MoCRA Enforcement Is Real. The 7 Triggers Putting Indie Cosmetics Brands on the FDA's Radar

On a long enough timeline, every marketer becomes their own narrator.

You're not safe because you're small. You're safe because you read the actual law. Most indie cosmetics founders never read it. Then a warning letter ships, and the founder Slack opens at 9 a.m. on cue.

The Problem: You Read The Memo And Skipped The Law

Here's the pain. Your lawyer sent a one-page memo in early 2024 about MoCRA. The bullet near the bottom read something like "small businesses with under $1 million in average annual gross sales of cosmetics are exempt." You filed it under "good news." You stopped reading.

Then last month an indie founder you follow on Instagram posted a screenshot of an FDA warning letter. The brand was small. Smaller than yours. The letter wasn't vague. It named specific cosmetic products, named specific labeling claims, and named the specific compliance gap the brand had missed. You read the screenshot twice. Your stomach dropped.

You're not stupid. You're loyal to a sentence in a memo that didn't read what you read into it. The memo wasn't wrong. Your read of it was. The carve-out under MoCRA section 612 covers three obligations. There are seven. You ran the math on three and assumed the other four came along for the ride. They don't.

The philosophical problem is the one no one on Reddit will write out. The cosmetic founder built a brand that ships the message that everything is safe and gentle and clean. So she reads her own brand and assumes the brand IS safe and gentle and clean. The FDA does not read your brand. The FDA reads your label, pulls your records, and reads the address printed on the bottom of your box.

The Guide: I Read The Whole Law

I run Paper St Marketing. I work with cosmetics founders. I read the actual MoCRA text, the new cosmetics chapter Public Law 117-328 added to the Federal Food, Drug, and Cosmetic Act in late December 2022¹. The law is short. It's also specific. Every section ships a different obligation. The small-business exemption in section 612 names exactly which sections it carves out, and it does not carve out the others.

Here's the structure. MoCRA was signed into law December 29, 2022 as part of the Consolidated Appropriations Act, fiscal year 2023¹. It added a new chapter to the FD&C Act that covers cosmetics specifically. Before MoCRA, the FDA's authority over cosmetics ran thin. After MoCRA, the FDA can pull records, file recalls, and read substantiation files. The law took roughly 80 years to write. Congress passed it in a holiday-week omnibus.

The seven triggers map to seven obligations:

1. Facility registration with FDA, every two years (FD&C Act section 607)
2. Product listing with ingredient disclosure (FD&C Act section 607)
3. Safety substantiation records (FD&C Act section 608)
4. Serious adverse event reporting within 15 business days (FD&C Act section 605)
5. Responsible Person contact info on the label (FD&C Act section 609)
6. Fragrance allergen labeling (FD&C Act section 609(d), proposed rule)
7. Good Manufacturing Practice records (FD&C Act section 606, proposed rule)

The section 612 small-business carve-out hits triggers 1, 2, and 7 for cosmetic businesses with under roughly $1 million in average annual gross sales (adjusted for inflation), and it cuts off if you ship certain higher-risk product categories: anything in contact with the eye mucous membrane, anything injected, anything intended for internal use, or anything intended to alter appearance for more than 24 hours². That leaves triggers 3, 4, 5, and 6 in force for every cosmetic seller in the country, regardless of revenue.

The failure mode here, the thing Charlie Munger would invert, is reading "small business exempt" as a blanket noun and not a footnote. Founders read "exempt" and stop reading. The four obligations that don't get carved out are the four obligations an FDA inspector can read in an afternoon by pulling a label and asking for a binder. The exemption is not a shield. It's partial credit.

The Plan: Walk All Seven Triggers

Here's the play. Run each trigger against your actual setup. The order below runs from "FDA can read this in one site visit" to "rule still pending."

1. Facility registration (section 607). If your annual cosmetic gross sales ran over $1 million across the prior 3 years, you must file your facility registration with FDA, every 2 years. Existing facilities had until July 1, 2024 to file, after FDA opened a window of enforcement discretion³. New facilities have 60 days from first manufacture to file. Why this matters: an unregistered facility reads as a strict-liability finding. The inspector doesn't argue intent. The record either ships or it doesn't.

2. Product listing (section 607). Every cosmetic product your responsible person ships must be listed with FDA: brand, product category, ingredient list. Same July 1, 2024 deadline. Same small-business carve-out. Why this matters: if a competitor or a customer files an adverse event report against your product and FDA can't pull your listing, the inquiry opens fast.

3. Safety substantiation (section 608). You must keep records that ship "adequate substantiation of safety" for every cosmetic product you sell. No specific format. No carve-out for small business². This hit live December 29, 2023. Why this matters: most indie brands keep a binder labeled "safety" filled with COAs, SDS sheets, and supplier letters. That binder isn't safety substantiation. Substantiation reads as tests or expert evaluation that show the formula doesn't cause harm under intended use. The COA reads what the supplier shipped you. It does not read whether your finished formula is safe.

4. Adverse event reporting (section 605). A "serious adverse event" must be filed with FDA within 15 business days of receipt. Records kept 6 years (3 years for small business). Hit live December 29, 2023. No revenue carve-out. Why this matters: most indie brands run no intake process for adverse event reports. A complaint email lands, a customer service person writes back, the email gets filed away. That email reads as a federal record, and it opens a 15-day clock you didn't know had started.

5. Responsible Person on label (section 609). The "responsible person" (the manufacturer, packer, or distributor whose name ships on the label) must write a domestic phone number or electronic contact for adverse event reporting. Same December 29, 2023 trigger. No revenue carve-out. Why this matters: every label printed without this contact info reads as non-compliant. The fix is a label revision. The exposure is the inventory you already shipped.

6. Fragrance allergen disclosure (section 609(d)). MoCRA required FDA to ship a proposed rule for fragrance allergen labeling by June 29, 2024. FDA missed that deadline; the Spring 2025 Unified Agenda lists the Notice of Proposed Rulemaking as expected May 2026⁴. Why this matters: the rule will name specific allergens (the EU has run a similar list, originally 26 allergens since 2003 under the 7th Amendment, recently expanded to roughly 80 under Regulation 2023/1545)⁴. Your fragrance supplier may not currently ship the breakdown you'll need. Open the supplier conversation now.

7. Good Manufacturing Practice (section 606). MoCRA required FDA to ship a proposed GMP rule by December 29, 2024 and a final rule by December 29, 2025. FDA missed both. The Spring 2025 Unified Agenda moved the rulemaking to FDA's long-term actions list, with a final rule unlikely before late 2026⁵. A small-business carve-out applies under section 612, plus a longer compliance runway when the rule lands. Why this matters: GMP records read as batch records, supplier qualifications, and deviation tracking. Most indie brands keep none of this. When the rule ships final, this will be the largest documentation lift on the list.

A note on order. Triggers 3, 4, and 5 are the three a single FDA inspector can read in one site visit, and they are the three the small-business carve-out does NOT cover. Run those first.

The Stakes: What One Warning Letter Costs

Here's what the warning letter actually ships. It's a public document. FDA posts every cosmetic warning letter on fda.gov where retailers, distributors, insurance carriers, and your competitors can read it⁶. A warning letter is not a fine. It's a notice and a public record.

The cost shows up in three other places. Your retailer reads the letter and pulls your SKU pending response. Your insurance carrier reads it and lifts your product liability premium at next renewal. A class-action plaintiff's firm reads it and files. None of those three actors waited for FDA to ship a fine. The letter itself was the trigger.

You won't pay a fine. You'll buy a phone call from your largest retailer, read a renewal letter from your insurer, and read a complaint filed in your state's federal district court.

The Call: Audit Before FDA Does

Run the seven-trigger walk this Saturday. Pull your safety binder, read it against section 608. Open your customer service inbox, read for the words "reaction," "burn," "rash." Pull your label, find your phone number. The audit ships in one weekend.

If you can't pull the records, you don't have them. That answer IS the audit. The fix runs faster than the warning letter.

Sticking feathers up your butt does not make you a chicken.