On September 15, 2026, the SEC approved FINRA Rule 3290 (Outside Activities Requirements). The new rule will replace FINRA Rules 3270, Outside Business Activities (OBAs) of Registered Persons, and FINRA Rule 3280, Private Securities Transactions (PST) of an Associated Person, once it becomes effective.
Background
Rule 3290 replaces two long-standing rules:
- Rule 3270: OBAs of Registered Persons
- Rule 3280: Private Securities Transactions of an Associated Person
The change is part of FINRA’s broader FINRA Forward rule-modernization initiative.
What Does FINRA Rule 3290 Change?
1. Narrows FINRA Requirements for Certain Outside Activities
Rule 3290 focuses on investment-related activities and generally removes FINRA’s baseline notice, assessment, and supervision requirements for non-investment-related outside activities. Firms may still apply broader internal controls based on their own risk assessment.
2. Focuses on Investment-Related Activity
Registered persons must continue to provide prior written notice before participating in investment-related outside activities. The rule defines investment-related activity as activity pertaining to financial assets, including securities, crypto assets, commodities, derivatives, currency, banking, real estate, and insurance.
3. Changes the Treatment of Activity at Unaffiliated RIAs
Advisory activity at an unaffiliated RIA will be treated as an outside activity rather than an outside securities transaction. Firms must still receive notice and assess the activity, but Rule 3290 removes the broker-dealer’s supervision and recordkeeping obligations for the advisory activity itself. Firms may still impose conditions or limitations based on their risk assessment.
4. Preserves Heightened Requirements for Securities Transactions Involving Selling Compensation
Outside securities transactions involving compensation remain subject to the rule’s most stringent requirements. Firms must notify the associated person in writing whether they approve or disapprove the person’s participation in the transaction. If approved, the firm must record the transaction and supervise the person’s participation as if the transaction were executed on behalf of the firm.
5. Sets a Floor, Not a Ceiling
Rule 3290 establishes minimum requirements and does not prevent firms from applying broader assessments or stricter internal requirements, particularly where reputational or legal risk is elevated.
Effective Date
FINRA has not yet announced Rule 3290’s effective date. Firms should not treat the rule as effective until FINRA announces that date. FINRA Rules 3270 and 3280 remain in effect until Rule 3290 becomes effective.
What This Means for Firms
Although Rule 3290 is intended to streamline certain requirements, firms should begin assessing the operational and policy updates that may be needed before the rule becomes effective.
- Written supervisory procedures (WSPs) governing OBA/PST intake, review, and approval should be reviewed to determine whether updates are needed to reflect the new investment-related activity definition and the narrowed scope of required disclosures.
- Intake and attestation forms/questionnaires used for new hires and annual/periodic certifications should be reviewed to determine which information remains necessary under Rule 3290 and the firm’s internal policies.
- Supervisory workflows tied to registered persons’ advisory activity at unaffiliated RIAs should be reassessed in light of the clarified and reduced supervisory obligation.
- Training for registered persons, office of supervisory jurisdiction/branch managers, and compliance staff should be refreshed so that outside activity determinations under the new rule are applied consistently.
- Books and records practices for approved compensated securities transactions should be reviewed to confirm they still meet the rule’s heightened treatment.
Firms with broader-than-required outside business activity and private securities transaction frameworks should assess whether to retain those controls or align their processes more closely with Rule 3290’s baseline requirements.
How ACA Can Help
ACA’s regulatory and compliance advisory teams can help firms prepare for and transition to Rule 3290 by:
- Reviewing procedures for OBAs and PSTs
- Reviewing OBA/PST intake forms, attestations, and approval workflows
- Reviewing supervisory frameworks for advisory activity at unaffiliated RIAs
- Benchmarking OBA/PST programs against the new rule
- Training staff on the rule before its effective date
- Tracking FINRA guidance to support implementation planning
For questions on how Rule 3290 affects your firm’s compliance program, please contact us or reach out to your existing ACA contact.