FINRA Rule 3290: A Significant Shift in the Supervision of Outside Business Activities

 

On September 15, 2026, the SEC approved FINRA Rule 3290, a significant modernization of the framework governing associated persons’ outside business activities.  This Client Alert discusses the changes and what firms should be doing now.

The new rule will replace and consolidate two longstanding requirements: FINRA Rule 3270, governing Outside Business Activities (OBAs), and FINRA Rule 3280, governing Private Securities Transactions (PSTs).

But describing Rule 3290 simply as a consolidation understates the change.

At its core, Rule 3290 represents a shift toward a more risk-based supervisory framework. Rather than requiring firms to devote compliance resources to virtually every compensated outside activity, the new rule focuses more directly on activities involving financial assets and those presenting meaningful investor-protection, customer-confusion, conflict, or selling-away risks.

What is changing?

Under current Rule 3270, registered persons generally must provide prior written notice before engaging in compensated business activity outside the scope of their relationship with the broker-dealer. That can capture activities having little connection to the securities industry.

Rule 3290 narrows that framework by focusing the outside-activity requirement on Investment-Related Activity.

Importantly, FINRA defines that term broadly. It includes activity pertaining to financial assets such as securities, crypto assets, commodities, derivatives, currency, banking, real estate and insurance. The list is expressly non-exclusive.

The practical result: firms should eventually be able to spend less time reviewing lower-risk outside employment that has little or no nexus to investing or financial services, while directing resources toward activities more likely to create conflicts, customer confusion or investor harm.

Private securities transactions are not going away.

This is an important distinction. Rule 3290 preserves heightened requirements for outside securities transactions, particularly those involving selling compensation.

Associated persons will continue to have prior-notice obligations. Where selling compensation is involved, the broker-dealer must make a written decision to approve, conditionally approve or disapprove participation.

If approved, the firm must record the transaction on its books and records and supervise the associated person’s participation as though the transaction were executed on behalf of the firm. In other words, firms should not interpret the modernization of the OBA framework as a relaxation of selling-away controls.

Unrelated outside employment and outside financial activity will no longer be treated the same.

This may be one of the most operationally important changes. Activities such as bartending or refereeing sporting events are examples FINRA has identified as lower-risk activities that would no longer fall within the mandatory reporting framework.

Investment-related outside activities remain different.

When a registered person provides notice of an outside activity, the firm must assess, at a minimum:

• Whether the activity is actually an outside securities transaction;
• Whether it involves a customer of the registered person;
• Whether it could interfere with or compromise the person’s responsibilities to the firm or its customers; and
• Whether customers or the public could reasonably view the activity as part of the firm’s business.

Based on that assessment, firms must evaluate the risks the activity presents to the firm and its customers and determine whether the activity should be permitted, restricted, conditioned or prohibited.

There is another important supervisory point here: if a firm imposes conditions or limitations, Rule 3290 expressly requires the firm to reasonably supervise compliance with those conditions or limitations.

That means an approval cannot simply disappear into an OBA file. Firms need a distinct mechanism for monitoring the conditions they impose.

Outside RIA activity receives substantially different treatment.

Rule 3290 also changes the treatment of associated persons working through unaffiliated registered investment advisers.

Under the new framework, advisory activity conducted through an unaffiliated SEC- or state-registered investment adviser is generally treated as an outside activity, rather than an outside securities transaction.

Prior written notice and the firm’s upfront assessment remain required, but FINRA is eliminating the broker-dealer’s Rule 3290 supervision and transaction-recordkeeping obligations for that advisory activity.

This is a meaningful departure from FINRA guidance dating back to the 1990s and recognizes a practical reality: requiring a broker-dealer to supervise activity occurring through a separately regulated, unaffiliated RIA can leave the BD responsible for activity over which it may have limited visibility or access to information.  FINRA concluded that requiring broker-dealers to supervise advisory activity conducted through independently regulated unaffiliated RIAs could create duplicative oversight obligations while providing limited additional investor protection.  The new framework acknowledges the separate regulatory regimes governing broker-dealers and registered investment advisers.

Affiliate activity is treated differently as well.

Activity performed on behalf of the broker-dealer or its affiliate is excluded from Rule 3290.

That can include investment advisory, insurance or banking activities conducted through affiliated entities.

The rationale is important: FINRA is distinguishing truly external activity from activity occurring within a corporate family where the firm should already have visibility through governance, compliance systems and internal coordination.

However, exclusion from Rule 3290 does not eliminate a firm’s broader supervisory obligations. Activities falling outside Rule 3290 may remain subject to other federal securities laws and FINRA requirements — including Rule 3110 — requiring firms to maintain appropriate supervisory systems, written procedures, and controls based on the nature of the activity and the risks it presents.

Certain personal activities are also excluded.

The rule contains targeted exclusions for certain lower-risk personal activity, including certain personal investments already addressed by Rule 3210, personal investments in non-securities, uncompensated securities transactions among immediate family members, and qualifying transactions involving an associated person’s primary residence and up to two secondary homes.

Again, the theme is consistent: focus compliance resources where the regulatory and investor-protection risks are greatest.

Rule 3290 does not necessarily change Form U4 reporting obligations.

One issue firms should monitor closely is the interaction between Rule 3290 and Form U4 disclosure requirements.  Although Rule 3290 eliminates FINRA notice requirements for many non-investment-related activities, the SEC approval order does not amend Form U4. Until FINRA and other regulators provide further guidance, firms should be cautious about eliminating existing disclosure processes for activities that may remain subject to Form U4 reporting obligations even if they no longer require review under Rule 3290.

What is not changing?

Despite the modernization effort, several core principles remain intact.  Associated persons must still provide prior notice of outside securities transactions, firms must continue reviewing potential conflicts and customer confusion risks, compensated outside securities transactions remain subject to firm approval, and approved transactions involving selling compensation must still be supervised as though executed on behalf of the firm.  Rule 3290 therefore represents an evolution of the framework, not a retreat from FINRA’s longstanding focus on selling-away risks.

What should broker-dealers be doing now?

Although the SEC approved Rule 3290 on September 15, 2026, the rule is not yet effective. FINRA has indicated that it will publish a Regulatory Notice establishing the implementation date.  Until that occurs, firms must continue complying with existing Rules 3270 and 3280.  FINRA told the SEC that it will determine an effective date that balances firms’ need for sufficient implementation time with its objective of reducing unnecessary regulatory burdens.

Until then, firms should continue operating under existing Rules 3270 and 3280.

But waiting for an effective date before beginning implementation planning would be a mistake.

From my perspective, broker-dealers should begin preparing now by:

1. Inventorying existing OBA and PST disclosures. Determine which activities are likely to remain reportable as investment-related outside activities, which constitute outside securities transactions, and which may ultimately fall outside Rule 3290.
2. Identifying unaffiliated RIA relationships. These deserve particular attention because their regulatory treatment changes materially under the new rule.
3. Mapping affiliate relationships. Firms should understand which activities may qualify for the affiliate exclusion while separately determining what supervisory obligations continue under Rule 3110 or other requirements.
4. Reviewing OBA/PST forms and technology workflows. Existing systems built around Rules 3270 and 3280 may not capture the information necessary to perform and document Rule 3290’s required assessments.
5. Building a process for supervisory conditions. If Compliance approves an activity subject to restrictions, the firm should be able to demonstrate not only what conditions were imposed, but how compliance with those conditions is monitored.
6. Preparing WSP revisions and training. Representatives will need to understand that “fewer reportable OBAs” does not mean “outside activities no longer matter.” The line is shifting toward investment-related activity and risk — not disappearing.
7. Reevaluating firm policy separately from the regulatory minimum. Rule 3290 does not prevent a broker-dealer from maintaining more restrictive internal disclosure requirements when warranted by its business model and risk profile.

That last point may be the most important: Rule 3290 provides firms with regulatory relief, but it also gives them greater responsibility to make thoughtful, risk-based decisions about where enhanced oversight remains appropriate.  Notably, Rule 3290 establishes a regulatory floor rather than a supervisory ceiling. Broker-dealers remain free to adopt more expansive internal reporting requirements where warranted by their business model, representative population, or risk profile.

The compliance opportunity is not simply to remove disclosures from a questionnaire. It is to redesign the OBA/PST Compliance program so that supervisory resources are concentrated on the activities that actually present meaningful risk.

For CCOs and Compliance teams, now is the time to understand the new framework, inventory the existing population and design the future-state process — before the implementation clock starts running.

Have questions? FiSolve can help – please reach out at Info@FiSolve.com.

Article written by Kimberly Johnson, Senior Vice President, Compliance