Introduction
In 2025, the Financial Industry Regulatory Authority (“FINRA”) issued Regulatory Notice 25-05, proposing new Rule 3290 to modernize and consolidate its long-standing requirements for outside business activities (“OBAs”) and private securities transactions (“PSTs”). The proposal was intended to replace FINRA Rules 3270 and 3280 with a single, risk-focused framework centered on investment-related outside activities.
FINRA has now submitted its proposed Rule 3290 to the U.S. Securities and Exchange Commission (“SEC”) for approval through a formal rule filing. This alert compares the original proposal described in Regulatory Notice 25-05 with the rule text and approach in the filed proposal, highlighting what has changed and what remains the same.
For a more detailed discussion of FINRA’s original proposal, including background, policy rationale, and a full summary of the proposed supervisory and reporting framework, read our prior LeGaye Law regulatory alert, FINRA Proposes Rule 3290 to Streamline Oversight of OBAs and PSTs, available here. That alert analyzes the proposal as originally published in FINRA Regulatory Notice 25-05 and provides additional context for firms evaluating how Rule 3290 may reshape existing outside business activity and private securities transaction compliance programs.
Significant Shift in the Final Proposed Rule
The rule proposal largely preserves the structure proposed in Regulatory Notice 25‑05. However, the final proposal clarifies several important issues based on industry feedback.
First, activities conducted by associated persons at unaffiliated registered investment advisers are treated as OBAs rather than PSTs, unless the activity otherwise constitutes a securities transaction for compensation. Notably, under the proposed FINRA Rule 3290, as currently filed with the SEC, “compensation” that triggers the additional approval/supervision requirements refers to compensation tied to securities transaction activity, such as selling or transaction-related fees, including commissions, success fees, and placement fees, not advisory fees earned solely through providing investment advice in an unaffiliated investment adviser. This clarification reduces uncertainty for dual‑hatted professionals and firms with unaffiliated advisory arrangements.
The final proposal also refines exclusions for certain personal and family transactions and clarifies how certain bank networking arrangements and Reg R/GLBA exceptions are treated for classification purposes. These changes are intended to improve consistency in firm determinations and reduce unnecessary supervisory obligations where other regulatory regimes apply.
From Two Rules to One: Consolidation
In Regulatory Notice 25-05, FINRA proposed eliminating the long-standing two-rule structure governing outside activities by deleting Rule 3270, which addresses outside business activities, and Rule 3280, which governs private securities transactions, and replacing both with a single, unified rule. FINRA explained that this consolidation was intended to reduce unnecessary operational complexity and regulatory overlap, and to enable firms to apply a single, coherent supervisory framework to outside activities that pose meaningful regulatory and investor protection risks. In the rule change subsequently filed with the SEC, FINRA retained this structural approach by continuing to eliminate Rules 3270 and 3280 and replacing them with a consolidated set of “Outside Activities Requirements” under proposed Rule 3290, built around a single notice, assessment, approval, and supervision model.
As a practical matter, FINRA has not retreated from its central consolidation objective. The SEC-filed proposal confirms that firms should expect a single, unified supervisory and compliance structure for associated persons outside activities, rather than parallel and sometimes duplicative OBA and private securities transaction regimes. Operationally, firms should anticipate the need for coordinated policy rewrites, new disclosure and approval workflows, and revised supervisory procedures to integrate the two separate compliance frameworks into a single, standardized outside-activities program under Rule 3290.
A Sharper Focus on “Investment-Related” Activities
In Regulatory Notice 25-05, FINRA proposed a fundamental shift in how broker-dealers identify and review outside activities by narrowing required disclosures and firm oversight to activities that are “investment-related.” Rather than continuing the long-standing OBA approach, which effectively captures almost any outside employment or business activity, the proposal focused the reporting framework on activities involving financial assets and investment products. FINRA described this concept broadly to include activities involving securities, digital and crypto assets, commodities, derivatives, real estate investments, insurance and annuity products, and related personal investment activity. By contrast, non-financial side businesses, and personal services, such as retail work, consulting unrelated to financial products, or other non-investment occupations, were generally intended to fall outside the scope of the rule.
In the proposed rule filed with the SEC, FINRA preserved this investment-related framework as the central organizing principle for the new Rule 3290. The filed proposal continues to rely on investment-related activity as the trigger for notice, firm assessment, and potential supervisory obligations, reflecting FINRA’s acknowledgement of extensive industry feedback that the existing outside business activity regime sweeps too broadly and captures a wide range of low-risk activities that present little or no investor protection or firm risk.
Clarifications and Exclusions Refined Through Industry Feedback
As part of its effort to streamline outside activity oversight and eliminate duplicative regulatory requirements, FINRA’s original proposal in Regulatory Notice 25-05 also identified several categories of activity that would be expressly excluded from the new Rule 3290 framework. Those exclusions included:
- Non-broker-dealer activities conducted on behalf of the member or its affiliates. The original proposal excluded non-broker-dealer activities performed by an associated person on behalf of the member firm or one of its affiliates. FINRA explained that these activities are already subject to the firm’s supervisory structure and internal controls and therefore do not pose the same risks as truly external activities. The exclusion was intended to avoid duplicative reporting and supervision when the activity is, in substance, part of the firm’s business.
- Immediate family transactions with no selling compensation. The proposal also excluded securities transactions involving immediate family members, in which the associated person does not receive selling compensation. FINRA recognized that uncompensated family transactions generally present a lower risk of conflicts, sales practice concerns, or investor harm, and therefore should not be subject to the full private securities transaction approval and supervision framework.
- Certain personal investments and transactions are already covered by other FINRA rules. Finally, the proposal excluded certain personal investment activity and transactions already addressed under other FINRA rules, including Rule 3210. This exclusion was designed to prevent overlapping reporting, approval, and supervisory obligations for accounts and transactions already regulated through existing compliance frameworks, and to reflect FINRA’s broader objective of reducing duplicative and unnecessary regulatory requirements.
In the rule change filed with the SEC, FINRA has largely retained the exclusions and clarifications originally proposed in Regulatory Notice 25-05, reinforcing the regulator’s stated objective of reducing duplicative compliance obligations and directing firm oversight toward higher-risk activities. This continuity provides firms with greater regulatory certainty that low-risk activities and activities already subject to other supervisory or regulatory frameworks are not intended to be swept back into a new reporting or approval regime under Rule 3290; however, firms should nevertheless establish and maintain clear internal documentation standards to support their determination and reliance on these exclusions.
Supervisory and Recordkeeping Obligations
In Regulatory Notice 25-05, FINRA made clear that when an associated person engages in an investment-related outside activity involving securities transactions for compensation, the firm must continue to supervise the activity and maintain records and supervisory controls comparable to those applicable to transactions conducted through the firm. In the rule change filed with the SEC, FINRA preserved this supervisory framework and reaffirmed that, where an outside activity resembles brokerage activity in substance, firm supervision and recordkeeping obligations remain central to the regulatory approach.
As a practical matter, FINRA has emphasized that consolidating the OBA and private securities transaction rules and narrowing the scope to investment-related activities are not intended to relax supervision where investor risk is present. Firms should continue to expect supervisory and recordkeeping responsibilities largely consistent with existing obligations for private securities transactions, even under the new unified rule. In effect, Rule 3290 shifts front-end filtering and classification of activities while preserving rigorous oversight for those that remain within the supervisory framework.
Comparison Summary: Changes Reflected in the Proposal
Compared to Regulatory Notice 25-05, the SEC-filed proposal reflects the following:
- The core framework remains intact and has not been materially restructured. FINRA has retained the consolidated rule structure, the investment-related activity standard, and the core supervisory model. This signals that the regulator viewed industry feedback as supporting refinement rather than a wholesale redesign.
- The narrowed, risk-based scope continues to be the foundation of the rule. The filed proposal confirms that FINRA intends to move firmly away from broad reporting of non-financial activities. This change is central to FINRA’s stated goal of aligning compliance efforts with actual regulatory risk.
- Clarifications and exclusions proposed in the original notice have been preserved with limited refinement. FINRA’s filing reflects continued reliance on exclusions for low-risk and duplicate activities. The proposal demonstrates FINRA’s effort to balance supervisory oversight with operational efficiency.
- Unaffiliated investment adviser activity and compensation standard. Activities conducted by associated persons at unaffiliated registered investment advisers are treated as OBAs rather than PSTs unless they involve a securities transaction for transaction-based compensation.
- Refined exclusions and regulatory classification clarifications. The final proposal refines exclusions for certain personal and family transactions and clarifies the classification of bank networking arrangements and Reg R/GLBA exceptions to improve consistency and reduce unnecessary supervisory obligations.
Bottom Line. The field proposal does not represent a substantive policy reversal from Regulatory Notice 25-05. Instead, it confirms FINRA’s commitment to consolidation, risk-focused reporting, and streamlined supervision. Firms should view the SEC filing as validation that the 2025 proposal is likely to become the final regulatory framework, subject to limited technical refinement.
Estimated SEC Approval Time Frame
FINRA filed the proposed rule change with the SEC in January 2026 under SR‑FINRA‑2026‑001. The proposal is subject to SEC notice, comment, and review. Notice of Filing of the Proposed Rule Change was published in the Federal Register on February 3, 2026. Based on standard SEC rule‑filing timelines, approval is generally expected within approximately 60 to 90 days following publication in the Federal Register, although this timeframe may be extended. Industry observers currently estimate potential SEC approval in mid‑to‑late 2026, subject to public comments and any amendments requested by the Commission.
Form U4 Disclosure Alignment Considerations
An open issue concerns the alignment between the proposed Rule and Form U4. While proposed Rule 3290 narrows required firm disclosure and review obligations to “investment-related” activities, Form U4 continues to require disclosure of all outside business activities, regardless of whether they are investment-related. Unless and until the SEC amends Form U4 to align with Rule 3290, firms will still be required to report non-investment-related outside business activities on Form U4. As a result, the operational burden of disclosure will not be fully eliminated, and firms should be mindful that Rule 3290 does not completely align with existing Form U4 reporting requirements.
Practical Takeaways for Member Firms
Firms should begin preparing for the transition from Rules 3270 and 3280 to Rule 3290 by inventorying existing OBA and PST workflows, revising written supervisory procedures, updating disclosure and approval forms, and training supervisors and associated persons on the new investment‑related framework. Firms with dual registrants or unaffiliated advisory relationships should pay particular attention to classification and supervisory distinctions created by the final proposal.
Conclusion
FINRA’s proposed Rule 3290 marks a meaningful shift in how broker-dealers oversee OBAs and PSTs. A comparison of Regulatory Notice 25-05 and the SEC-filed proposal shows that FINRA has preserved its original reform agenda while refining the rule in response to industry feedback. Firms should treat the current proposal as a near-final blueprint and begin preparing now for policy, supervisory, and training changes that are likely to be required once Rule 3290 is approved and becomes effective.