FDA’s Records Access Authority Under MoCRA
FDA can access and copy records related to a cosmetic product when it has a reasonable belief that the product, or an ingredient in it, is likely adulterated in a way that threatens serious adverse health consequences or death. This authority comes from Section 610 of the FD&C Act (21 U.S.C. § 364f), added by the Modernization of Cosmetics Regulation Act (MoCRA), enacted on December 29, 2022.
Before MoCRA, FDA’s ability to request records from cosmetic companies was limited. Today, records access is one part of an integrated compliance framework that also covers adverse event reporting, good manufacturing practice (GMP), facility registration, and safety substantiation.
The Legal Standard: What § 364f Requires
A records request is a risk-triggered authority, not a routine right. Under § 364f(a), the following conditions apply together:
- Reasonable belief: FDA must reasonably believe a cosmetic product or ingredient is likely adulterated.
- Serious health risk: Use of or exposure to the product must present a threat of serious adverse health consequences or death.
- Credentials and written notice: A duly designated FDA officer presents credentials and a written notice.
- Reasonable time and limits: Access occurs at reasonable times, within reasonable limits, and in a reasonable manner.
The authority also extends to any other cosmetic product FDA reasonably believes is likely affected in a similar manner, for example products made from the same raw material lot. Requests can be directed to both the responsible person (the manufacturer, packer, or distributor named on the label, § 364(4)) and the facility. For a Turkish brand, this means both the manufacturing site in Turkey and the U.S. distributor may receive a request.
Which Records Are In Scope, and Which Are Not
| Record type | Accessible to FDA? | Note |
|---|---|---|
| Product related manufacturing, quality, and distribution records | Yes | Records needed to determine whether the product is adulterated |
| Safety substantiation data | Yes | Research data is excluded, but safety substantiation data for products and ingredients is not |
| Shipment data | Yes | Sales data is excluded, but shipment data regarding sales is not |
| Qualifications of technical personnel | Yes | Personnel data is excluded, except qualifications of technical and professional staff |
| Formulas and recipes | No | Expressly excluded |
| Financial and pricing data | No | Expressly excluded |
| Other personnel, research, and sales data | No | Outside the exceptions above |
In practice, you do not have to disclose your formula under § 364f, but you must be able to show evidence that the product and each ingredient are safe. § 364d(a) already requires the responsible person to ensure and maintain records supporting adequate substantiation of safety.
Products that are also drugs (for example, a moisturizer with an SPF claim) are exempt from § 364f and related MoCRA requirements under § 364i(a), because they are subject to drug regulation under FD&C Act Subchapter V.
Other Recordkeeping Obligations
During an inspection under 21 U.S.C. § 374, FDA’s review of a cosmetic facility extends to records described in §§ 364a, 364b, and 364f.
- Adverse event records (§ 364a): Keep records of each adverse event report for 6 years, or 3 years for small businesses under § 364h that do not make the higher risk products listed in § 364h(b). Report serious adverse events within 15 business days, with a copy of the label. Provide fragrance or flavor ingredient information within 30 days if FDA requests it in writing. Submitting a report is not an admission of causation (§ 364a(h)(4)).
- GMP records (§ 364b): The GMP regulation may allow FDA to inspect records needed to demonstrate GMP compliance. The statute called for a final rule within 3 years of enactment; confirm its current status on FDA.gov before relying on specific requirements.
What Can Follow a Records Request
- Mandatory recall (§ 364g): If FDA finds a reasonable probability that a cosmetic is adulterated or misbranded and will cause serious adverse health consequences or death, it first offers the responsible person the opportunity to cease distribution and recall voluntarily, and may then order a recall.
- Suspension of facility registration (§ 364c(f)): If the problem cannot be isolated to a single product, FDA may suspend the facility’s registration. The responsible person may submit a plan within 5 business days of the notice of intent; an informal hearing is offered within 5 business days of the order; a corrective action plan is reviewed within 14 business days. No cosmetic product from a suspended facility may enter U.S. commerce.
Preparation Checklist for Brands Exporting to the U.S.
- Define the responsible person and allocate recordkeeping duties between manufacturer and U.S. distributor by contract.
- Build a product level safety substantiation file covering each finished product and ingredient.
- Keep the formula separate so safety data can be shared without disclosing it.
- Establish lot and raw material traceability across products.
- Maintain organized shipment records.
- Set up an adverse event system linked to the U.S. contact on the label.
- Keep qualification records for quality and production staff.
- Prepare English summaries or translations of key records (recommended practice).
- Define an internal response procedure for FDA written notices (recommended practice).
Frequently Asked Questions
Can FDA ask to see my cosmetic formula? Not under § 364f. Formulas and recipes are excluded, although safety evidence supporting the formula can be requested.
Can FDA request my records at every inspection? § 364f access depends on a reasonable belief of likely adulteration posing a serious health threat. Adverse event records must be made available during inspections under § 374.
If manufacturing is in Turkey, who receives the request? Both the responsible person and the manufacturing facility can be addressed, so both parties should agree on recordkeeping roles in advance.
How long must adverse event records be kept? Six years as a rule; three years for qualifying small businesses that do not make eye area, injected, internal use, or long lasting (over 24 hours) appearance altering products.
Do these rules apply to an SPF moisturizer? No. Sunscreen products are OTC drugs in the U.S.; under § 364i(a) they are exempt from these MoCRA requirements but remain subject to drug regulations.
Conclusion
FDA’s access to cosmetic records is a defined, conditional authority. Formulas, financial data, and pricing are excluded; safety substantiation data, shipment records, and technical staff qualifications are in scope. For a compliant company, a records request is an opportunity to document product safety, provided the records are organized before a request ever arrives.
UPP supports Turkish cosmetic brands entering the U.S. market with responsible person structuring, safety substantiation files, adverse event systems, and MoCRA facility registration and product listing.
This article is based on 21 U.S.C. §§ 361, 364, 364a, 364b, 364c, 364d, 364f, 364g, 364h, 364i, and 374. Regulations and FDA practice may change; check FDA.gov/cosmetics and eCFR.gov for current information. This content is for general information and is not legal advice.
