FINRA Rule 3290 Approved: Rebuild Your Outside Activities Program Before the Effective Date

TL;DR

• The SEC approved FINRA Rule 3290 on September 15, 2026. It will replace Rules 3270 and 3280 with one framework for outside investment-related activities and outside securities transactions.
• The new rule drops routine reporting of non-investment side jobs, but it does not weaken controls over selling away, compensated outside securities transactions, crypto, insurance, real estate, or other financial-asset activity.
• The effective date is not set. FINRA will announce it separately, so firms should run a controlled conversion while continuing to apply the current rules.
• The biggest implementation risk is not the policy rewrite. It is bad classification logic: treating every activity the same, deleting legacy records too early, or failing to supervise conditions the firm imposed.

FINRA Rule 3290 is approved. The long-running proposal to consolidate outside business activities and private securities transactions is no longer a “watch the rulemaking” item. It is now a program-conversion project waiting for an effective date.

In a September 16 update, FINRA confirmed that the SEC had approved the rule the prior day. New Rule 3290 will replace Rule 3270, which governs outside business activities of registered persons, and Rule 3280, which governs private securities transactions of associated persons.

The important nuance: the SEC’s approval order, Release No. 34-106381, did not establish an effective date. FINRA said it will announce that date in a regulatory notice. Until then, the current rules remain the operating standard.

That gives Compliance time to build the transition correctly. It does not justify waiting.

What FINRA Rule 3290 changes

FINRA’s Rule 3290 filing page describes the goal as focusing member oversight on outside activities that create heightened risk while reducing unnecessary burden. The approved framework has two main lanes:

1. Outside investment-related activities of registered persons; and
2. Outside securities transactions of associated persons.

That structure preserves much of the current notice, assessment, approval, supervision, and recordkeeping architecture. The scope and classification rules change.

The phrase investment-related activity is broader than “securities.” The SEC order says it pertains to financial assets including securities, crypto assets, commodities, derivatives such as futures and swaps, currency, banking, real estate, and insurance. That means firms should not translate “narrower reporting” into “brokerage products only.”

The rule reduces noise. It also raises the cost of getting the remaining classifications wrong.

The four-factor assessment becomes the center of the file

For an outside activity, the member must assess at least whether it:

• is actually an outside securities transaction;
• involves a customer of the registered person;
• will interfere with or compromise the person’s duties to the firm or its customers; and
• could be viewed by customers or the public as part of the firm’s business, considering the activity and how it is offered.

The same core questions apply when assessing an outside securities transaction, with additional consequences based on selling compensation.

This is where the intake form has to do real work. A free-text box labeled “describe your outside activity” will not reliably capture customer overlap, compensation, transaction involvement, public presentation, crypto assets, referral arrangements, or the representative’s actual role.

A better questionnaire uses branching logic:

The last row matters because Rule 3290 makes explicit what firms often handle casually: if the member imposes conditions or limitations, it must reasonably supervise compliance with them.

“Approved, provided you do not solicit firm clients” is not a complete control. Who compares the outside business’s clients to the firm’s customer list? How often? What evidence is retained? What happens when a match appears? If those questions have no owner, the condition is decorative.

Selling compensation still drives the hardest obligations

For outside securities transactions, the associated person must provide prior written notice describing the transaction, the person’s role, and whether selling compensation will be received. Selling compensation is defined broadly as compensation paid directly or indirectly in connection with or as a result of purchasing, selling, or exchanging a security.

Where selling compensation exists, the representative needs prior written firm approval. An approved transaction must be placed on the firm’s books and records, and the firm must supervise the person’s participation as if the transaction were executed on behalf of the firm.

That is the control line separating a low-complexity acknowledgment from a substantial supervisory commitment.

A reviewer should trace compensation rather than accept labels. Equity, referral fees, consulting fees, revenue sharing, carried interest, debt forgiveness, tokens, and payments to an entity controlled by the representative can all require closer analysis. “Unpaid” also deserves challenge when the person expects future compensation or receives an indirect economic benefit.

The site’s earlier analysis of an SEC case involving undisclosed compensation and outside activities shows why that tracing matters: the compliance issue often sits in the relationship among the representative, an affiliated entity, the customer, and the payment flow—not in the title on the disclosure form.

Some activities move categories rather than disappear

Rule 3290 does more than combine two rule numbers. It changes how certain activity is characterized.

For example, activity at an unaffiliated registered investment adviser is treated as an outside activity rather than an outside securities transaction. The approval order explains that the change removes the old expectation that the broker-dealer supervise and keep records for advisory activity at the unaffiliated RIA, an arrangement that created practical and privacy problems where the broker-dealer lacked the information needed for meaningful supervision.

The activity still receives notice and assessment treatment. It is not invisible.

The rule also provides specific handling for portfolio manager or investment committee roles, activities under certain bank exceptions, affiliate activity, immediate-family transactions without selling compensation, personal investments covered by Rule 3210, personal non-securities investments, and limited personal real-estate activity.

Do not reduce these to a one-page employee FAQ. Classification decisions need a documented rule map because two activities that sound similar can generate different firm obligations.

The effective-date gap needs dual controls

A commenter asked for at least 12 months after SEC approval so firms could update systems built around Rules 3270 and 3280. The SEC order notes that FINRA declined to set the date in the proposal and will balance implementation time against timely burden reduction.

Until FINRA publishes the regulatory notice, firms need dual-state governance:

• Current state: continue enforcing Rules 3270 and 3280.
• Future state: design the Rule 3290 process, data model, policy, training, and migration.
• Change trigger: assign Regulatory Change Management to monitor and evidence the eventual notice and effective date.
• Release gate: do not switch forms, delete categories, or close old supervisory tasks before the approved implementation date.

The human failure mode is easy to predict. Representatives hear “non-investment side jobs no longer reportable,” stop reporting them immediately, and managers assume the burden reduction is already live. Training should state the transition date in the first paragraph and explain that firm policy may remain broader than the FINRA minimum.

A defensible Rule 3290 conversion plan

1. Inventory every dependency

Owner: CCO and Compliance Operations

Find every place where “3270,” “3280,” “OBA,” “PST,” “selling away,” or “outside activity” appears:

• written supervisory procedures;
• employee and representative attestations;
• onboarding and annual certification forms;
• case-management workflows;
• branch examination modules;
• training and job aids;
• code-of-ethics documents;
• surveillance and customer-matching reports;
• vendor rules and field names; and
• books-and-records schedules.

This is a search-and-reconcile exercise, not a policy-only update. The same lesson appears in today’s off-channel communications control analysis: a written prohibition does little when the operating systems, supervision, and evidence trail do not enforce it.

2. Build the classification decision tree

Owner: Compliance Advisory with Legal

Start with four questions:

1. Is the person registered, associated, or both?
2. Does the activity pertain to a financial asset?
3. Is the person participating in a securities transaction?
4. Is selling compensation involved?

Then apply the rule’s exclusions and activity-specific provisions. Require a legal escalation for ambiguous crypto, real estate, insurance, referral, and advisory arrangements. Preserve both the submitted facts and the classification rationale.

3. Convert open cases without losing history

Owner: Compliance Operations and Records Management

Create a crosswalk for every active disclosure:

Never mass-close “non-investment” records based on title alone. A representative’s “consulting company” may provide ordinary strategy work—or solicit investors for private offerings. The underlying facts control.

4. Turn approval conditions into testable controls

Owner: Supervisory Principals

For each condition, store:

• the prohibited or required behavior;
• the control owner;
• the monitoring source;
• the review frequency;
• evidence retained;
• the breach escalation; and
• the next review date.

A condition against using firm customers could use periodic customer-name matching plus branch-manager certification. A condition against firm branding could use scheduled website and social-profile reviews. A compensation limitation could require annual tax-form or payment-ledger certification where legally appropriate. The method should match the risk and privacy constraints.

5. Test before the rule goes live

Owner: Compliance Testing or Internal Audit

Run sample cases through both the legacy and future workflows. Include:

• a non-financial second job;
• an insurance sales role;
• a crypto advisory business;
• uncompensated immediate-family securities activity;
• compensated private-placement participation;
• an unaffiliated RIA role;
• a personal rental property; and
• an affiliate assignment.

The test should verify classification, notices, approvals, supervisory conditions, record creation, customer conflicts, and management reporting. Record defects as conversion issues with owners and due dates—not as comments buried in a testing memo.

What should the CCO ask Monday morning?

Ask for five artifacts:

1. The complete Rules 3270/3280 dependency inventory.
2. The draft Rule 3290 classification tree.
3. A count of open disclosures by proposed migration category.
4. A register of every current approval condition and its monitoring owner.
5. The regulatory-change ticket assigned to capture FINRA’s effective-date notice.

If the team can produce only a revised policy draft, the implementation has barely started.

Rule 3290 is genuinely deregulatory for low-risk, non-investment side work. That is useful. The trade is that firms should have fewer excuses for shallow reviews of the investment-related activity that remains. Less intake volume should produce better classification, better compensation tracing, and supervision that can be proven.

Use an Issues Management Tracker to run the Rule 3290 conversion as a controlled remediation—with dependencies, owners, due dates, testing evidence, and closure approval—rather than a chain of policy edits in email.

Primary sources: FINRA’s September 16 announcement | SEC approval order | FINRA Rule 3290 filing and amendment record