FINRA Rule 3290 Approved: Rebuilding Outside-Activities Supervision

The SEC approved FINRA's replacement for Rules 3270 and 3280 on September 15, 2026. The new framework narrows outside-activity reporting and changes supervision of unaffiliated advisory activity, but firms must wait for FINRA's effective-date notice before treating Rule 3290 as operative.

Updated September 26, 2026: This article retains its complete original text, with researched updates integrated into the relevant sections.

The Securities and Exchange Commission approved FINRA Rule 3290 on September 15, 2026. The new rule will replace FINRA Rules 3270, governing outside business activities of registered persons, and 3280, governing private securities transactions of associated persons. The consolidation narrows routine reporting while putting a more explicit risk assessment around investment-related conduct.

Approval is not the same as implementation. FINRA has said that it will announce Rule 3290’s effective date in a Regulatory Notice. As of September 21, the effective date had not been identified in the primary materials reviewed for this article. Firms should continue applying Rules 3270 and 3280 until the transition becomes effective and should not treat the SEC approval order as immediate permission to stop collecting existing disclosures.

A narrower perimeter, not an end to outside-activity review

Rule 3290 focuses on “investment-related activity,” a broad concept covering financial assets including securities, crypto assets, commodities, derivatives, currency, banking, real estate, and insurance. It includes association with financial businesses and participation in personal investments involving securities transactions, subject to exclusions.

That focus means low-risk non-investment activities such as bartending or refereeing sports generally move outside the rule. The change can reduce noise in annual questionnaires and compliance queues. It does not justify ignoring a side venture merely because it uses unfamiliar technology or a different legal wrapper. A crypto consultancy, real estate syndication, insurance role, money-services business, or private financing arrangement may be investment-related even if the employee does not describe it that way.

For a registered person’s outside activity that is investment-related but not connected to a securities transaction, prior written notice is required. The notice must describe the activity and the person’s role, and material changes require an update. The member then assesses at least whether the activity is actually an outside securities transaction, involves the person’s customer, compromises responsibilities to the firm or customers, or may be viewed by customers or the public as the firm’s business. The firm may condition, limit, or prohibit it. Conditions and limitations carry an express duty of reasonable supervision.

Outside securities transactions receive different treatment

An associated person proposing an outside securities transaction must provide detailed prior written notice, identify the proposed role, and state whether selling compensation will be received. Selling compensation is defined broadly as direct or indirect compensation from any source in connection with or resulting from the purchase, sale, or exchange of a security.

When there is no selling compensation, the firm provides prompt written acknowledgment and may impose conditions. When selling compensation is involved, prior written approval is required. The member must decide in writing whether to approve, approve with conditions, or disapprove after the required assessment. An approved compensated transaction must be recorded on the firm’s books and supervised as if executed on its behalf.

This structure makes classification consequential. An intake form that asks only whether an employee has a “side job” will not gather enough information. It should capture the assets involved, transaction activity, customers, compensation from all sources, use of firm resources or branding, role in solicitation or recommendations, and anticipated changes. Compliance reviewers need a documented way to challenge an employee’s label.

Exclusions and special treatments require precise coding

Rule 3290 excludes activity on behalf of the member or an affiliate, certain uncompensated securities transactions among immediate family, specified personal investments, and qualifying residential-property activity. Activity under a contract between a member and another entity, such as a banking or insurance networking arrangement, may fall within the person’s relationship with the member and remain subject to ordinary broker-dealer supervision under Rule 3110.

The rule also treats some activities specially. Acting only as a portfolio manager or investment committee member for specified entities is treated as an outside activity rather than an outside securities transaction, although selling their shares changes the analysis. Work at an unaffiliated SEC- or state-registered investment adviser is treated as an outside activity, which removes the prior guidance-based obligation to supervise and keep records of that advisory activity itself. Certain securities activity under bank exceptions in the Gramm-Leach-Bliley Act or Regulation R is treated as an outside activity, requiring notice and assessment but not member supervision or recordkeeping of the activity itself. If the firm imposes conditions or limitations, however, it must reasonably supervise compliance with those conditions, and the firm remains responsible for preserving its Rule 3290 compliance record.

These distinctions should appear in workflow logic and reviewer guidance. A single “approved” status can conceal whether the firm acknowledged an uncompensated transaction, approved compensated selling, imposed conditions, or concluded that an exclusion applies.

Transition work should start with data

Firms can prepare without prematurely applying the new rule. First, inventory current Rule 3270 and 3280 records and map them to Rule 3290 categories. Identify compensated transactions, customer involvement, imposed conditions, unaffiliated advisory work, affiliate activities, and records that may fit an exclusion.

Second, revise disclosure forms and annual attestations. Questions should use examples and ask for material changes, rather than requiring employees to make legal classifications. Third, create assessment templates covering the mandatory factors and a reasoned approval record. Fourth, assign supervision for every condition or limitation and ensure alerts can be tested. Fifth, update training for associated persons, supervisors, compliance reviewers, and business leaders.

Finally, preserve the record of compliance for the period and accessibility required by Exchange Act Rule 17a-4(e)(1). A migration should not erase the reasoning behind prior decisions. FINRA staff also may grant exemptions for good cause under the Rule 9600 Series, but firms should not design a baseline program around possible relief.

Rule 3290 is best understood as a reallocation of attention. It removes lower-risk non-investment activity from a prescriptive reporting framework while requiring firms to identify and document the financial activities most likely to create customer confusion, conflicts, or unsupervised securities business. The quality of the transition will depend less on shortening a questionnaire than on improving classification, escalation, and ownership.

Updating your firm’s outside-activities program? Contact Braeden Anderson to discuss the implications for supervisory procedures, disclosure forms, approval workflows, and implementation planning. Plan your Rule 3290 transition.

The SEC has approved FINRA Rule 3290, the long-running effort to modernize FINRA's outside-business-activity and private-securities-transaction framework.

But approval is not the same thing as effectiveness.

The SEC issued its approval order on September 15, 2026. FINRA has said that it will establish and announce the effective date separately. Until that implementation step occurs, firms should continue to apply the currently effective Rules 3270 and 3280.