, or a designated third party under contract. Many indie K-beauty brands appoint a specialized regulatory firm as their Responsible Person because it avoids the cost of setting up an EU subsidiary. The Responsible Person is not a passive title. They hold the Product Information File, respond to competent-authority inquiries, and are legally accountable for product safety on the EU market (see ec.europa.eu CosIng resources).
The Cosmetic Product Safety Report has two parts. Part A collects the safety information, including ingredient specifications, impurity data, packaging material data, microbiological quality, stability, and human exposure. Part B is the safety assessment itself, written and signed by a qualified assessor, typically a European pharmacist or toxicologist with recognized credentials.
CPNP notification is not a review process. Once the Responsible Person submits the dossier through the portal, the product can be placed on the market. Competent authorities in each member state may audit at any time. If they request the Product Information File, the Responsible Person has seventy-two hours to provide the documentation in a readable format for the local language.
The founder mistake here is assuming CPNP is a light-touch registration because there is no approval letter. In practice, the CPSR is the heaviest single document in the K-beauty founder's compliance stack, and rebuilding it after a formulation change is expensive and slow.
The sequencing question: which registration do you tackle first?
For an indie brand launching a serum or moisturizer through a Korean ODM into Korea, the US, and the EU inside twelve months, the practical sequencing is Korea first, US second, EU third. The reasoning is not regulatory difficulty. It is dependency chain.
Korea first because your ODM is already generating Korean compliance data as part of production. Ingredient lists, stability data, microbiological testing, and preservative efficacy are captured in Korean format. Getting those files organized and Korean-labeling done aligns with your ODM's normal workflow and gives you a Korean D2C or Olive Young launch on day one.
US second because MOCRA facility registration is the fastest single filing in the stack. Once the Korean ODM's site is registered with the FDA, you can build product listings for each SKU in a few weeks. Safety substantiation piggybacks on the Korean ODM's data with a US-qualified safety assessor sign-off. You can be shelf-ready for a US Amazon or Shopify launch inside eight to twelve weeks of Korea data being complete.
EU third because CPNP requires a Responsible Person to be under contract before notification, and building the CPSR is the longest single line item. The good news: the Korean and US compliance data feed directly into the CPSR. Your Responsible Person and safety assessor use the same stability, microbiology, and ingredient data with additional EU-specific work on human exposure and packaging migration.
This sequence assumes a straightforward product category. If your formula uses functional-cosmetic actives that trigger MFDS pre-approval or ingredients on the EU restricted list, the calendar shifts and Korea may take longer than the US. A serum or hydrating moisturizer with mainstream ingredients typically follows the standard order.
The five most common founder mistakes on this stack
First, treating "KFDA approved" as a portable seal. It is only a Korean-shelf statement. US and EU shelves need country-specific work regardless of the Korean status.
Second, expecting a MOCRA approval letter. MOCRA is a registration and record-keeping regime. There is no letter. There is a submission confirmation and an obligation to keep records.
Third, appointing a Responsible Person only to save filing costs. The Responsible Person owns legal liability on the EU market. A cheap Responsible Person contract with limited scope leaves the brand exposed when a competent authority audits, and can invalidate the CPSR itself.
Fourth, using the same safety assessor for all three regions. Korean, US, and EU safety substantiation each have their own methodology and their own credential expectations. Trying to run a single assessment across all three often means the file is rejected during EU audit even if it passed US safety substantiation review.
Fifth, missing the sunscreen split. Sunscreens are regulated as over-the-counter drugs by the FDA, as functional cosmetics by MFDS, and as cosmetics with strict UV-filter positive-list rules by the EU. A single K-beauty SPF formula cannot be sold in all three regions without three different regulatory tracks. This is the single most common regulatory blocker for indie K-beauty founders launching a sunscreen SKU.
What good compliance planning looks like at brief stage
The most efficient thing a founder can do is settle the compliance sequencing at brief stage, before the ODM starts formulation. Three questions to answer during the brief:
What regions will you sell in during year one, and which retailer channels in each region? Region and channel determine which regulator applies and how much documentation each retailer additionally demands. Sephora and Ulta ask for MOCRA product listing plus retailer-specific compliance packets. Olive Young asks for MFDS documentation. Boots UK asks for CPNP notification plus animal-testing declarations.
What is the product category? A general skincare cosmetic follows a lighter path in Korea and Europe. A functional cosmetic in Korea, a drug in the US, or a UV-filter product in the EU each add months and cost. Answering this at brief stage lets your ODM steer formulation toward the lighter regulatory track when the marketing claim allows.
Who owns the Responsible Person function in the EU, the responsible person function in the US, and the Korean responsible seller function? Naming these three roles at brief stage prevents the pre-launch scramble where a founder tries to appoint a Responsible Person two weeks before EU shipping starts.
Frequently asked founder questions
Is MFDS the same as KFDA? Yes. KFDA was the pre-2013 name. MFDS is the current name. Any documentation using either acronym refers to the same Korean regulator.
Do I need MOCRA registration if I only sell through Amazon US and not brick-and-mortar retail? Yes. MOCRA applies to any cosmetic product placed on the US market, regardless of retail channel. Amazon US is the US market.
Can my Korean ODM be the Responsible Person for the EU? No. The Responsible Person must be a legal entity established inside the EU. A Korean-based ODM does not qualify. Your options are an EU subsidiary, an EU importer of record, or a designated third party under contract.
Does the EU accept the MOCRA safety substantiation? Not as a substitute for the CPSR. The Cosmetic Product Safety Report is a specific EU document format signed by a qualified assessor. MOCRA substantiation records can feed data into the CPSR, but the CPSR itself must be built as an EU dossier.
What is the fastest realistic timeline for all three registrations if I already have a stable formula? Assuming a general cosmetic with mainstream ingredients: Korean documentation and labeling in four to eight weeks, MOCRA facility registration and product listing in six to twelve weeks after Korean data is complete, and CPNP notification with CPSR in twelve to twenty weeks after MOCRA. A parallel-track approach with an experienced regulatory partner can compress the total to five to seven months for all three regions.
What about UK SCPN post-Brexit? The UK has its own Submission of Cosmetic Product Notification portal separate from EU CPNP. If you sell in the UK, you need a UK Responsible Person and a UK SCPN filing in addition to the EU CPNP notification. See our companion guide, UK SCPN for Korean ODM K-Beauty Brands, for the UK-specific workflow.
Ready to map your compliance stack?
If you are staring at four acronyms and unsure which one to tackle first, or which regulator applies to your specific SKU and channel mix, the fastest way forward is a scoped conversation with someone who has walked founders through the same stack. Book a fifteen-minute call and bring your product list plus target regions. We will map the sequencing on a shared screen and identify which compliance workstreams your Korean ODM already covers versus which need external help.
Email liz@altameet.com to book a call, or reach the team at partnerships@altameet.com. For related reading, see our KFDA vs FDA vs EU safety standards guide for the substantive rule comparison, and our Korean ODM pre-PO due diligence checklist for the vendor-side questions to ask before signing.
By the ALTA MEET editorial team, K-beauty ODM consulting. Reviewed for accuracy by ALTA MEET's formulation consulting team.
