MoCRA adverse event reporting for fragrance and beauty brands
Who has to report, what counts as serious, a free calculator for the 15-business-day deadline, how to file with the FDA, and what records to keep.
The short answer
Under MoCRA, if the company named on a cosmetic’s label, called the responsible person, receives a report of a serious adverse event, it must send it to the FDA within 15 business days, with a copy of the label. New and material medical information received within 1 year of that first FDA report must also be sent within 15 business days. Every adverse event report, serious or not, must be kept for 6 years, or 3 for some small businesses. MoCRA’s small-business exemptions don’t cover adverse event reporting.
Who the responsible person is
MoCRA defines the responsible person as the manufacturer, packer or distributor whose name appears on a cosmetic product’s label. For most independent fragrance and beauty brands, that’s the brand itself, even when a contract manufacturer makes the product and the label says “Manufactured for” or “Distributed by.”
The FDA says the reporting rules became enforceable on December 29, 2023. Since December 29, 2024, each label must also show a domestic address, domestic phone number or electronic contact, such as a website, where the responsible person can receive adverse event reports.
Are small businesses exempt from adverse event reporting?
No. MoCRA’s small-business exemptions, in 21 U.S.C. 364h, cover only good manufacturing practice, facility registration and product listing. The adverse event rules in 21 U.S.C. 364a apply to every responsible person, whatever its size. The FDA describes the exemptions the same way: MoCRA “exempts certain small businesses from GMP, registration, and product listing requirements.”
MoCRA counts a business as small if its average yearly US cosmetic sales over the past 3 years are under $1,000,000, adjusted for inflation. Even then, the exemptions don’t apply to a business that makes or processes products that regularly touch the eye’s mucous membrane, are injected, are taken internally, or are meant to change appearance for more than 24 hours and aren’t removed by the consumer in normal use.
For adverse events, the one difference a qualifying small business gets is shorter record keeping: 3 years instead of 6.
What counts as a serious adverse event
An adverse event is any health-related event associated with using a cosmetic product that is adverse. MoCRA calls it serious when it results in any of the following:
- Death, or a life-threatening experience
- Inpatient hospitalization
- A persistent or significant disability or incapacity
- A congenital anomaly or birth defect
- An infection
- Significant disfigurement, including serious and persistent rashes, second- or third-degree burns, significant hair loss, or a persistent or significant alteration of appearance, other than as intended, under conditions of use that are customary or usual
It’s also serious when, based on reasonable medical judgment, it needs medical or surgical intervention to prevent one of those outcomes.
Events that aren’t serious don’t have to be reported to the FDA, but you must still keep a record of each one.
When is a serious adverse event report due?
MoCRA requires it no later than 15 business days after the responsible person receives the report. The FDA hasn’t defined business days for this rule. Business days usually exclude weekends, but whether federal holidays count is unsettled, so the calculator shows two dates: the earlier counts holidays as business days, the later skips them. The earlier date is the cautious one.
The law covers “any report received” without naming channels, and the FDA hasn’t said which channels count, so a customer email to your support inbox, a product review or a message passed on by a retailer could start the clock. Your counsel can say how to treat each.
For a report received on Friday, November 6, 2026, 15 weekdays later is Friday, November 27. Skipping Veterans Day (November 11) and Thanksgiving (November 26) would move it to Tuesday, December 1. Plan for the earlier date, November 27.
What counts as day 1. The law counts 15 business days after the report is received, so we treat the day it reaches you as day 0, whatever day of the week it is, and the next weekday as day 1. Form FDA 3500A’s instructions define the date received as the date the responsible person, or a corporate affiliate, receives information about the event; they don’t say how to count the days. So a report that arrives on Saturday, November 7, has the same deadline as one received the day before: November 27.
If you receive new and material medical information within 1 year of your first report to the FDA, send it within 15 business days of receiving it. Add your first report’s date to the calculator to see when that year ends.
This calculator handles one report at a time. Tracking every report’s window for you is on our roadmap. Today, the Order-Status Responder in our Peak-Proof Perfume Program sends messages with reaction words straight to a person, marked urgent, so a report isn’t left buried while its clock runs. It works from keywords, so your team should still read every message.
How to submit a report
The FDA offers three routes and strongly encourages the electronic ones.
| Route | Who it suits | How it works |
|---|---|---|
| Electronic Submissions Gateway | Companies whose systems can send XML files to the FDA | Reports go database to database. Questions go to AEMSeSub@fda.hhs.gov. |
| Safety Reporting Portal | Companies without that setup | Request an account at AEMSeSub@fda.hhs.gov, then enter reports one at a time in a web form. |
| Paper Form FDA 3500A | Anyone | Email it, with the label and any images in one PDF, to CosmeticAERS@fda.hhs.gov, or mail it. |
Ask for a portal account before you need one. The FDA tells drug companies that portal accounts take about 7 to 10 business days to activate.
After you file. Reports appear on the FDA’s public dashboard, updated daily and searchable by product name. The FDA says publication doesn’t mean it found the product caused the event, and the law says filing isn’t an admission.
What goes in a report
The FDA’s instructions for Form FDA 3500A (September 2025 edition) ask for:
- The person’s initials or a code, never their name
- Who first reported it, and how to reach them for follow-up
- The product name and lot number
- What happened, where on the body, how much was used, and the outcome
- The date you received the information
- A manufacturer report number. The FDA says a report isn’t complete without it.
- A copy of the label on or within the retail packaging
For new information, file a follow-up report with the same report number.
What you have to keep
- A record of every adverse event report you receive, serious or not, for 6 years.
- Three years instead for a qualifying small business.
- For serious events, the report you sent with its label copy, plus any follow-up.
- Records supporting the safety of each product, which MoCRA also requires.
The FDA can review your adverse event records during an inspection. Failing to keep them, or to file a required report, is a prohibited act under federal law.
Fragrance ingredients and allergen labels
If the FDA has reasonable grounds to believe a fragrance or flavor ingredient caused or contributed to a serious adverse event, it can ask the responsible person, in writing, for a list of those ingredients or ingredient categories. You have 30 days to send it, and the FDA must withhold it from Freedom of Information Act requests. The law says the responsible person must ensure the list is submitted, which leaves room for a fragrance house that keeps your formula confidential to send it to the FDA directly within the 30 days.
Federal fragrance allergen labeling isn’t required yet. MoCRA told the FDA to propose a rule naming fragrance allergens by June 29, 2024. As of October 13, 2026, no proposed rule has been published, and the federal regulatory agenda lists one for November 2026. Until a final rule takes effect, FDA rules still let labels list fragrance ingredients as “fragrance.”
How to handle a reaction report, step by step
- Check every channel. Reports can arrive through support email, chat, product reviews, social messages, Amazon and TikTok Shop messages, and wholesale partners. Make sure a person or a tool watches each one.
- Log the day you received it. That date starts the clock, so record it before anyone investigates.
- Reply to the customer. Pass on the FDA’s advice to consumers: stop using the product and contact a healthcare provider. Then gather the details a report needs.
- Decide whether it’s serious. The responsible person makes that call against MoCRA’s definition.
- Report serious events in time. Submit to the FDA within 15 business days, with a copy of the label. The deadline calculator above gives the date.
- Keep the record. File the report, your decision and any follow-up together, even when you decide not to report.
SypherRing doesn’t log or file reports for you yet; a reaction report desk is on our roadmap. Today, the Order-Status Responder sends any message with reaction words, such as rash, burn, swelling or a doctor visit, straight to a person, marked urgent, instead of answering it. It looks for keywords, so it can miss a report, and it only reads the inbox connected to it. Your team should still read every message. It isn’t legal or medical advice.
See how it routes a reaction report in the Responder demo, or get a free Peak-Proof Report of your store.
Questions brands ask
Do small fragrance brands have to report adverse events?
Yes. Under 21 U.S.C. 364h, MoCRA’s small-business exemptions cover only good manufacturing practice, facility registration and product listing, not adverse event reporting.
Is a rash a serious adverse event?
It can be. The law lists serious and persistent rashes as significant disfigurement, and a rash that needs medical or surgical treatment to prevent a serious outcome counts too. A mild rash that clears on its own may not qualify. The responsible person decides, and every report should be recorded.
When does the 15-business-day clock start?
When the responsible person receives the report. That day is day 0, so day 1 is the next weekday. The law covers any report received without naming channels, so, as written, a customer email to your support inbox can start it. The FDA hasn’t said whether federal holidays count as business days, so plan as if they do.
How do we submit a serious adverse event report?
There are three routes. Companies that can send XML files use the FDA’s Electronic Submissions Gateway. Others use the Safety Reporting Portal, after requesting an account at AEMSeSub@fda.hhs.gov. Or email Form FDA 3500A with the label to CosmeticAERS@fda.hhs.gov.
Do we have to report adverse events that aren’t serious?
No. MoCRA requires reports to the FDA only for serious adverse events. You can report others voluntarily on Form FDA 3500A, and you must still keep a record of each one.
How long do we keep adverse event records?
Six years for each adverse event report, serious or not. A small business keeps them for three years if it doesn’t make or process products that regularly touch the eye’s mucous membrane, are injected, are taken internally, or are meant to change appearance for more than 24 hours and aren’t removed by the consumer in normal use.
Do we have to list fragrance allergens on our labels yet?
Not under federal law yet. As of October 13, 2026, the FDA hadn’t proposed the rule MoCRA requires, and the federal regulatory agenda lists a proposal for November 2026. Until a final rule takes effect, labels can still say “fragrance.”
Does filing a report mean we admit our product caused the reaction?
No. The law says a report isn’t an admission that the product caused or contributed to the event, and you can attach a statement saying so. The FDA publishes reports on a public dashboard and says publication doesn’t mean it has concluded the product caused the event.
Sources
- FDA: Modernization of Cosmetics Regulation Act of 2022 (MoCRA)
- FDA: How to report a cosmetic product related complaint
- FDA: Serious adverse event reporting instructions (December 14, 2023)
- FDA: Instructions for Form FDA 3500A (September 2025)
- FDA: Adverse Event Monitoring System electronic submissions
- FDA: Adverse event dashboard for cosmetic products (September 12, 2025)
- Unified Agenda: Disclosure of Fragrance Allergens in Cosmetic Labeling (RIN 0910-AI90)
- 21 U.S.C. 364: Definitions
- 21 U.S.C. 364a: Adverse events
- 21 U.S.C. 364d: Safety substantiation
- 21 U.S.C. 364e: Labeling
- 21 U.S.C. 364h: Small businesses
- 21 U.S.C. 331: Prohibited acts
- 21 CFR 701.3: Designation of ingredients
- 21 CFR 701.12: Name and place of business
- 5 U.S.C. 6103: Holidays
- OPM: Federal holidays
- Public Law 117-328 (MoCRA is Division FF, Title III)
This guide is general information, not legal or medical advice. Your responsible person, and your counsel where needed, should decide what to report.
Last reviewed October 13, 2026 against the sources above.