What Just Happened
On September 15, 2026, the SEC approved FINRA Rule 3290 (Outside Activities Requirements) — a full overhaul of how broker-dealers supervise registered persons' outside activities and private securities transactions. The approval order, Release No. 34-106381, was published in the Federal Register on September 18, 2026. In a September 16 update, FINRA confirmed the approval. The rule replaces two long-standing pillars of your supervision framework: Rule 3270 (Outside Business Activities of Registered Persons) and Rule 3280 (Private Securities Transactions of an Associated Person). That two-rule structure has been in place since the early 1990s and has not meaningfully changed since FINRA undertook a retrospective review of both rules in 2017.
The critical timing detail: the SEC's approval order did not establish an effective date. FINRA has said it will announce the effective date in a separate regulatory notice. Until that notice drops, Rules 3270 and 3280 remain the operating standard. That window is your implementation runway — but it is not an invitation to wait.
Why the Old Framework Was Broken
The problem with Rules 3270 and 3280 was structural. Rule 3270 required registered persons to provide prior written notice before engaging in any outside business activity — the language swept in side jobs with no investor-protection relevance, like driving for a ride-share service. Rule 3280 separately governed private securities transactions, requiring written notice and, where selling compensation was involved, member approval, books-and-records treatment, and supervision. Firms were forced to classify each outside role as either an OBA or a PST, a distinction that became especially difficult for investment advisory activity conducted at unaffiliated RIAs. Over time, the dual structure became duplicative and not always aligned with actual risk. The practical result: compliance teams spent meaningful resources processing low-risk disclosures instead of concentrating supervision where investor harm is most likely.
What Rule 3290 Changes
Rule 3290 reorganizes the framework around a single, risk-focused concept: 'investment-related activity.' Rather than requiring notice and review for any and all outside business activities, the new rule focuses on activities pertaining to financial assets such as securities, crypto assets, commodities, derivatives (such as futures and swaps), currency, banking, real estate, and insurance. That definition is intentionally broad — it is not limited to stocks and bonds.
The approved framework operates in two lanes. First, outside investment-related activities of registered persons: registered persons must provide prior written notice, and the firm must assess and confirm those activities. Second, outside securities transactions of associated persons: all associated persons (not just registered persons) must give prior written notice of outside securities transactions — this is the core selling-away control, and it is preserved intact under Rule 3290. For compensated outside securities transactions, the firm must still decide whether to approve or disapprove, communicate that determination in writing, and if it approves, record the transaction and supervise it as if executed on behalf of the member.
What Rule 3290 Does Not Change
This is the most important thing for CCOs to internalize: Rule 3290 is a re-targeting, not a deregulation. The new rule drops the requirement to report routine non-investment side jobs — the 'white noise' disclosures that clogged review queues — but it does not weaken controls over selling away, compensated outside securities transactions, crypto-asset business ventures, insurance activities, real estate-related financial activity, or roles with broker-dealers, issuers, investment advisers, or funds. Your supervision and recordkeeping obligations for high-risk outside activity remain substantially intact.
Rule 3290 also preserves FINRA's existing expectation that firms investigate and respond to red flags under Rule 3110 (Supervision). Approval of an activity upfront does not discharge that ongoing obligation.
Key Exclusions Worth Knowing
Rule 3290 introduces explicit exclusions that did not exist in Rules 3270 or 3280. Activity performed on behalf of the member or an affiliate — including investment advisory activity conducted for a dually registered broker-dealer/investment adviser — is excluded from the rule's coverage entirely. Personal investments in non-security crypto assets (for example, bitcoin held personally) are also expressly excluded from Rule 3290, meaning no notice or approval is required. However, business ventures related to crypto assets — such as promoting or selling crypto assets away from the firm — remain outside activities subject to the rule. Similarly, personal investments in non-securities are excluded, as are the purchase, sale, rental, or lease of a primary residence and up to two secondary homes meeting specified ownership criteria.
The Implementation Risk Nobody Is Talking About
The biggest compliance failure waiting to happen under Rule 3290 is not a policy gap — it is bad classification logic applied during the transition. Firms that treat every activity the same way they did under Rules 3270 and 3280 will either over-report (wasting resources) or under-report (creating supervision gaps). The riskiest scenario: deleting or archiving legacy OBA and PST records too early, before FINRA's effective-date notice confirms when the old rules stop applying. Rules 3270 and 3280 remain in force until that notice is issued, so your books-and-records obligations under those rules continue to run.
A related risk applies to dually registered firms. Under the old framework, classifying a registered person's IA activity at an unaffiliated adviser as either an OBA or a PST was genuinely ambiguous and expensive to manage. Rule 3290 resolves some of that ambiguity — unaffiliated IA activity is now treated as an outside activity subject to notice and upfront assessment rather than full supervision and recordkeeping. But for affiliated IA activity, the exclusion applies and no reporting is required under Rule 3290 at all. Firms with complex dual-registration or hybrid structures should map their current roster against these two outcomes before the effective date arrives.
What to Do Now
Run a gap analysis on your current disclosure inventory. Pull every active OBA and PST disclosure on file. Classify each one under the Rule 3290 framework: does it involve investment-related activity as defined (financial assets including securities, crypto, commodities, derivatives, currency, banking, real estate, or insurance)? If not, it will not require a disclosure under the new rule. If yes, determine which lane applies — outside investment-related activity (registered persons) or outside securities transaction (all associated persons) — and confirm whether selling compensation is involved.
Do not retire old disclosures or records prematurely. Rules 3270 and 3280 are still operative. Consider retaining all current records at least through the end of the year and until FINRA issues its effective-date regulatory notice.
Redraft your written supervisory procedures now. Your WSPs referencing Rules 3270 and 3280 will need to be rewritten. Consider beginning that draft now so your legal and compliance team has time for a clean review before the effective date. The prior written notice and assessment requirements for investment-related outside activities, and the approval/supervision/recordkeeping requirements for compensated outside securities transactions, must be clearly reflected.
Revisit your disclosure forms and questionnaires. The questions you ask registered persons during onboarding and annual attestations will need to shift from 'any outside business activity' to 'any outside investment-related activity.' Consider whether your current annual questionnaire captures crypto-asset business ventures, real estate syndication roles, insurance sales at non-affiliates, and roles with unaffiliated investment advisers — all of which remain in scope.
Flag the open effective-date question. Set a FINRA regulatory notice alert now. The clock on your implementation timeline does not start until FINRA publishes that notice. Monitor finra.org/rules-guidance/notices and build the effective-date notice into your compliance calendar the day it drops.
Note for dually registered firms and RIA/BD hybrids. If your registered persons conduct IA activity through an affiliate of your BD, that activity is fully excluded from Rule 3290 reporting. If the IA is unaffiliated, it is an outside activity requiring notice and assessment but not full Books and Records supervision under the new framework. Consider documenting that classification analysis in your WSPs now.
Bottom Line
FINRA Rule 3290 is approved and real — Release No. 34-106381 is on the Federal Register. The effective date is not yet set, which means the interval between now and that regulatory notice is the most valuable implementation window you will get. Use it to reclassify your existing disclosures, rebuild your WSPs around the new investment-related-activity standard, and update your disclosure forms. The rule is designed to reduce low-risk reporting burden, but the firms that benefit will be the ones that do the reclassification work before the effective date — not after an examination.