Revlon Got a Drug CGMP Warning Letter Without an Inspection. Here Is How That Works.

Between May 1 and July 29, 2026, FDA published 64 warning letters citing current good manufacturing practice violations for finished pharmaceuticals. Two things about that cohort are worth an operator's attention.

Thirteen of the 64 were built entirely from records the company mailed in. No investigator visited. FDA sent a request under section 704(a)(4) of the FD&C Act, read the response, and issued a CGMP warning letter from the paperwork.

Several went to companies that do not think of themselves as drug manufacturers. Revlon is on the list. So is a Turkish cosmetics manufacturer and a Florida contract cosmetics packer. All three were cited under 21 CFR parts 210 and 211 — the finished pharmaceutical rules.

If you make anything with an OTC active ingredient — sunscreen, anti-dandruff shampoo, acne wash, antiperspirant, medicated lip balm, hand sanitizer — this is your regulatory framework, and FDA can now reach you without leaving the building.

The records-request route

Section 704(a)(4) [21 U.S.C. § 374(a)(4)] lets FDA request records from a drug establishment in advance of, or in lieu of, an inspection. The company is obliged to produce them. Where the resulting records show CGMP failures, FDA can issue a warning letter on that basis alone — the letters say so explicitly.

The Revlon letter (MARCS-CMS 722596, issued June 2, 2026) opens by describing records submitted "in response to our September 8, 2025 request for records and other information pursuant to section 704(a)(4)" for the Revlon – Oxford Facility in Oxford, North Carolina (FEI 1021184). Then:

"Because your methods, facilities, or controls for manufacturing, processing, packing, or holding of drugs as described in your response to our 704(a)(4) request do not conform to CGMP, your drug products are adulterated within the meaning of section 501(a)(2)(B)."

The adulteration finding rests on the company's own submission. Nine months elapsed between the request and the letter.

The Erkul Kozmetik letter (MARCS-CMS 721964, Istanbul, FEI 3012641739) follows the identical structure from an August 25, 2025 request.

Both were cited under 21 CFR 211.84(d)(1) and (d)(2) — failure to test each component for identity and for conformity with written purity, strength, and quality specifications. In both cases the concern was an inactive ingredient that can carry a contaminant FDA describes as a known human carcinogen. FDA redacted the ingredient and contaminant names under (b)(4), so we are not going to guess at them. What is legible is the compliance failure: the firms did not test incoming components against specification, and the risk lived in an excipient, not the active.

FDA classified at least one of the affected products as a "higher-risk drug."

Why cosmetics companies keep landing in part 211

The distinction that matters is not what your company does. It is what is in the formula.

A product with an OTC active ingredient is a drug. Add an approved sunscreen filter, and the sunscreen is a drug. Add salicylic acid for acne, and the wash is a drug. Add pyrithione zinc, and the shampoo is a drug. The rest of your portfolio may be pure cosmetics governed by MoCRA. The one SKU with an active is governed by 21 CFR 210 and 211, and those rules require things a cosmetics quality system usually does not: component identity testing on every lot, written and validated specifications, stability data, batch records, and formal out-of-specification investigations.

Active Cosmetics Manufacturing Inc. of Orlando (MARCS-CMS 722408, FEI 3005351079) shows what the gap looks like in practice. This one did come from an inspection, October 27–31, 2025. FDA cited 21 CFR 211.192 — failure to thoroughly investigate discrepancies and batch failures. The specifics:

"Batch (b)(4) was found to contain the objectionable microorganism Staphylococcus aureus. Batch (b)(4) was found to contain the objectionable microorganism Pseudomonas aeruginosa. Batch (b)(4) failed the Neogen Soleris Next Generation System test..."

The firm released those batches for commercial distribution on the strength of passing retest results, without investigating why the first results failed. FDA's response is the standard one and worth memorizing:

"Passing retest results alone cannot invalidate an initial out-of-specification result."

Retesting until you get a clean number is a recognizable habit from cosmetics microbiology, where in-house limits are often internal rather than regulatory. Under part 211 it is a documented violation.

The geography

The 64-letter cohort is heavily international. Facilities cited include Sato Pharmaceutical and Asanuma Corporation (Japan), Shantou Qiwei, Harbin Jixianglong, Hangzhou Yiqi, and Hubei Gedian Humanwell (China), Zydus Lifesciences, Umendra Life Sciences, and Alchymars ICM SM (India), Laboratorios Jaloma (Mexico), Macau-Union Pharmaceutical (Macau), Respilon Production (Czech Republic), Naveh Pharma (Israel), and Erkul Kozmetik (Turkey).

There is a structural reason the records-request route matters most here. Foreign inspections are expensive, slow, and require host-country coordination. A 704(a)(4) request costs a postal address. Our reading: if you are a US brand relying on an overseas contract manufacturer for an OTC drug product, that facility's regulatory exposure has gone up, and your supply continuity is downstream of it. We are describing a pattern in one quarter of data, not predicting FDA's plans.

One related item is worth naming. Aeroflex Industria de Aerosol Ltda. received a letter titled "Refusal to Provide Access to and Copying of Records." Declining a 704(a)(4) request is itself the violation — and under section 501(j), a drug can be deemed adulterated on that basis alone.

What to do this week

1. List those SKUs explicitly. Separate them from your cosmetics. They are governed by different rules and need a different quality system.
2. Check component identity testing. Does your contract manufacturer test every incoming lot of every component — actives and excipients — for identity and against written specifications? 211.84(d) is the single most-cited provision in this cohort. Ask for records, not assurances.
3. Ask about excipient contaminant testing specifically. Both records-request letters turned on an inactive ingredient. Excipients are where this cohort's risk concentrated.
4. Audit your OOS handling. If any procedure permits releasing a batch on a passing retest without a completed root-cause investigation, that is a 211.192 citation waiting to be written.
5. Confirm your facilities can answer a 704(a)(4) request. Ask your contract manufacturer directly whether they have received one. The answer is a live indicator, and a refusal on their end becomes an adulteration finding that reaches your product.

The takeaway

The old mental model was that CGMP risk arrives with an investigator at reception. Thirteen letters this quarter say otherwise. A records request is a slower, quieter event that produces the same adulteration finding — and for a facility overseas, it is now the more likely path.

The other correction is about identity. FDA does not care what your company calls itself. Revlon is a cosmetics company by any ordinary description. Its Oxford facility is a drug establishment with an FEI number, and it was cited under the finished pharmaceutical rules like any other.

Sources

• FDA Warning Letters, May 1 – July 29, 2026, Center for Drug Evaluation and Research — FDA Warning Letters database
• Revlon Group Holdings, LLC, MARCS-CMS 722596 (June 2, 2026)
• Erkul Kozmetik Sanayi ve Ticaret A.S., MARCS-CMS 721964 (June 2, 2026)
• Active Cosmetics Manufacturing Inc., MARCS-CMS 722408 (April 22, 2026)
• FD&C Act sections 501(a)(2)(B), 501(j), 704(a)(4); 21 CFR parts 210 and 211, specifically 211.84(d) and 211.192

Policy Canary tracks FDA enforcement and matches it against your specific products. We are an intelligence service, not a law firm — this is analysis, not legal advice.