Private Label Brands and Who Owns MoCRA Compliance

A brand owner emailed us recently with a version of a question we hear constantly: "My manufacturer already registers their facility with the FDA. Does that cover me too?" Short answer, almost always no. Let's walk through why, using a typical private label setup.

The scenario

Picture a small skincare brand, let's call it a lotion sold under a boutique name. The brand doesn't manufacture anything itself. It takes a stock formula from a contract manufacturer, has its own label printed and applied, and sells the finished product under its own brand name, its own website, its own retail relationships. The manufacturer makes the same base formula for several other brands too, just relabeled each time.

Who's responsible for MoCRA compliance here, the manufacturer or the brand?

MoCRA's core requirements, quickly

MoCRA, the Modernization of Cosmetics Regulation Act from 2022, requires facility registration and product listing with the FDA, a named responsible person for each product, safety substantiation on file, and adverse event recordkeeping. Some small businesses are exempt from the registration and listing pieces, but the responsible person requirement and the underlying safety obligations don't disappear just because a business is small.

The manufacturer's registration covers the facility, not the brand

Here's the part that surprises private label brands: the contract manufacturer registering their facility with the FDA is about the physical place where cosmetics are made. It doesn't automatically make the manufacturer the responsible person for every brand's product coming out of that facility. The responsible person is generally the manufacturer, packer, or distributor whose name appears on the label, and for a private label arrangement, that's usually the brand, because it's the brand's name on the package, not the contract manufacturer's.

In other words, the boutique brand in our example is very likely the responsible person for its own product, even though it never touched a mixing vat. That means the brand, not the manufacturer, carries the obligation for safety substantiation and adverse event recordkeeping tied to that specific listing, unless the contract explicitly assigns those duties elsewhere and the FDA's requirements are still satisfied by whoever is actually named.

What this means in practice for a private label brand

• Confirm in writing with your contract manufacturer exactly what they register and what they don't. Facility registration is theirs to handle if they're the manufacturing site. Product listing tied to your specific label is generally yours.
• Get safety substantiation documentation from the manufacturer for the base formula, and keep it on file under your own responsible person records, not just trust that it exists somewhere upstream.
• Set up your own adverse event intake, even if it's simple, an email address and a log, because as the responsible person you're the one who needs to track and, when required, report serious adverse events.
• Don't assume "small business" exemptions apply to you without checking. The exemption thresholds relate to registration and listing obligations specifically, and even exempt businesses still need a responsible person and still need safety substantiation on hand.

A quick reference for the roles

Party	Typically responsible for
Contract manufacturer	Facility registration for the physical site
Brand (private label owner)	Product listing under its own label, responsible person duties, safety substantiation on file, adverse event recordkeeping
Both, by contract	Can be split by agreement, but the FDA still needs a clearly named responsible person regardless of internal contract terms

Where this gets genuinely messy

Private label arrangements sometimes involve a middle layer, a distributor who sources from the manufacturer and sells to multiple retail brands, each with their own label. Every layer in that chain should have a clear, written understanding of who is the responsible person for each specific labeled product, because the FDA doesn't care about your internal supply chain structure, it cares about the name on the package in front of a consumer.

If you're a small brand relying entirely on a manufacturer's assurances that "compliance is handled," ask specifically: handled by whom, under whose name, for which listing? Get the answer in writing.

One more wrinkle worth knowing

Sunscreen products are regulated as an OTC drug in the US, not a cosmetic, so if your private label lineup includes an SPF product alongside your lotions, that item sits under a different regulatory framework entirely, with its own manufacturing and labeling requirements. Don't assume MoCRA's cosmetic pathway covers it.

Cosmetic Comply's current focus is Canada's notification system, with US MoCRA support on the way, but the underlying discipline is the same wherever you sell: know exactly who is named as responsible, keep your ingredient and safety documentation organized under that name, and don't rely on an upstream party's paperwork to cover gaps in your own filing. For a private label brand specifically, that means treating your own name on the label as the trigger for your own compliance obligations, not an afterthought bolted onto someone else's registration.