For two years the question on every beauty operations call has been some version of "is the FDA actually going to enforce MoCRA?" Through the back half of 2025 and the first quarter of 2026, the answer became clear. The grace period is over. The agency is enforcing.
Three signals tell the story.
In December 2025, the FDA issued a warning letter to Private Label Skin Care, Inc. The letter was the first significant MoCRA-cited cosmetics enforcement action and named CGMP violations specifically. It was not subtle. It set the tone for 2026. (Source: cosmeticsandtoiletries.com)
On 11 February 2026, the FDA updated its Cosmetics Direct portal with mandatory renewal tracking. Registrations have to be renewed every two years, and the portal now displays the status in real time. The agency does not need to chase brands; the data is on screen. Brands that registered in February 2024 are now in the renewal window. (Source: inmykit.com)
Through April 2026, US Customs has been seizing shipments where the FDA registration cannot be verified at the port of entry. Border seizures are not a softly-softly enforcement. They cost the brand the freight, the inventory, and the launch window. Several indie founders have shared the experience publicly in the last fortnight; the brands cited a mix of expired registration, missing product listing, and product listing not matching label declarations.
Add the proposed fragrance allergen rule, expected to publish in May 2026, and the picture sharpens further. The draft rule will require brands to disclose specific allergens on label rather than hiding behind generic "fragrance" - and the rumour from regulatory consultants is that the US version will be stricter than the EU's eighty-allergen list. Brands relying on contract fragrance suppliers without IFRA certificates have a problem they may not yet realise.
Here is the operational checklist any US-bound beauty brand should run this quarter.
1. Confirm your facility registration is current
If your facility was registered in February 2024, the renewal window is now. Renewal is mandatory; missing it gives US Customs grounds to detain a shipment. Most indie brands rely on a contract manufacturer's facility registration. That means you need to confirm with your manufacturer that their registration is current and that your products are listed under it. Do not assume. Get the registration number on file in writing.
2. Verify product listing matches label
The FDA's product listing data has to match the label artwork shipping in the box. INCI declaration, product type, manufacturer name, responsible person address. Mismatches between the listing and the label have been showing up in border seizures. Walk through every SKU.
3. Stand up adverse event reporting
Serious adverse events have to be reported to the FDA within fifteen business days of the brand becoming aware. Records have to be kept for six years. "Reply to the customer service email" is not a system. You need a formal complaint intake, a triage rule for serious versus non-serious, and a documented escalation path. Most indie brands do not have one. The fix is procedural, not expensive.
4. Pull fragrance allergen data from your suppliers now
The fragrance allergen rule is expected this month. Brands that ask their fragrance compound supplier today for the full IFRA certificate and allergen breakdown will be ahead. Brands that wait until the rule publishes will be reformulating labels under deadline pressure. Many fragrance suppliers will not give you the breakdown unless you ask explicitly. Ask explicitly. If they cannot provide it, find one who can or be prepared to disclose conservatively.
5. Document safety substantiation per SKU
MoCRA requires safety substantiation. The FDA does not provide a template. The brand has to build its own procedure. The minimum is a folder per SKU containing the toxicological profile of every ingredient at its in-product concentration, a finished-product stability report, and any adverse event records. Treat this as a living record updated post-launch, not a one-time document.
6. Align to ISO 22716, even if cGMP rules are delayed
The cGMP final rule has slipped to the FDA's "long-term actions" list. Do not read that as a reprieve. Warning letters are using ISO 22716 as the de facto standard the agency expects facilities to operate to. If your contract manufacturer cannot produce an ISO 22716 certificate, you are exposed.
What founders are missing
The pattern across the last four months of conversations is consistent. Indie brands treat MoCRA as a one-time admin task. They register, file the listing, move on. They do not stand up renewal calendars, adverse event intake, allergen data files, or substantiation folders. The result is that compliance is a snapshot from launch, not a system.
The FDA's enforcement posture in 2026 is not about catching launches. It is about catching brands that registered, then did nothing for two years.
Where this puts beauty brands strategically
There is a second-order effect founders are missing. Sephora's vendor onboarding now includes compliance checks. Cult Beauty and Space NK are following. The brands that have MoCRA locked are using it as a retailer conversation, not a cost centre. "Here is our facility registration, here is our renewal calendar, here is our adverse event log, here is our substantiation file" is a competitive moat now, not paperwork.
If you sell into the United States and you are not sure where your brand sits on this checklist, run the Recall Readiness Quick Check or speak to us about LaunchOS compliance setup. The fix is procedural. The cost of getting it wrong - delayed launch, retailer rejection, ASA fine, border seizure - compounds quickly.
This post is not legal advice. For binding regulatory guidance, speak to a qualified responsible person or cosmetics compliance consultant.