There's no federal license to make or sell cosmetics, and FDA doesn't approve them before they're sold, apart from color additives. What you need is the ordinary business layers, a registered name, a sales or excise tax license, a city license where required, and then the federal rules from MoCRA, the Modernization of Cosmetics Regulation Act of 2022. A small business, under $1,000,000 of average US cosmetic sales over three years, adjusted for inflation, is exempt from FDA facility registration, product listing and the coming manufacturing rules, unless it makes eye-area, injected, internal-use or long-wear products. Every maker, small or not, keeps records showing each product is safe, reports serious adverse events to FDA within 15 business days, puts a US contact on the label for those reports, and labels the ingredients. Soap sold as soap isn't a cosmetic at all. In the example below, an Oʻahu skincare maker sorts its licenses. Below are the layers, MoCRA's rules, the example, and a free checklist.
The short version
- No federal license, and no FDA approval of cosmetics, apart from color additives.
- Business layers: a registered name, a tax license, a city license where required.
- MoCRA small business: under $1,000,000 average US cosmetic sales over 3 years.
- Small businesses skip facility registration, product listing and the manufacturing rules.
- Not for eye-area, injected, internal-use or long-wear products.
- Everyone: safety records, serious adverse event reports in 15 business days, a label contact.
- Soap sold only as soap isn't a cosmetic; claims to treat disease make a product a drug.
- TaroStack keeps each batch's ingredient lots and which shops got it. More below.
The layers
| Layer | Who issues it | What to check |
|---|---|---|
| Business name | State | An LLC filing, a trade name or a DBA |
| Tax license | State revenue department | Sales or excise tax registration |
| City business license | City or county | Where one is required |
| Facility registration and product listing | FDA | Above the small business line, or for the excluded products |
| Safety, adverse events, labels | FDA, MoCRA and 21 CFR part 701 | For everyone |
| State ingredient rules | States | Some states limit or ban ingredients or require reporting |
States can't add their own registration, manufacturing or adverse event rules under 21 U.S.C. 364j, but they can still ban or limit ingredients. This is general information, not legal advice.
MoCRA's rules
| Rule | What it says |
|---|---|
| Small business | Under $1,000,000 average US cosmetic sales over 3 years, adjusted for inflation (364h) |
| Not for these products | Products that touch the eye's mucous membrane, injected, internal-use, or altering appearance for more than 24 hours (364h) |
| Registration and listing | Each facility within 60 days of starting, renewed every 2 years, and each product listed, unless exempt (364c) |
| Safety substantiation | Records supporting that each product is safe as labeled (364d) |
| Serious adverse events | Reported to FDA within 15 business days, with the label; records kept 6 years, or 3 for a small business (364a) |
| Label contact | A US address, phone number or website for adverse event reports (364e) |
| Manufacturing rules | Regulations still to come, with a draft guidance; small businesses exempt |
More on the exemption in MoCRA small business, and the label in cosmetic labeling requirements.
Soap and claims
A bar that's mostly fatty acid salts, sold only for cleansing, is soap, not a cosmetic, under 21 CFR 701.20, and the Consumer Product Safety Commission covers it; a bar sold to moisturize or deodorize is a cosmetic. Claims to treat or prevent disease, or to change the body, make any product a drug. More in soap business license.
An example: an Oʻahu skincare maker
Hoʻola Botanicals, the made-up skincare maker in Kailua, Oʻahu, I use in these examples, makes whipped body butter, lotion, cold process soap and bath bombs for markets, online orders and gift shops:
| Layer | Status |
|---|---|
| Trade name and Hawaii general excise tax license | Done, June 2024 |
| MoCRA small business | Yes: well under $1,000,000 a year, no eye-area or long-wear products; checked each January |
| FDA facility registration and product listing | Not required |
| Safety substantiation | Done: a file for each formula, with each ingredient's safety data |
| Serious adverse event reports | A process ready: 15 business days; records kept 3 years |
| Label contact | The website on every label |
| Cosmetic labels | Done: ingredients in descending order, net quantity, name and place |
| Soap | Labeled "moisturizing", so treated as a cosmetic |
| Claims | Checked: no "heals eczema" anywhere |
| Product liability insurance | Done June 1, 2026; renews June 1, 2027 |
The soap's "moisturizing" makes it a cosmetic, so it goes through the same label and safety file as the body butter. The business is in skincare business plan.
Get the checklist
Download the cosmetics business license checklist. One sheet: each layer, who issues it, what it is, whether you need it, the cost, the date done and the renewal date; the status and the total cost fill in. It's an ordinary Excel file with no macros, and it works in Google Sheets, LibreOffice and Numbers.
Where this stops working
A customer reports a rash from a jar of body butter. The checklist says you have a process; it doesn't say which batch the jar came from, which shea butter lot went into it, or which shops got the same batch.
How TaroStack does it
TaroStack makes the lot code on a jar lead to its batch, its ingredients and its customers.
From the lot to the batch. Every lot made carries its batch: which ingredient lots went in, from which suppliers, which recipe version, when and who made it, with the batch record's readings and sign-off.
From the batch to every customer. One report walks the lot forward to every customer who got it, and shows what's still on your shelves. Stock on hold sits apart, so a lot you're looking into can't ship.
And the records keep. Every batch and movement is a permanent record with who, when and why. TaroStack keeps the records; it doesn't file anything with FDA.
| The question | Notebook | In TaroStack |
|---|---|---|
| Which batch was the jar from? | Maybe a date | The lot, on its label |
| What went into that batch? | "Shea butter" | Each ingredient's lot and supplier |
| Who else got it? | A box of invoices | One report |
Lots, lot labels, holds, recalls, recipes with versions, batches and batch records are on every plan, from $49 a month. The first 30 days are free, with no credit card. If you'd like a hand setting up, ask, and we'll do it with you.