Overview #
Regulatory compliance is not a checkbox at the end of a project. It is the constraint that shapes every formulation decision from day one. When brand partners brief us on a brightening serum, the first question we ask is not “which active?” — it is “which markets are you selling into?” Because alpha-arbutin at 2% clears EU notification in a straightforward path. Kojic acid at the same concentration triggers a different conversation entirely. Tranexamic acid sits in a third category where the regulatory framework is still catching up to the market demand. Getting this wrong costs six to twelve months and a full reformulation.
The Regulatory Landscape: What Each Market Actually Allows #
Start with the EU, because it sets the most structured framework. Under EU Cosmetics Regulation 1223/2009, alpha-arbutin is permitted in face creams up to 2% and body lotions up to 0.5%. These limits came from the SCCS Scientific Opinion on arbutin and alpha-arbutin, adopted in 2015 and revised in 2018. The SCCS concluded that alpha-arbutin is safe at those concentrations specifically because of its slower hydrolysis to hydroquinone compared to beta-arbutin. That distinction matters — beta-arbutin is not on the same permitted list.
Kojic acid is where EU projects get complicated. It is not listed in Annex III (restricted substances) with a defined permitted limit. It sits in a grey zone where it is technically not prohibited, but the SCCS opinion from 2011 flagged concerns at concentrations above 1% in rinse-off and leave-on products. In practice, most EU-compliant formulations we produce cap kojic acid at 1% in leave-on formats. Some brand partners push for 2% — we push back. Not because it is definitively banned, but because the safety dossier burden at that level is significant and the outcome is uncertain.
Tranexamic acid has no dedicated entry in EU Annex II, III, or V. It is treated as a general cosmetic ingredient, which means the safety assessment falls entirely on the Responsible Person. We typically see it formulated at 2–3% in EU-targeted products. The challenge is that clinical evidence for tranexamic acid as a topical cosmetic is still relatively thin compared to its pharmaceutical history, and some EU notified bodies scrutinize the dossier more carefully when the ingredient has a known pharmaceutical application.
In the US, the FDA Cosmetics Guidelines framework is more permissive in structure but carries its own risks. None of these three actives are classified as OTC drug actives for skin lightening — the FDA withdrew the proposed OTC monograph for skin bleaching in 2019, which means hydroquinone is effectively off the table for cosmetics, but alpha-arbutin, kojic acid, and tranexamic acid remain in cosmetic territory. No specific concentration limits are federally mandated. The safety burden sits with the brand. What this means practically: you can formulate kojic acid at 2% for the US market without hitting a regulatory ceiling, but your safety substantiation needs to be solid.
China NMPA is the most prescriptive of the three. Under the NMPA Cosmetic Regulation framework updated in 2021, alpha-arbutin is listed as a permitted whitening ingredient with a maximum concentration of 2% in leave-on products. Kojic acid is permitted at up to 1% in leave-on formulations. Tranexamic acid is permitted at up to 3%. These are hard limits — not guidelines. Exceeding them means your registration application is rejected. Full stop.
| Active Ingredient | EU Permitted Limit (Leave-On) | US FDA Limit | China NMPA Limit |
|---|---|---|---|
| Alpha-Arbutin | 2% (face), 0.5% (body) | No federal limit | 2% |
| Kojic Acid | ~1% (SCCS-guided, not codified) | No federal limit | 1% |
| Tranexamic Acid | No specific limit (general cosmetic) | No federal limit | 3% |
| Beta-Arbutin | Not recommended (hydroquinone concerns) | No federal limit | 0.5% |
Registration Timelines and What Actually Delays Projects #
EU notification through the CPNP portal is theoretically straightforward — 24 to 48 hours for the notification itself once your Product Information File is complete. The PIF is where time disappears. A safety assessment for a product containing kojic acid at 1% with a novel delivery system took us 14 weeks to complete on one recent project, because the safety assessor required additional in vitro data on percutaneous absorption. That is not unusual. Budget 8–16 weeks for EU PIF preparation on any product with a restricted or borderline active.
China NMPA registration for ordinary cosmetics (普通化妆品) moved to a filing system in 2021, which sounds faster. It is, for straightforward formulations. A brightening serum with alpha-arbutin at 2% and a clean ingredient list can complete filing in 4–6 weeks. Add kojic acid, and you are in ordinary cosmetic territory but with higher scrutiny. Add a claim like “whitening” (美白) and you cross into special-purpose cosmetics (特殊化妆品), which requires full registration — not filing — and takes 6–12 months. This is the single most common timeline shock we see with brand partners entering China.
The US path is fastest on paper. No pre-market approval for cosmetics. But if you are selling through major retail channels, retailer compliance programs (Sephora Clean, Target Clean, Ulta’s standards) add their own ingredient restrictions that can be more limiting than federal regulation. We have had projects where the formulation cleared FDA requirements easily but failed a retailer’s restricted substance list because of a preservative system, not the brightening active.
One project memory worth sharing: we had a brand partner targeting all three markets simultaneously with a single SKU. The NMPA 1% kojic acid limit and the EU SCCS-guided 1% limit aligned, so that was manageable. But the China “whitening” claim triggered special-purpose registration, which pushed the China launch 9 months behind the EU and US launches. The brand had already printed packaging with a unified global claim. We now require market-specific claim review before any packaging artwork is approved.
The Clinical Evidence — and Where It Gets Honest #
The most cited head-to-head data for these three actives comes from a double-blind, randomized controlled trial comparing topical tranexamic acid 3% versus kojic acid 1% in melasma patients (n=60, 12 weeks, twice-daily application). Tranexamic acid showed a 32% reduction in MASI score versus 29% for kojic acid — statistically comparable, not dramatically different. What that study does not capture is the tolerability difference: kojic acid showed a 23% incidence of mild irritation versus 8% for tranexamic acid. For sensitive skin positioning, that gap matters more than the efficacy delta.
Alpha-arbutin data is more fragmented. Most supplier-funded studies show melanin inhibition in vitro at IC50 values around 0.4–0.8 mM, which looks impressive until you consider that in-vivo penetration at 2% topical application delivers a fraction of that to the melanocyte layer. We are still not fully convinced the in-vitro-to-in-vivo translation is as clean as supplier data suggests. Our own stability and efficacy testing on alpha-arbutin formulations shows good consumer-reported outcomes, but we have not run our own controlled clinical trials on this specific active. The supplier data and our stability results don’t always tell the same story.
For brightening and whitening formulation strategy, the combination approach — alpha-arbutin plus tranexamic acid, with niacinamide as a supporting inhibitor — consistently outperforms single-active formulations in our internal assessments. Not because of synergy in the pharmacological sense, but because you are hitting multiple points in the melanogenesis pathway simultaneously.
Where Most Brands Get This Wrong #
Honestly, the biggest mistake is treating regulatory compliance as a documentation exercise rather than a formulation constraint. We see it constantly. A brand finalizes a formula at 2% kojic acid targeting the EU market, then discovers the safety dossier is essentially unachievable at that concentration, and the reformulation to 1% changes the sensory profile enough that the product development cycle restarts.
The second mistake is claim-driven formulation. A brand wants to say “brightens in 4 weeks” on pack. That claim, in China, triggers special-purpose cosmetics registration regardless of the active concentration. In the EU, it may require substantiation data that the formula cannot actually generate. We almost always push back on efficacy claims during the brief stage, not because we cannot formulate to support them, but because the regulatory and substantiation cost of defending them is rarely worth it for an indie brand at launch.
Cost is real here too. A full NMPA special-purpose cosmetics registration package — including the required human safety testing, efficacy testing, and stability data — runs approximately $15,000–$25,000 USD in testing fees alone, before our documentation preparation time. Most indie brands are not budgeting for that. Airless pump packaging adds $0.40–$0.80 per unit on top of that, which matters when you are trying to keep COGS manageable at MOQ 3,000 units.
The third mistake is assuming that because an ingredient is “natural” or “gentle,” it bypasses regulatory scrutiny. Kojic acid is derived from fungi. It still has a 1% limit in China and a contested safety profile in the EU. Alpha-arbutin is enzymatically synthesized. It still has concentration restrictions. The regulatory framework does not care about your marketing narrative.
For brands also working with vitamin C and antioxidant systems alongside tyrosinase inhibitors, the interaction between ascorbic acid (low pH) and kojic acid stability is something we flag early. Kojic acid degrades faster in acidic environments, and a vitamin C serum base at pH 3.0–3.5 will compromise kojic acid efficacy within weeks. This is usually where projects go sideways.
The Scale-Up Problem Nobody Talks About #
Lab-scale stability and production-scale stability are not the same thing. We learned this the hard way on a kojic acid formulation a few years back. At 500g lab scale, the formula held color and potency through 12 weeks at 40°C/75% RH. At 200kg production scale, we saw yellowing onset at week 6 — kojic acid oxidation accelerated by trace metal contamination from the mixing vessel. The fix was chelation with EDTA at 0.1% and switching to a passivated stainless steel vessel. Simple in retrospect. Not obvious until it happened.
Tranexamic acid is more forgiving at scale. We have not seen significant scale-up stability failures with it. Alpha-arbutin is sensitive to pH drift — if your water phase pH is not tightly controlled during manufacturing, you get hydrolysis to hydroquinone, which is both a regulatory problem and a safety concern. We control this by pre-adjusting the water phase to pH 5.5–6.0 before adding alpha-arbutin, and we verify pH at three points during the batch. It adds 20 minutes to the production cycle. Worth it.
We haven’t fully solved the long-term photostability of kojic acid in transparent packaging. Our current approach — UV-blocking packaging plus antioxidant support — works, but it is not elegant. Some batches still show marginal color shift by month 9 at ambient storage. We are still working on this.
Formulation Notes for Brand Partners #
What market? What are you expecting on-pack? Those are the first two questions. Because the answer changes everything about how we structure the formula, the concentration, and the documentation package.
If you are targeting EU and US only, we have a relatively clean path with alpha-arbutin at 2% or tranexamic acid at 2–3%. The safety dossier is manageable, the timeline is 12–16 weeks from brief to finished goods, and the claim space is reasonable. If you want to add kojic acid, we cap it at 1% and we are transparent about the EU grey zone.
If China is in scope, we need to know your claim strategy before we finalize the formula. “Brightening” as a functional description is different from “whitening” as a registered claim. The formula can be identical — the claim determines the registration pathway and the timeline. Budget 9–12 months for NMPA special-purpose registration if you want whitening claims. Budget $15,000–$25,000 USD in testing fees minimum.
For multi-market SKUs, we typically recommend alpha-arbutin at 2% plus tranexamic acid at 2% as the core brightening system. This clears NMPA limits, aligns with EU SCCS guidance, and has no US regulatory ceiling. Kojic acid as a third active is possible but adds complexity we usually do not think is worth it unless the brand has a specific reason.
We prepare the full documentation package: safety assessment, stability data (ICH-aligned, 6-month accelerated minimum per ICH Stability Guidelines), NMPA filing dossier, EU PIF, and claim substantiation summary. We do not hand you a formula and leave you to figure out the paperwork.
Frequently Asked Questions #
Q: We want to launch in China with a “whitening” claim — how long does that actually take?
Budget 9–12 months for NMPA special-purpose cosmetics registration from the point your formula is finalized. Testing alone — human safety patch test, efficacy assessment, stability — takes 4–6 months. Documentation preparation and NMPA review takes the rest. If you need to hit a specific launch window, tell us at brief stage, not three months in.
Q: Can we use kojic acid at 2% for the EU market?
Technically it is not prohibited, but we would not recommend it. The SCCS flagged safety concerns above 1% in leave-on products, and getting a safety assessor to sign off on a 2% kojic acid leave-on formula is difficult and expensive. We cap it at 1% for EU-targeted products. If you need stronger brightening efficacy, we add tranexamic acid or alpha-arbutin alongside it.
Q: Is alpha-arbutin actually stable in a vitamin C serum?
At pH below 4.0, alpha-arbutin hydrolysis accelerates meaningfully. A vitamin C serum base typically runs pH 2.5–3.5. We have seen 15–20% active degradation within 8 weeks under those conditions. If you want both actives in one product, we formulate at pH 4.5–5.0 and accept a modest reduction in ascorbic acid stability. Or we recommend a two-product system. Short answer: combining them in one phase at low pH is not something we do.
Q: What documentation do you prepare for FDA compliance?
For the US market, we prepare a cosmetic safety assessment, full ingredient INCI list with concentrations, stability data (minimum 6 months accelerated per ICH Stability Guidelines), and a challenge test report. We also flag any ingredients that appear on major retailer restricted substance lists. There is no pre-market FDA submission for cosmetics, but the safety substantiation file needs to exist and be defensible.
Q: We have seen tranexamic acid at 5% in some Korean products — can we formulate at that level?
For China NMPA, the hard limit is 3%. For EU, there is no codified limit, but a safety assessor will want percutaneous absorption data and a robust safety justification at 5%. For the US, no federal ceiling. If you are not selling into China, 5% is technically achievable with the right safety dossier. In our experience, the efficacy difference between 3% and 5% is not dramatic enough to justify the additional regulatory burden for most brand partners. We usually land at 3% as the practical optimum.
Have a product concept in mind? Contact our formulation team to request a complimentary brief review.
© 2026 Mastracare.com. All rights reserved.
Unauthorized reproduction or distribution is prohibited.