MoCRA Compliance for Lash Brands: A Plain-English Guide
MoCRA — the Modernization of Cosmetics Regulation Act of 2022 — makes your lash brand a "Responsible Person" under FDA law. In practice, since the 2023–2024 rollout you must register the manufacturing facility with FDA, list every product (including your lash adhesive), keep safety substantiation on file, and report any serious adverse event within 15 business days. Facility registration renews every 2 years, so many brands hit their first renewal in 2026. Critically, the small-business exemption does not apply to eye-area products — so even a tiny lash brand still has to list. The single biggest lever is choosing an FDA-listed manufacturer that hands you INCI, an English SDS, per-lot CoA and safety data, because that documentation is what MoCRA actually runs on.
If you sell lash extensions or adhesive in the United States, MoCRA isn't optional and it isn't only for big brands. Here's what it requires, who is responsible for what, and how to make it manageable — written for brand owners and buyers, not lawyers.
What is MoCRA, and does it apply to my lash brand?
MoCRA is the biggest expansion of FDA authority over cosmetics in decades. It was signed into law in December 2022, and its core obligations phased in through 2023 and 2024. A "cosmetic" under US law includes anything applied to the body to beautify or alter appearance — which squarely covers lash extensions, lash adhesive, primers, and cleansers.
If your name is on the label of a lash product sold in US interstate commerce, MoCRA applies to you as the Responsible Person, whether you manufacture in-house or private-label from an overseas factory. Importing from Korea or China does not move the obligation off you; it means you rely on your manufacturer for the underlying data. (Wondering about the related question — do you need FDA approval to sell lashes? Short version: no approval, but yes to these duties.)
Who is the "Responsible Person" — the factory or the brand?
This trips up a lot of new founders. The Responsible Person is the manufacturer, packer, or distributor whose name appears on the product label. If you build a private-label brand, that's you — not the factory. The Responsible Person carries product listing, safety substantiation, and adverse-event reporting.
The manufacturing facility, meanwhile, must be registered with FDA (your contract manufacturer usually handles its own facility registration). So the duties are split: the factory registers its facility; you, the brand, list the products and hold the safety file. You need a manufacturer that already carries its side — an FDA-listed private-label supplier — and that will give you the documents for yours.
What do I actually have to do?
Here's the practical checklist, and who owns each item.
| Requirement | Timing | Who does it |
|---|---|---|
| Facility registration | Renews every 2 years; new facilities within 60 days of operating | Manufacturer (the factory) |
| Product listing (per product) | New products within 120 days of marketing; updated annually | You (Responsible Person) |
| Safety substantiation | On file before & while marketed | You, using manufacturer's data |
| Serious adverse-event reporting | Within 15 business days of report | You (Responsible Person) |
| Adverse-event records | Kept 6 years (3 for small businesses) | You |
| Compliant label & contact | Ongoing | You |
| Good Manufacturing Practice (GMP) | Rule still being finalized in 2026 | Manufacturer (prepare now) |
Note two things still in motion as of 2026: FDA's cosmetic GMP regulation has not been finalized, and the fragrance-allergen labeling rule remains future rulemaking rather than a fixed compliance date. Both are coming, so a manufacturer already working to GMP-style controls saves you a scramble later.
The paperwork MoCRA needs, ready on day one
magal is an FDA-listed Korean lash-adhesive manufacturer built for brands that have to answer to regulators. Every order comes with INCI, an English SDS, per-lot CoA, and safety data (3rd-party clinical patch test passed, low-formaldehyde 0.0279% / 72.5% lower, NMP-free, hypoallergenic) — plus MoCRA support. MOQ 1,000 mixable across SKUs, samples in 7 days.
Request samples & docsDoes the small-business exemption cover a small lash brand?
Almost certainly not — and this is the point most guides bury. MoCRA does offer a small-business exemption from facility registration and product listing for companies under a set average annual gross sales threshold. But the exemption explicitly excludes higher-risk products, including those that come into contact with the eye.
Lash adhesive and lash extensions are applied at the eye. That puts them in the carve-out, so a lash brand generally cannot rely on the small-business exemption to skip listing — no matter how small your revenue. In other words, "we're too small for FDA" is not a plan for a lash brand. Budget for compliance from your first product, not your hundredth.
What documents do I need from my manufacturer?
You can't substantiate safety or answer FDA from marketing claims. You need the underlying technical file, and a serious manufacturer provides it without being chased. Ask for, and keep on file:
- INCI ingredient list — exact, in standard nomenclature, for your label and listing.
- English SDS (Safety Data Sheet) — hazard and handling data for the adhesive.
- Per-lot Certificate of Analysis (CoA) — so each batch is traceable.
- Safety / irritation testing — e.g. a 3rd-party clinical patch test and formaldehyde test numbers, to support substantiation.
- FDA facility listing confirmation — evidence the factory is registered.
These are professional documents that your manufacturer holds and interprets — not something a consumer would read. If you're vetting suppliers on exactly this, our guide to the safety papers behind a safe adhesive and the broader how to start a lash glue brand walkthrough go deeper.
MoCRA readiness — a quick brand checklist
- Is my manufacturer's facility FDA-registered (and current on its 2-year renewal)?
- Have I listed each of my products with FDA, and set a calendar reminder to update annually?
- Do I hold INCI, SDS, per-lot CoA and safety data for every SKU?
- Do I have a written process to log and report a serious adverse event within 15 business days?
- Am I keeping adverse-event records for 6 years (3 if I qualify as a small business)?
What happens if I skip it?
Non-compliant cosmetics can be treated as adulterated or misbranded, which opens the door to FDA enforcement, and imported products that don't meet requirements can be refused entry at the border — a real risk when you're bringing adhesive in from overseas. Beyond the legal exposure, retailers and marketplaces increasingly ask for this documentation before they'll stock you. Treating MoCRA as a growth enabler — proof you're a legitimate, shelf-ready brand — is a healthier framing than treating it as a tax.
Launch your lash line with a manufacturer regulators recognize
magal produces fast-cure lash adhesive (0.5–2s cure, 5–7 week retention) in a Daegu, South Korea facility: FDA-listed, cleanroom, in-house QC, with a USPTO patent and a Taiwan Innotech Expo Bronze Medal. Full MoCRA-ready documentation — INCI, English SDS, per-lot CoA, clinical patch-test and formaldehyde data — MOQ 1,000 mixable across SKUs, and samples in 7 days.
Request samplesFrequently asked questions
Does MoCRA apply to a small or new lash brand?
Yes. If your name is on the label of a lash product sold in the US, you're the Responsible Person. And because lash products contact the eye, the small-business exemption from registration and listing generally does not apply — so even a small brand must list its products with FDA.
Is the factory or the brand the "Responsible Person"?
The Responsible Person is whoever's name is on the label — usually the brand, not the contract factory. The brand owns product listing, safety substantiation and adverse-event reporting; the manufacturer registers its facility and supplies the technical data you rely on.
How fast do I have to report an adverse event?
A serious adverse event must be reported to FDA within 15 business days of receiving the report, with follow-up information also due within 15 business days if it arrives within a year. Keep adverse-event records for 6 years (3 years for small businesses).
What MoCRA documents should I get from a lash adhesive supplier?
At minimum: INCI ingredient list, an English SDS, per-lot Certificate of Analysis, safety/irritation testing (such as a clinical patch test and formaldehyde numbers), and confirmation the manufacturing facility is FDA-registered. These support your listing and safety substantiation.
Are cosmetic GMP rules in force yet?
As of 2026 FDA's cosmetic Good Manufacturing Practice regulation is still being finalized, and the fragrance-allergen labeling requirement remains future rulemaking. Both are expected, so working with a manufacturer that already follows GMP-style controls prepares you ahead of time.