US MoCRA Preservative Compliance: The 2026 Guide for Cosmetic Brands and Contract Manufacturers

A USD 24,000 Long Beach port hold, one lapsed facility registration

In Q3 2026 a mid-sized US cosmetic brand received a port hold notice 48 hours after a 1,200 kg phenoxyethanol shipment arrived at the Port of Long Beach. The cause was not the preservative. The Chinese contract manufacturer that produced the finished product carried by that container had let its FDA cosmetic facility registration lapse 11 days earlier — the FY2025-2026 biennial renewal window had closed December 31, 2025, and the registration was marked inactive in the FDA Industry Systems database.

The shipment was held under section 801(a) of the Federal Food, Drug, and Cosmetic Act as appearing to be from an unregistered foreign facility. The brand's compliance team spent four business days verifying the US agent of record, re-filing the registration, obtaining a new registration number, and submitting a reconditioning request to CBP and FDA. The container cleared on day 18.

Direct costs: USD 11,400 in demurrage and detention; USD 3,200 in rush customs brokerage and FDA refiling fees; USD 6,800 in retailer-contracted on-time delivery penalties; USD 2,600 in internal compliance team time. Total: USD 24,000 for a renewal filing that would have taken ten minutes and zero dollars had it been done on schedule.

This article is the US compliance playbook that would have caught the lapse at the annual supplier audit — covering what MoCRA actually requires, how facility registration and product listing work, the safety substantiation standard, the SAE 15-business-day clock, FDA inspection expectations, state-level overlays, and the change-management SOP that keeps subsequent batches defensible.

What MoCRA actually requires (and how it differs from EU Annex V)

The Modernization of Cosmetics Regulation Act of 2022 (MoCRA), enacted December 29, 2022, is the first substantive federal update to US cosmetic regulation since the FD&C Act of 1938. It operates through five pillars, each with its own compliance deadline and enforcement mechanism under FDA's Office of Cosmetics and Colors (OCC).

• Facility registration (FD&C §607) — domestic and foreign facilities manufacturing or processing cosmetic products for US distribution must register with FDA, biennially renewed. Small-business exemption applies with carve-outs.
• Cosmetic product listing (FD&C §607) — the responsible person files a listing for each product marketed in the US, including ingredient list with concentration ranges for substances of concern. Updated annually.
• Safety substantiation (FD&C §608) — adequate evidence of safety must be maintained for each product. "Adequate" is defined as "tests or studies, research, analyses, or other evidence or information that is considered, among experts qualified by scientific training and experience to evaluate the safety of cosmetic products and their ingredients, sufficient to support a reasonable certainty that a cosmetic product is safe." For preservation, this typically means Challenge Test under ISO 11930 or USP <51> plus stability study plus toxicological assessment.
• Serious adverse event reporting (FD&C §605) — the responsible person must report SAEs to FDA within 15 business days, with records retained 6 years (6 years past majority for minors).
• Good manufacturing practices (FD&C §606) — FDA is directed to promulgate GMP regulations; proposed rule issued 2026, final rule expected 2027. In the interim ISO 22716 is the de facto industry standard FDA cosmetic inspectors reference.

The practical consequence for preservative compliance is a shift in evidentiary burden relative to EU Annex V. In the EU, a formulator consults the 59-entry Annex V list, selects a permitted preservative, formulates below the stated cap, and the regulatory framework assumes efficacy and safety for that use. In the US under MoCRA, no such positive list exists for preservatives. The responsible person bears the full burden of demonstrating that whatever preservation system was chosen is both safe at the use concentration and adequate to prevent microbial contamination — documented in the safety substantiation record, verifiable at FDA inspection, and consistent across batches per CoA.

The sister article to this one, our EU Annex V preservative compliance guide, covers the EU side in equivalent depth. Multi-market brands typically maintain a consolidated master dossier that satisfies both systems with a single evidence base and two notification filings.

Facility registration — the FY2025-2026 renewal mechanics

Section 607(a) of the FD&C Act requires every owner or operator of a facility that manufactures or processes cosmetic products for distribution in the United States to register with FDA. "Facility" includes domestic and foreign facilities; "processing" includes packaging, labeling, and blending. Pure holding, warehousing, or trucking operations are not facilities for MoCRA purposes.

Who must register

The owner or operator of each facility registers once per facility, regardless of how many products or responsible persons the facility manufactures for. Contract manufacturers register themselves; the brands they manufacture for do not register the facility on the manufacturer's behalf. A single facility manufacturing products for ten different brands files one facility registration.

Foreign facilities and the US agent requirement

Foreign facilities must designate a US agent with a physical US address, a telephone number answered during US business hours, and an email address. The US agent receives FDA communications on the facility's behalf and must be able to arrange a facility inspection if FDA requests one. Common US agent arrangements: the brand owner's regulatory consultant, a third-party US agent service, or the US-based parent of a foreign subsidiary. The US agent plays no role in product listing or SAE reporting.

Biennial renewal and the FY2025-2026 window

Facility registration renews every two years, with the renewal window closing December 31 of even-numbered years. The FY2025-2026 renewal window closed December 31, 2026. A lapsed registration marks the facility inactive in the FDA Industry Systems database and triggers import refusal for incoming shipments produced at that facility under section 801(a). Reinstatement requires a new registration submission; there is no grace period and no automatic renewal.

Small-business exemption with carve-outs

A "small business" for MoCRA purposes is a responsible person or owner/operator whose average gross US cosmetic sales for the previous 3-year period is less than USD 1,000,000 (adjusted for inflation). Small businesses are exempt from facility registration and product listing. The exemption does NOT apply to facilities manufacturing products that (a) regularly contact mucous membrane of the eye under customary use, (b) are injected, (c) are intended for internal use, or (d) are intended to alter appearance for more than 24 hours and are not removed by the consumer. Preservative-containing leave-on eye-area products, long-wear color cosmetics, and certain lip products therefore trigger full registration even below the USD 1M threshold.

New facility 60-day window

A new facility must register within 60 calendar days of first manufacturing or processing a cosmetic product for US distribution. The 60-day clock starts on the first day of production for distribution, not on the facility's construction completion or regulatory intent date. An ownership transition (acquisition, divestiture, change in owner/operator) does not restart the 60-day clock but does require an update to the registration record within 60 days.

Cosmetic product listing — preservative-specific declaration fields

Section 607(c) requires the responsible person to submit a cosmetic product listing to FDA for each product marketed in the US. The listing is filed through the FDA Industry Systems Cosmetic Direct portal and carries specific ingredient disclosure fields that surface preservative compliance signal to FDA reviewers.

• Product name and category — the label-stated product name and the FDA cosmetic product category (leave-on skincare, rinse-off cleanser, color cosmetic, etc.). Category determines the SAE risk weighting and the applicability of small-business carve-outs.
• Responsible person — the manufacturer, packer, or distributor whose name appears on the product label per section 609. This is the entity on the hook for all five MoCRA pillars.
• Facility registration numbers — the FDA registration number for each facility that manufactures the product. Listing a facility not currently registered is flagged automatically; listing a facility whose registration has lapsed between the listing filing and FDA review is flagged on the next listing update.
• Ingredient list — complete list of ingredients in descending order by weight per 21 CFR 701.3, including each preservative identified by INCI name. For substances of concern, concentration range disclosure is required.
• Preservative concentration range — for preservatives above FDA substance-of-concern thresholds, the concentration range at use (not maximum theoretical). The declared range must bracket the actual use level; a product formulated at 0.85% phenoxyethanol with a declared range of 0.5-1.0% is compliant; a declared range of 0.1-0.5% is a listing misrepresentation.
• Fragrance allergen disclosure — fragrance allergens above 0.01% (leave-on) or 0.1% (rinse-off) must be individually disclosed on the label and listed.

Listing updates are required within 60 days of any material change: new or discontinued product, formulation change affecting preservative identity or concentration range, facility change, responsible person change, or label category change. Annual listing confirmation is required regardless — the listing must be refreshed or confirmed each year by the responsible person, with the annual deadline tied to the original listing date.

Safety substantiation — the defining difference from EU

Section 608 of the FD&C Act requires the responsible person to ensure that there is adequate substantiation of safety for each cosmetic product marketed in the US. For preservation specifically, "adequate substantiation" is a four-layer evidence stack: preservative efficacy (Challenge Test), product stability (preservative concentration holds over shelf life), toxicological assessment (ingredient-level safety profile), and labeling accuracy (no misleading claims).

The builder below generates the evidence stack FDA cosmetic inspectors expect for a given product type and market scope. Select the product and the inspector will see which specific records must be available at inspection.

The practical operating standard FDA inspectors apply is that each layer must be current (within 24 months for Challenge Test and stability, within 60 months for toxicological assessment absent a formulation change), traceable (sample retained, method cited, qualified individual signed off), and reproducible (another qualified individual, given the same sample and method, would reach the same conclusion). A substantiation record that passes all three tests clears the section 608 threshold even absent a positive-list cap for the preservative.

SAE reporting — the 15-business-day clock

Section 605 requires the responsible person to submit a serious adverse event report to FDA within 15 business days of receiving information about the event, and to maintain records of all adverse events (serious and non-serious) for 6 years (6 years past majority for events involving minors). The 15-day clock is strict; FDA has issued warning letters for late SAE reports in 2024-2026 inspection cycles.

What counts as a serious adverse event

A "serious adverse event" per section 603(5) is an adverse event that results in: death; a life-threatening experience; inpatient hospitalization; a persistent or significant disability or incapacity; a congenital anomaly or birth defect; an infection that requires medical or surgical intervention to prevent one of the above; or a decision based on reasonable medical judgment to intervene to prevent one of the above. For preservative-related events the typical triggers are microbial contamination incidents causing hospital-treated infection (Pseudomonas, Burkholderia, mould systemic infection) and severe allergic contact dermatitis requiring hospitalization.

Filing mechanism and recordkeeping

SAE reports are filed through FDA MedWatch (form 3500A) with the cosmetic product category selected. The report includes product identification, batch number, event description, outcome, and the responsible person's contact information. Supporting records (consumer complaint intake, medical documentation if provided, internal investigation notes, laboratory analysis of retained product) must be maintained for the full 6-year window and surrendered to FDA on request. A preservative-linked SAE cluster to a specific product or facility typically triggers facility inspection within 30-60 days.

MoCRA compliance checklist — role & product scope

The checklist below filters by your role in the cosmetic supply chain (manufacturer, responsible person, importer, distributor, brand owner) and by product scope (single product line, multi-SKU brand, contract manufacturing) to show the specific MoCRA action items with FDA deadlines.

FDA inspection — what preservative suppliers and buyers must expect

FDA cosmetic inspections under MoCRA follow a risk-based prioritization: eye-area products, mucous-membrane contact products, long-wear products, injectable or internal products, and products with recent SAE clusters receive first-tier scheduling. The inspection scope for a registered facility typically includes the following records, each of which must be available for FDA review within 15 business days of request.

• Facility registration currency — confirm active registration number, correct US agent (foreign facilities), correct owner/operator.
• Product listing accuracy — every product being manufactured matches an active product listing; ingredient list reflects current formulation; preservative concentration range brackets the use level; facility registration number on the listing matches the facility being inspected.
• Safety substantiation records — Challenge Test, stability, and toxicological assessment for each product; qualified individual sign-off on file.
• SAE recordkeeping — consumer complaint log, SAE report correspondence, 6-year retention evidence.
• Batch records and CoA archive — batch-level production records cross-referenced to preservative lot numbers; supplier CoA archive matching each lot used.
• Change-control records — any supplier change, process change, or facility change in the inspection window documented with change notice, impact assessment, re-test evidence where applicable, and updated product listing or registration where required.
• Labeling accuracy — label matches listing, ingredient disclosure complete and in correct declining weight order, warning statements present where required.

The single most common inspection finding across the 2024-2026 enforcement cycle is a supplier change not reflected in the responsible person's change-control record. The preservative manufacturer shifted from plant A to plant B of the same owner, the CoA header updated, but the responsible person's PIF-equivalent record did not. Our Preservative CoA batch consistency playbook covers the 60-day change-notification clause language that catches this at RFQ stage.

State-level overlays — California, Washington, New York

MoCRA preempts state regulations that are "different from or in addition to" its requirements only for a defined scope (section 614). State requirements outside that scope — ingredient prohibitions, disclosure, reporting, labeling — remain in force. Three state frameworks materially affect preservative compliance for products sold in their jurisdictions.

California — Safe Cosmetics Act and Prop 65

The California Safe Cosmetics Act (Cosmetic Fragrance and Flavor Ingredient Right to Know Act, 2020 amendment) requires manufacturers selling cosmetics in California to report to the California Safe Cosmetics Program any product containing an ingredient on the Designated List of chemicals known or suspected to cause cancer, birth defects or reproductive harm. Several preservatives (formaldehyde releasers above certain free formaldehyde thresholds, certain parabens under reproductive review) appear on the Designated List. Separately, Proposition 65 requires warning labels for products causing exposure above the safe harbor level for listed chemicals; 1,4-dioxane (residual impurity in ethoxylated surfactants and sometimes in phenoxyethanol below spec) is a Prop 65 listed chemical with a stringent no-significant-risk level that affects some preservation systems indirectly.

Washington — Toxic-Free Cosmetics Act

The Washington Toxic-Free Cosmetics Act (2023, enforcement from January 1, 2025 for some substances, January 1, 2026 for others) prohibits the manufacture, sale and distribution in Washington of cosmetic products containing specified intentionally added ingredients, including formaldehyde and formaldehyde-releasing preservatives above defined thresholds, certain parabens, and per- and polyfluoroalkyl substances (PFAS). Products containing DMDM Hydantoin, Imidazolidinyl Urea, Diazolidinyl Urea or Quaternium-15 above the Washington thresholds cannot be sold in Washington regardless of federal MoCRA compliance.

New York — 1,4-Dioxane cap

New York State enforces a 1 ppm cap on 1,4-dioxane in cosmetic products (effective December 31, 2022, tightened from the original 2 ppm). The cap applies to the finished product. Products preserved with phenoxyethanol from certain Chinese sources carrying residual 1,4-dioxane above 10 ppm at raw-material level can fail the finished-product cap even at 1% use concentration. The New York cap is one of the strongest arguments for ICP-MS-level supplier CoA auditing of 1,4-dioxane in phenoxyethanol.

Change-management SOP — the US version of the 60-day clause

EU Annex V compliance relies on a 60-day supplier change-notification SOP tied to Article 5 of Regulation 1223/2009. MoCRA has no explicit 60-day clock for supplier change, but the combination of (a) product listing requirement to re-list within 60 days of a material change, (b) safety substantiation requirement to maintain adequate records, and (c) FDA inspection authority to request change-control documentation produces a de facto equivalent discipline.

Three supplier-side changes that trigger CPL re-listing:

1. Change of preservative ingredient identity — any INCI name change, any CAS number change, any substitution.
2. Change in declared concentration range such that the current range no longer brackets the use level.
3. Change of manufacturing facility — new facility registration number on the product must be reflected in the listing.

Five supplier-side changes that do NOT trigger CPL re-listing but DO require change-control documentation plus typically a Challenge Test re-run:

1. Change of production site within the same supplier organization and same CAS.
2. Change of raw material feedstock (e.g. phenol source for phenoxyethanol synthesis) that may shift residual-impurity profile.
3. Change of synthesis route or purification method with no ingredient-identity change.
4. Change of CoA analytical method for a key field (e.g. HPLC vs GC for assay).
5. Change of purity grade (cosmetic-grade to pharma-grade or vice versa) with no ingredient-identity change.

The practical SOP: supplier notifies within 60 days of change effective date, responsible person logs in change-control register within 10 working days, decides within 20 working days whether CPL re-listing is required and whether Challenge Test re-run is required, executes within the window before the first batch of changed material enters finished-product production for US distribution.

US MoCRA vs EU Annex V — multi-market compliance delta

Multi-market brands that distribute into both the US and EU carry a consolidated compliance stack that satisfies both regimes with a single evidence base. The following delta table identifies the structural differences that must be managed in parallel — one framework does not substitute for the other.

The practical consequence: a product fully compliant under EU Annex V with a complete CPSR will almost always clear MoCRA safety substantiation with one additional step — the US product listing filing with FDA registration number for the manufacturing facility. A product designed for US-only distribution with only MoCRA records in place will fail EU CPNP notification without substantive additional work on the CPSR, the Annex V cap compliance, and the member-state notification mechanics.