SEC Approves FINRA Rule 3290: New Outside Activities Requirements

The U.S. Securities and Exchange Commission (“SEC”) has approved the Financial Industry Regulatory Authority (“FINRA”) new framework for the outside activities of associated persons, clearing the way for a significant change in how broker-dealers oversee outside business activities and private securities transactions.

On September 15, 2026, the SEC approved new FINRA Rule 3290, Outside Activities Requirements. 

The rule will replace two existing rules: Rule 3270, Outside Business Activities of Registered Persons, and Rule 3280, Private Securities Transactions of an Associated Person.

The new rule is part of FINRA’s broader rule modernization efforts and is intended to reduce unnecessary compliance burdens while preserving investor protections. Among its most significant changes, Rule 3290 narrows the outside activities that registered persons must report by focusing primarily on investment-related activities rather than requiring reporting of many non-investment-related outside business activities.

FINRA will issue a separate Regulatory Notice announcing the effective date. In the meantime, broker-dealers should begin assessing how the new framework may affect their policies, disclosure processes, supervisory procedures, and employee training.

What Is FINRA Rule 3290?

FINRA Rule 3290 consolidates and modernizes requirements currently addressed separately under Rules 3270 and 3280.

Under the existing framework, Rule 3270 generally governs outside business activities of registered persons, while Rule 3280 addresses private securities transactions conducted by associated persons outside the regular scope of their employment with a member firm.

Rule 3290 brings these areas under a single framework while retaining distinct requirements for two primary categories:

1. Outside investment-related activities of registered persons
2. Outside securities transactions of associated persons

The SEC approved the new rule under File No. SR-FINRA-2026-001 on September 15, 2026.

For broker-dealers, the consolidation should make it easier to focus supervisory resources on outside activities presenting greater regulatory and investor-protection risks.

Why Is FINRA Replacing Rules 3270 and 3280?

FINRA’s existing outside activities framework can require firms to collect, evaluate, document, and supervise a wide range of outside activities, including activities with little connection to the securities industry.

Rule 3290 is designed to establish a more risk-based approach.

One of the most consequential changes is the narrowing of reportable outside activities from general outside business activities to investment-related activities.

Under the approved rule, investment-related activity encompasses activities pertaining to financial assets, including securities, crypto assets, commodities, derivatives such as futures and swaps, currency, banking, real estate, and insurance.

This allows firms to direct more of their compliance resources toward activities that may create conflicts, customer confusion, or other investor-protection concerns.

Non-Investment-Related Outside Activities Will Generally No Longer Require Reporting

Under Rule 3290, registered persons generally will no longer be required by the FINRA rule to report outside activities that are unrelated to investments.

For example, FINRA specifically discussed activities such as bartending or refereeing sporting events as lower-risk activities that would fall outside the new reporting framework.

This represents a meaningful change from Rule 3270, which applies more broadly to compensated outside business activities.

Importantly, FINRA’s minimum requirements do not prevent a member firm from maintaining broader internal disclosure requirements. Firms may establish stricter criteria based on their own business model and assessment of risk.

Broker-dealers should therefore consider whether their existing outside business activity questionnaires and disclosure systems should simply be narrowed to match Rule 3290 or whether maintaining broader internal reporting remains appropriate.

Outside Investment-Related Activities Remain Subject to Oversight

The streamlined framework does not eliminate oversight of outside activities that present meaningful financial or investor-protection concerns.

A registered person intending to participate in an outside investment-related activity must generally provide prior written notice to the member firm and describe the proposed activity and the individual’s role in detail.

The registered person must also update previously submitted information when there is a material change to the activity.

After receiving notice, the broker-dealer must assess factors including whether the activity:

• Is actually an outside securities transaction
• Involves a customer of the registered person
• Could interfere with or compromise the person’s responsibilities to the firm or its customers
• Could be viewed by customers or the public as part of the member firm’s business

Based on that assessment, the member must determine whether to permit, limit, condition, or prohibit the activity.

These responsibilities make accurate classification of outside activities particularly important.

What Happens to Private Securities Transactions Under Rule 3290?

Private securities transactions are not simply disappearing with the retirement of Rule 3280.

Instead, Rule 3290 creates requirements for what it defines as outside securities transactions, meaning investment-related activities outside the scope of an associated person’s relationship with the member that are conducted in connection with a securities transaction.

An associated person intending to participate in an outside securities transaction generally must provide prior written notice describing the proposed transaction, the person’s role, and whether selling compensation will be received.

The firm’s obligations then vary depending on the nature of the transaction.

Outside Securities Transactions Without Selling Compensation

For qualifying transactions in which the associated person will not receive selling compensation, the member generally must provide prompt written acknowledgment of the notice. The firm may also impose conditions or limitations on the person’s participation.

Outside Securities Transactions With Selling Compensation

Requirements are more extensive when selling compensation is involved.

The associated person must obtain the member’s prior written approval. The member must determine whether to approve the transaction, approve it subject to specified conditions or limitations, or disapprove it.

If approved, the member generally must record the transaction on its books and records and supervise the associated person’s participation as if the transaction were executed on behalf of the member.

This maintains substantial investor-protection and supervisory requirements for higher-risk outside securities activity.

Certain Activities Are Excluded From Rule 3290

The new framework also excludes certain activities from its requirements.

Among the exclusions discussed as part of the approved rule are certain activities conducted by associated persons on behalf of a member firm’s affiliate, certain personal real estate activities, and personal investments involving non-securities.

These exclusions are another way FINRA is attempting to direct compliance resources toward activities that present greater potential risks to firms and investors.

However, exclusions should not be interpreted as permission to ignore potential compliance concerns. Firms remain responsible for investigating red flags and complying with other applicable securities laws, regulations, and FINRA rules.

Rule 3290 Does Not Eliminate Firm Supervision

The streamlined approach should not be confused with eliminating broker-dealer responsibility.

Rule 3290 preserves important obligations involving notice, assessment, approval, supervision, and recordkeeping, depending on the activity involved.

If a firm permits an outside activity or outside securities transaction subject to conditions or limitations, the firm must reasonably supervise compliance with those conditions or limitations.

FINRA has also made clear that member firms may adopt requirements exceeding the minimum requirements established by Rule 3290.

This means each broker-dealer will need to determine how the new rule fits within its own risk profile and broader broker-dealer compliance program.

What Should Broker-Dealers Do Before Rule 3290 Takes Effect?

The SEC’s approval changes the conversation from evaluating a proposal to preparing for implementation.

Although FINRA has not yet announced the effective date, firms can begin reviewing their current processes now.

Potential preparation steps include:

• Review Written Supervisory Procedures addressing outside business activities and private securities transactions
• Identify policies that currently reference Rules 3270 and 3280
• Review employee outside activity questionnaires and disclosure forms
• Determine which existing disclosure categories will no longer be required under Rule 3290
• Establish procedures for identifying investment-related activities
• Review processes for outside securities transactions involving selling compensation
• Evaluate how material changes to previously disclosed activities will be reported
• Determine when the firm will impose conditions, limitations, or prohibitions
• Establish procedures for supervising compliance with those conditions
• Review applicable books and records requirements
• Train registered and associated persons on the new framework
• Determine whether the firm wishes to maintain internal requirements broader than FINRA’s minimum standards

Firms should also review existing outside activities rather than assuming every activity previously approved under Rules 3270 or 3280 will receive identical treatment under the new framework.

What Does Rule 3290 Mean for Associated Persons?

For many registered persons, the most noticeable change may be the reduced reporting burden for non-investment-related activities.

At the same time, individuals participating in investment-related outside activities or securities transactions will continue to have important disclosure responsibilities.

Associated persons should understand that Rule 3290 differentiates among activities based on their nature and risk. Requirements may also differ depending on whether an individual is a registered person or another associated person and whether an outside securities transaction involves selling compensation.

Firms should make these distinctions clear when updating training and disclosure procedures.

A More Risk-Based Approach to Outside Activities

Rule 3290 represents a shift toward concentrating broker-dealer compliance resources on outside activities that are more closely connected to financial assets, securities transactions, customers, and potential investor harm.

For compliance teams, that creates an opportunity to simplify some processes. It also creates implementation work.

Policies, forms, supervisory systems, employee training, and existing outside activity records may need to be reviewed so that firms can take advantage of the streamlined framework without inadvertently overlooking activities that remain subject to oversight.

Quadrant’s compliance professionals assist broker-dealers with interpreting regulatory developments and implementing compliance programs tailored to their operations.

Key Takeaways

The SEC’s approval of FINRA Rule 3290 represents a significant modernization of FINRA’s outside activities requirements.

The most important points for broker-dealers are:

• Rule 3290 will replace FINRA Rules 3270 and 3280.
• The new framework focuses outside activity reporting on investment-related activities.
• Many non-investment-related outside activities will no longer be subject to FINRA’s reporting requirement.
• Outside securities transactions remain subject to notice and supervisory requirements.
• Transactions involving selling compensation continue to carry heightened obligations.
• Firms retain the ability to establish requirements that are stricter than Rule 3290’s minimum standards.
• Broker-dealers should prepare to update WSPs, disclosure forms, supervisory processes, and employee training.
• FINRA will announce the effective date in a forthcoming Regulatory Notice.

Prepare for FINRA Rule 3290 With Quadrant Regulatory Group

The transition from Rules 3270 and 3280 to Rule 3290 may require changes to Written Supervisory Procedures, outside activity forms, employee training, supervisory controls, and existing compliance workflows.

Contact Quadrant Regulatory Group to discuss how the new requirements may affect your firm. Our experienced compliance professionals can help your broker-dealer evaluate its current procedures, identify necessary updates, and prepare for implementation once FINRA announces the effective date.