MoCRA and Your 3PL: What the Cosmetics Brand Owns vs What the Warehouse Owns

Under MoCRA, the brand named on the label owns most FDA obligations, and a 3PL that only stores and ships finished cosmetics usually does not register with FDA.

The brand’s side covers product listing, serious adverse event reporting, safety substantiation, label contact information and recalls under the Modernization of Cosmetics Regulation Act of 2022 (MoCRA). The 3PL is still the operational backbone of that compliance, because it holds the lot data and inventory you need to investigate a complaint or run a recall. For the wider picture of outsourcing beauty fulfillment, see our guide to 3PLs for cosmetics brands.

Who is the “responsible person” under MoCRA?

The responsible person is the manufacturer, packer or distributor of a cosmetic product whose name appears on the label. For most direct-to-consumer and wholesale beauty brands, that is the brand itself, even when a contract manufacturer makes the product and a 3PL ships it.

That definition is why outsourcing does not move MoCRA obligations off your desk. Your contract manufacturer and your 3PL each have roles, but FDA looks to the name on the label for listing, adverse events and recalls.

Does a cosmetics 3PL need to register with FDA under MoCRA?

Usually not, if it only stores and ships. MoCRA requires every person that owns or operates a facility that manufactures or processes cosmetic products for U.S. distribution to register that facility. FDA’s guidance on registration and listing says an establishment that solely performs labeling, relabeling, packaging, repackaging, holding or distributing is not required to register.

There is an important limit. For that exclusion, FDA says packaging and repackaging do not include filling a product container with a cosmetic. A 3PL that fills jars, bottles or tubes is doing manufacturing or processing and would need to register that facility. Kitting finished, sealed products into gift sets or subscription boxes is different from filling containers, but confirm any value-added work with your regulatory advisor.

Who owns each MoCRA requirement?

The brand owns listing, adverse event reporting, safety substantiation, labeling and recalls, while a fulfillment-only 3PL owns lot capture, holds and recall execution in the warehouse. The table below is a practical split for a brand that uses a contract manufacturer and a fulfillment-only 3PL. Your contracts should mirror it.

What does the brand own under MoCRA?

The brand owns the regulatory relationship with FDA. In practice, that covers five areas:

• Product listing. The responsible person must list each marketed cosmetic product with FDA, including ingredients, and provide updates annually. FDA’s Cosmetics Direct portal is the main electronic submission tool.
• Serious adverse events. Serious adverse events associated with use of a cosmetic in the United States must be reported to FDA within 15 business days, and new medical information received within a year must also be submitted within 15 business days.
• Records. Records related to each adverse event report must be kept for 6 years, or 3 years for qualifying small businesses, and made available to FDA during inspections.
• Safety substantiation. Brands must ensure and keep records supporting adequate safety substantiation for each product.
• Labeling. Since December 29, 2024, each cosmetic label must include a domestic address, domestic phone number or electronic contact information, which may include a website, through which the responsible person can receive adverse event reports. MoCRA also requires fragrance allergen disclosure, with the allergens to be set by FDA regulation.

MoCRA’s small business exemption covers registration and listing for companies with average U.S. cosmetic sales under $1 million over the previous three years, adjusted for inflation, but not for certain higher-risk products such as those that contact the eye’s mucous membrane, are injected, are for internal use, or alter appearance for more than 24 hours. Adverse event reporting applies regardless.

What does the warehouse own?

A fulfillment-only 3PL does not file anything with FDA for your products, but it owns the operational data and controls that make your filings and recalls possible:

• Lot and batch capture. Record lot numbers and expiration dates at receiving and on every outbound order. Our guide to batch tracking covers how that data is captured.
• Expiration management. Pick by expiration date where products are dated, and enforce any minimum shelf-life rules you set by channel.
• Complaint and return routing. Pass reaction-related returns or notes to your team quickly, since your 15-business-day clock starts when you receive the information.
• Quarantine and holds. Freeze a lot in the warehouse system within hours, so it cannot ship to customers, marketplaces or retailers.
• Recall execution. Produce a list of every order and customer that received the affected lot, then process returned units and disposal under your instructions.
• Label integrity. Do not over-label, relabel or repack in ways that obscure required label information unless you have approved it.

Innovative Warehouse Solutions (IWS) fulfills health and beauty orders from Farmingdale, Long Island, New York. IWS publishes a 99.98% order accuracy rate on its homepage, and its food logistics page describes lot and batch traceability for quality control and recall management, the same capability cosmetics brands need for lot-level recalls.

How do recalls work for cosmetics under MoCRA?

MoCRA gave FDA mandatory recall authority for cosmetics. If FDA determines there is a reasonable probability that a cosmetic is adulterated or misbranded and that use or exposure will cause serious adverse health consequences or death, it first gives the responsible person an opportunity to voluntarily stop distribution and recall the product. If the company does not act, FDA can order it to cease distribution, and the order can be amended to require a recall.

The speed of your response depends on your warehouse. If your 3PL can stop shipments of a specific lot and produce a customer list the same day, you can act within whatever timeframe FDA sets. If lot numbers were never captured, you may have to treat every unit as affected.

What about cosmetic GMP rules?

MoCRA directs FDA to establish good manufacturing practice regulations for cosmetic manufacturing facilities, but FDA’s MoCRA page shows that work is still in development. When final, GMP rules are expected to apply to facilities that manufacture or process cosmetics, so watch for whether storage and distribution practices are addressed.

What should you ask a cosmetics 3PL?

Ask how the 3PL captures lots, places holds and routes reaction-related returns, because those three controls decide how fast you can act on a complaint.

• Do you capture lot and expiration at receiving and on every outbound order?
• Can you place a lot on hold across all channels in one step?
• How quickly can you produce a customer list for a specific lot?
• How do you flag returns that mention a reaction or injury?
• Do you fill or repackage product, or only kit and ship sealed units?
• Can you meet marketplace and retailer shelf-life rules for dated products?

Frequently asked questions

Does my 3PL need to be “MoCRA compliant”?

MoCRA’s main duties fall on the responsible person and on facilities that manufacture or process cosmetics. A fulfillment-only 3PL is generally not required to register, but it should support your lot tracking, complaint routing and recall needs.

Who reports adverse events, the brand or the 3PL?

The responsible person, which is usually the brand named on the label. The 3PL’s job is to pass relevant complaints and returns to you fast.

How often do cosmetic facility registrations and product listings renew?

Facility registrations renew every two years from the initial registration date. Product listings must be updated annually.

Does kitting cosmetics into gift sets trigger registration?

FDA’s guidance excludes establishments that solely label, relabel, package, repackage, hold or distribute, but packaging and repackaging do not include filling a container with cosmetic product. Kitting sealed units is not filling, but confirm your specific process with an advisor.

What label change did MoCRA require?

Labels must include a U.S. address, U.S. phone number or electronic contact, such as a website, for adverse event reports. That requirement took effect December 29, 2024.

Shipping skincare, cosmetics or personal care? IWS fulfills health and beauty orders from Farmingdale, NY, with lot tracking, same-day shipping on orders in by 11 AM EST and no receiving or onboarding fees. Request a quote.