MoCRA in 2026 for Indie K-Beauty Founders: A Public-Records Overview

By the ALTA MEET editorial team | Public-records overview for indie K-beauty founders

The Modernization of Cosmetics Regulation Act of 2022 (MoCRA) is the largest change to US cosmetics oversight since 1938, and by mid-2026 the first biennial renewal cycle is underway. For indie K-beauty founders working with Korean OEM and ODM partners, MoCRA reshapes who registers what, who signs for adverse events, and how safety substantiation must be documented. This post is a public-records overview of the rules that apply as of July 2026, sourced entirely from FDA guidance documents, the MoCRA statute, and MFDS-facing K-beauty regulatory press. It is not legal advice.

The goal here is not to walk a founder through their own filing. It is to help a founder read the paper the Korean OEM sends over, understand which obligations the OEM is contractually agreeing to carry and which stay with the US brand, and cite the source when a question comes up later.

What MoCRA is, in one paragraph

MoCRA was signed into law in December 2022 as part of the Consolidated Appropriations Act, 2023. It amended Chapter VI of the Federal Food, Drug, and Cosmetic Act to give FDA new authorities over cosmetics: mandatory facility registration, mandatory product listing, safety substantiation, adverse event reporting, good manufacturing practice rulemaking, and mandatory recall. FDA published a summary landing page for MoCRA under Modernization of Cosmetics Regulation Act of 2022 (MoCRA). The most recent implementation update, covering the biennial renewal cycle that begins in 2026, was announced by FDA on February 11, 2026 via the Cosmetics Direct submission portal.

The registration and listing obligations, in the FDA's own words

FDA's landing page for Registration and Listing of Cosmetic Product Facilities and Products describes two distinct filings:

Facility registration. Cosmetic product manufacturers and processors must register their facilities with FDA, update the content within 60 days of any change, and renew the registration every two years. The 2026 biennial renewal window opens for facilities that registered during the initial 2023 to 2024 grace period.

Product listing. A responsible person must list each marketed cosmetic product with FDA, including product ingredients, and provide any updates annually.

The full Guidance for Industry: Registration and Listing of Cosmetic Product Facilities and Products defines the responsible person as the manufacturer, packer, or distributor of a cosmetic product whose name appears on the label of such cosmetic product in accordance with section 609(a) of the FD&C Act or section 4(a) of the Fair Packaging and Labeling Act.

What this means for an indie K-beauty brand sourcing from Korea: the Korean OEM is normally the manufacturer or processor and is expected to register its facility. The US brand whose name is on the label is normally the responsible person for the product listing. Either party can also register or list, so a founder should look at the paper and see who has signed for which duty. See our companion piece on what indie founders sign inside a Korean OEM contract for how the responsible-person clause typically reads.

Who counts as a small business (and who does not)

Section 612 of MoCRA carves out an exemption from facility registration, product listing, and GMP requirements for small businesses. The FDA MoCRA landing page defines a small business as an entity whose average gross annual US sales of cosmetic products for the previous three-year period is less than one million US dollars, adjusted for inflation.

Two things stand out for indie K-beauty founders reading this.

First, the exemption does not apply to safety substantiation or adverse event reporting. Those obligations survive at any brand size.

Second, the exemption does not apply if the product falls into one of the categories in section 612(b). Those categories, quoted from FDA's guidance page, include cosmetic products that regularly come into contact with the mucous membrane of the eye under customary or usual conditions of use, products that are injected, products that are intended for internal use, and products that are intended to alter appearance for more than 24 hours under customary or usual conditions of use and where removal is not part of such conditions of use.

For a K-beauty brand, the practical filter is: is the product an eye product, an injectable, a semi-permanent color, or intended to alter appearance for a full day or longer without a customary removal step. If yes, the small-business exemption does not apply regardless of revenue.

What ends up on the responsible person's desk

Reading FDA's guidance side by side with typical Korean OEM contract templates, the following list of items sit with the responsible person by default. This is a checklist, not a workflow, and every item cites its FDA source.

Product listing filing. Per section 607 of the FD&C Act as amended by MoCRA, the responsible person submits the product listing through FDA's Cosmetics Direct portal. The FDA Registration and Listing landing page hosts the current portal link and file-format documentation.

Ingredient list and safety substantiation. Section 608 of the amended Act requires the responsible person to ensure and maintain records supporting adequate substantiation of safety of the cosmetic product. FDA's landing page for Cosmetics & U.S. Law summarizes what "adequate substantiation" is expected to mean.

Adverse event reporting. Section 605 of the amended Act requires the responsible person to maintain records of adverse event reports and to submit reports of serious adverse events to FDA within 15 business days of receipt. Records are retained for six years, or three years for a qualifying small business.

Labeling. MoCRA added a requirement that the label bear a domestic address, phone number, or electronic contact information at which the responsible person can receive adverse event reports. FDA has posted labeling FAQ material on its Registration and Listing page.

Fragrance allergen disclosure. Section 609 of MoCRA directs FDA to issue a rule identifying fragrance allergens that must be disclosed on the label. Rulemaking is in progress and FDA has not yet finalized the list as of July 2026; founders should track the FDA MoCRA landing page for updates.

What sits with the Korean OEM by default

The Korean OEM is normally responsible for the following items unless the contract explicitly transfers them.

Facility registration. If the Korean OEM is the manufacturer or processor, it registers its own facility, obtains an FDA Establishment Identifier (FEI), and renews every two years. The Cosmetics Direct portal accepts registrations from foreign facilities.

Good Manufacturing Practice (GMP) compliance. Section 606 of MoCRA directs FDA to publish a proposed GMP rule and then a final rule. FDA published a proposed rule in 2025; the final rule is not yet in force as of July 2026. Until the final rule takes effect, foreign facilities that voluntarily align to ISO 22716 are cited by FDA in the current registration guidance as a reasonable interim reference. K-beauty brands should ask the OEM whether its facility is currently ISO 22716 certified.

Batch records and stability documentation. These are contractual defaults in Korean OEM paper (see the stability testing guide) but they are also the underlying evidence the responsible person will need if FDA later asks for the safety-substantiation file.

How MFDS registration in Korea maps to MoCRA in the US

MFDS (Korea's Ministry of Food and Drug Safety) is the counterpart regulator. Its English-language cosmetics regulation portal hosts the current Cosmetics Act text.

Two structural differences matter for indie K-beauty founders working with a Korean OEM.

First, in Korea, the Market Authorization Holder (MAH) is the party that intends to import, distribute, and sell cosmetic products, and that party registers with MFDS before the product enters the domestic Korean market. FDA's MoCRA responsible person concept is closely related but is scoped to the US market and to the labelholder rather than the seller-of-record.

Second, MFDS has publicly announced a phased safety-management reform. According to Korea Biomedical Review reporting on MFDS' 2026 export support platform announcement, the ministry will run pilot projects in 2026 and 2027, begin phased implementation in 2028 keyed to industry size and product characteristics, and move toward full-scale enforcement in 2031. The 2028 phase is reported to apply first to companies with annual production or import volumes exceeding KRW 1 billion. Indie K-beauty founders whose volumes sit below that threshold have several years of runway before the domestic Korean reform reaches them, but the MoCRA obligations on the US side apply as soon as the brand ships to the US.

How the biennial 2026 renewal actually works

The FDA Registration and Listing page describes the renewal mechanic. Facility registrations must be renewed every two years, biennially, in the same window in which they were first submitted. FDA's February 2026 update to the Cosmetics Direct portal describes the renewal user interface and the acknowledgement receipt process.

For a Korean OEM that first registered during the 2023 to 2024 grace period, the 2026 renewal window is the first real test of the biennial cycle. Indie K-beauty founders whose product listings depend on the OEM's active facility registration should confirm in writing that the OEM has completed the 2026 renewal and hold a copy of the acknowledgement receipt.

Fragrance allergen disclosure

Section 609 of MoCRA directs FDA to issue a rule identifying fragrance allergens that must be disclosed on the label. As of July 2026, the rulemaking is in progress and the final list of allergens has not yet been published. Two facts about the current state of the rule are worth noting.

First, the statute uses the phrase "fragrance allergen" without specifying which allergens must be included, delegating that determination to FDA rulemaking.

Second, FDA has publicly stated on its MoCRA landing page that it is considering harmonizing with international lists, which include the fragrance allergens named in EU cosmetic regulation Annex III of Regulation (EC) No 1223/2009.

The practical read for indie K-beauty founders: labels that already comply with EU CPNP fragrance allergen disclosure are likely to require only modest revision when the FDA rule finalizes. K-beauty brands that sell into the EU and use the same primary components in the US market are typically in this position already. Our EU CPNP registration guide covers what EU-side allergen labelling looks like today.

Adverse event reporting timelines and records

Section 605 of the amended Act, as reflected in the FDA Registration and Listing landing page and adjacent guidance, requires the responsible person to submit a report of a serious adverse event to FDA within 15 business days of receipt. The report goes through the FDA MedWatch pathway. The records retention period is six years, or three years for a qualifying small business.

Two operational practices sit under this requirement.

First, the responsible person needs an inbound channel that a real person monitors. The FDA MoCRA labelling requirement (mentioned above) is what creates this channel: the label must carry a domestic address, phone number, or electronic contact information for adverse event reports.

Second, the responsible person needs a retention system for the reports. Six years of paper (or three years for small businesses) means the retention system is a longer-term commitment than most first-year indie brands plan for.

Safety substantiation, without inventing a spec

Section 608 of the amended Act requires "adequate substantiation of safety" for the product. FDA has not yet published a final rule defining the specific evidence set that satisfies substantiation. The Cosmetics & U.S. Law page summarizes the statutory language and points to interim references.

In practice, K-beauty brands and their Korean OEM partners typically assemble a substantiation file from evidence that would already have been produced for the Korean market: an ingredient safety review under Korean cosmetic law, stability testing to ICH Q1A or ISO 11930, microbiological testing to ISO 17516, and any Product Information File (PIF) prepared for the EU market. The MFDS cosmetics regulation portal hosts the current Korean-side ingredient safety framework.

Founders should not sign a contract that says only "product complies with MoCRA safety substantiation." The paper needs to identify which specific documents constitute the substantiation file and which party holds the master copy.

Where MoCRA and Korean OEM contract paper touch

Reading MoCRA against the Korean OEM contract templates covered in our earlier OEM contract overview, the following clauses in the paper carry MoCRA weight and are worth re-reading through that lens.

Regulatory responsibility clause. This is the clause that names who is the FDA responsible person, who does the facility registration, who does the product listing, and who owns the adverse event workflow. If the paper is silent, the default under the FDA guidance and section 609(a) of the FD&C Act is that the labelholder is the responsible person.

Quality specification clause. References to ISO 22716, ISO 17516, and ICH Q1A are what the safety substantiation file typically pulls from. If the paper only says "manufactured to industry standards" without naming a standard, the substantiation file is thin.

Records access clause. If FDA later requests documentation to support the safety substantiation file or the adverse event report, the responsible person needs access to the OEM's batch records and QC reports within FDA's response window. The contract should give the brand the right to request and receive those records.

Change order clause. A reformulation that changes ingredients or a change of primary packaging is likely to trigger an update to the product listing under section 607. The contract should describe how the OEM communicates such changes to the brand and how quickly.

What is not yet finalized

Several parts of MoCRA are still in rulemaking as of July 2026 and are worth watching.

The GMP rule under section 606 has been proposed and not finalized. Until it finalizes, the industry reference is ISO 22716, which the current FDA guidance cites.

The fragrance allergen disclosure rule under section 609 has not been finalized. FDA has signaled harmonization with international lists is under consideration.

The talc-and-asbestos testing rule under section 3505 of the Consolidated Appropriations Act (which added the requirement to detect and identify asbestos in talc-containing cosmetic products) has been proposed and is not yet in final form.

The perfluoroalkyl and polyfluoroalkyl substances (PFAS) reporting provisions of MoCRA required FDA to submit a report to Congress in 2025 on the use and safety of PFAS in cosmetics. FDA has published preparatory materials on its MoCRA landing page; final regulatory action based on that report is not yet in place.

Indie K-beauty founders whose formulas use talc-based color cosmetics or intentional PFAS should track these rulemakings directly on the FDA MoCRA landing page.

How this reads for a founder about to sign a Korean OEM contract

The MoCRA framework does not change what a Korean OEM produces. It changes what paper the brand and the OEM must jointly produce alongside the product. When reading a 2026 Korean OEM contract, the useful test is whether the paper explicitly names a responsible person, cites a specific quality standard, describes a records-access mechanism, and identifies which party updates the FDA product listing when the formula or packaging changes.

Where the paper is silent, the default under FDA guidance places the obligation on the labelholder. That default may be workable for a brand with the internal capacity to run its own regulatory function, but it is worth naming and pricing rather than left implied.

For founders whose gross US sales are below the small-business threshold in the FD&C Act as amended by MoCRA, facility registration, product listing, and GMP compliance are relaxed, but safety substantiation and adverse event reporting are not. The paper should reflect that even a small-business brand needs a documented safety file and a monitored adverse event channel.

Where to keep reading, on FDA's own site

FDA's MoCRA landing page is updated as rules move through the rulemaking process and is the authoritative source for indie founders. The Registration and Listing page hosts the Cosmetics Direct portal, the current facility registration user guide, and the product listing user guide. The Cosmetics & U.S. Law page collects statutory citations and cross-references.

On the Korean side, the MFDS English-language cosmetics regulation portal hosts the Cosmetics Act, the ingredient safety framework, and translated notices for exporters.

For companion reading on the Korean OEM side of the same conversation, see our Korean OEM contract overview and the FDA / MOCRA / KFDA safety verification protocol.

FAQ

Does my Korean OEM need to register with FDA if I am the responsible person on the label?

Yes. Under MoCRA, facility registration is a separate obligation from product listing. If the Korean OEM is the manufacturer or processor of the cosmetic product, the OEM must register its facility with FDA and renew that registration every two years, regardless of who is the responsible person on the label. The FDA Registration and Listing page describes both obligations.

Does the small-business exemption apply to my adverse event reporting duty?

No. The FDA small-business exemption under section 612 of MoCRA covers facility registration, product listing, and good manufacturing practice requirements. Safety substantiation and adverse event reporting apply regardless of business size. Small businesses that qualify may retain adverse event records for three years instead of six.

Is ISO 22716 enough to satisfy MoCRA's GMP requirement?

As of July 2026 the final GMP rule under section 606 of MoCRA has not been published. The current FDA guidance cites ISO 22716 as a reasonable interim reference. Once FDA publishes the final rule, the industry standard may shift. Founders should track the FDA MoCRA landing page for the final rule.

What happens if my product ships to both the US and the EU?

The two frameworks operate in parallel. In the US, MoCRA governs facility registration, product listing, safety substantiation, adverse event reporting, and (eventually) GMP and fragrance allergen disclosure. In the EU, Regulation (EC) No 1223/2009 and the CPNP portal continue to apply. Fragrance allergen disclosure is already required in the EU under Annex III; the FDA rule under MoCRA section 609 has not yet finalized as of July 2026. Our EU CPNP registration guide covers the EU-side workflow.

What does MFDS require of my Korean OEM if the product is exported to the US and not sold in Korea?

Products manufactured in Korea for export only are still subject to MFDS oversight of the manufacturing facility under Korea's Cosmetics Act, but the domestic market authorization (MAH registration) that MFDS requires for products sold inside Korea does not apply to export-only products. The MFDS English portal hosts the current Cosmetics Act text.

How often does the FDA product listing need to be updated?

The FDA Registration and Listing page describes annual updates to the product listing and biennial renewal of the facility registration. Ingredient changes, brand-name changes, and other listed-data changes should be reflected in the annual update.

Working With ALTA MEET

ALTA MEET is a New York based cross-border sourcing partner for US indie K-beauty brands. We work alongside founders while they are matching to a Korean ODM or OEM, structuring the contract terms that decide the economics a year later, and running the Seoul-side oversight that makes the paper actually work.

If a MoCRA question sits between you and a Korean OEM contract on your desk right now, book a free 15-min gut-check with Liz. Fifteen minutes is usually enough to say whether the responsible-person clause is standard, overreaching, or worth a longer conversation.

For companion reading, see the Korean OEM contract overview, the FDA / MOCRA / KFDA verification protocol, and the EU CPNP registration guide.

This post is a public-records summary written for reference by indie K-beauty founders and is not legal advice. Founders should confirm specifics with FDA guidance and with qualified counsel before making regulatory filings.