Key Question
Now that the SEC has approved FINRA Rule 3290, what steps should broker-dealers and dual registrants take to transition from the separate outside business activity and private securities transaction frameworks under Rules 3270 and 3280?
Our View
SEC approval moves Rule 3290 from a planning assumption to an implementation project. Firms should now redesign their outside-activity programs around the new rule’s risk-based classifications and continue to comply with Rules 3270 and 3280 until FINRA announces Rule 3290’s effective date.
Executive Summary
On September 15, 2026, the Securities and Exchange Commission approved FINRA Rule 3290 (Outside Activities Requirements), which will replace FINRA Rules 3270 and 3280 with a single framework governing outside activities and outside securities transactions. The approval largely confirms the structure discussed in our February 2026 alert, From Two Rules to One: FINRA’s Rule 3290 Will Reshape Supervision of OBAs and PSTs. The significant change now is not the substance of the framework but its status: firms should shift from evaluating a proposal to preparing an implementation plan.
Rule 3290 narrows ordinary outside-activity reporting for registered persons to investment-related activities, preserves heightened requirements for outside securities transactions involving selling compensation, and changes how unaffiliated investment adviser activity is treated. The SEC approval order does not set the rule’s effective date; FINRA stated in its filing that it will announce that date separately in a Regulatory Notice. Until then, firms should not discontinue their existing Rule 3270 and 3280 controls. Instead, firms should use the transition period to map existing disclosures, revise forms and procedures, establish classification standards, and train supervisors on the new framework.
From Proposal to Approved Rule
In our February alert, we described FINRA’s SEC-filed Rule 3290 proposal as a near-final blueprint for how firms should expect to supervise outside activities. That assessment followed FINRA’s 2025 proposal and its January 2026 filing with the SEC. The SEC’s September 15 approval order now completes the approval stage and confirms that Rules 3270 and 3280 will be replaced by Rule 3290.
The practical consequence is important. Firms no longer need to design around multiple possible outcomes. They can begin building the Rule 3290 framework into their written supervisory procedures, disclosure forms, approval workflows, recordkeeping practices, and training programs. At the same time, approval does not equal effectiveness. FINRA’s rule filing states that FINRA will announce an effective date in a Regulatory Notice. As of September 23, 2026, FINRA has not published that implementation notice. Current Rules 3270 and 3280 therefore remain the operative requirements during the transition.
The Core Shift: Focus on Investment-Related Outside Activities
Rule 3290 changes the front end of the outside-activity process by focusing a registered person’s notice obligation on outside investment-related activities rather than the broader universe of outside business activities covered by Rule 3270. “Investment-related activity” is defined broadly to include financial assets and financial-services activity. The approved framework encompasses activities involving securities, crypto assets, commodities, derivatives, currency, banking, real estate, insurance and annuities, as well as associations with specified financial-services entities.
This narrower reporting trigger should reduce routine firm reviews of side businesses with little connection to securities or financial services. But firms should be careful not to turn that reduced scope into a mechanical elimination of existing controls. The transition requires a defensible method for determining whether an activity is investment-related and for documenting the basis for classifications that exclude an activity from Rule 3290 review.
Outside Securities Transactions Still Require the Highest Level of Attention
Rule 3290 preserves a separate, more demanding framework for outside securities transactions. An associated person must provide prior written notice describing the proposed transaction, the person’s role, and whether selling compensation will be received. If selling compensation is involved, the member must approve, conditionally approve, or disapprove the transaction in writing before participation. If approved, the transaction must be recorded on the member’s books and records and supervised as if executed on the member’s behalf.
Transactions without selling compensation receive different treatment, but they remain within the compliance framework. The member must acknowledge the notice and may impose conditions or limitations based on its assessment. Importantly, when a firm imposes conditions or limitations under Rule 3290, it must reasonably supervise compliance with those restrictions. Firms therefore need a process not only to make the initial decision but also to track conditions after approval.
Un-Affiliated RIA Activity: A Significant Change for Dual Registrants
One of the most consequential changes for dual-registration structures concerns investment advisory activity conducted through an unaffiliated SEC- or state-registered investment adviser. Rule 3290 treats that activity as an outside activity rather than automatically treating it as an outside securities transaction. As a result, the broker-dealer will not have the same automatic obligation to supervise and record the advisory activity as it would for the member’s own securities business.
That does not make the activity invisible to the broker-dealer. The registered person remains subject to the applicable notice requirement, and the member may prohibit, limit, or condition the activity after assessing the risks. FINRA also emphasized that Rule 3110 supervisory obligations remain relevant when a firm encounters red flags suggesting undisclosed outside activity, undisclosed securities transactions, compensation issues, or misconduct. For firms with representatives affiliated with unaffiliated RIAs, the change should prompt a careful review of existing supervisory arrangements rather than an automatic elimination of oversight.
Exclusions Require Classification and Documentation
The approved rule includes exclusions to keep lower-risk or duplicative activity outside the mandatory Rule 3290 process. Among other things, the rule excludes certain activities conducted for the member or its affiliates, certain personal investments in non-securities, securities transactions already subject to Rule 3210, and specified personal real-estate activity. The real-estate exclusion can cover a registered person’s primary residence and up to two secondary homes, subject to the rule’s conditions.
These exclusions can reduce administrative burden, but they also create a classification issue. A firm should be able to demonstrate why an activity was excluded, particularly when the activity resembles investment activity or evolves over time. For example, a personal real-estate holding may warrant a different analysis if the representative begins acquiring properties as an investment business, soliciting investors, or receiving transaction-related compensation.
The Form U4 Issue Has Not Disappeared
Rule 3290 narrows the outside activities that must be reported to the broker-dealer, but it does not change the separate disclosure requirements of Form U4. Section 13 of Form U4 continues to require disclosure when a representative is engaged in another business as a proprietor, partner, officer, director, employee, trustee, agent, or otherwise. The principal exclusion is for non-investment-related activity that is exclusively charitable, civic, religious, or fraternal and recognized as tax-exempt.
This distinction is important because Rule 3290 and Form U4 will no longer necessarily capture the same universe of outside activities. An activity may be non-investment-related and therefore fall outside Rule 3290’s new notice requirements, while the representative’s role in that activity may still trigger Form U4 disclosure. For example, serving as an officer, director, employee, or partner of a non-investment-related business may no longer require notice under Rule 3290 but can remain reportable on Form U4.
Accordingly, firms should not redesign their outside-activity process solely around Rule 3290’s narrower investment-related standard. The firm’s intake and review process should continue to identify outside activities that may require Form U4 disclosure, even when no Rule 3290 notice is required. Maintaining this separate review will help prevent the streamlined Rule 3290 framework from inadvertently creating gaps in representatives’ continuing Form U4 reporting.
Recommended Actions
With SEC approval complete but the effective date is still pending, firms have a defined implementation window. The most useful work now is to translate the approved rule into operational controls before the effective date is announced.
- Inventory current OBA and PST records. Identify the existing Rule 3270 and 3280 disclosures and determine how each would be classified under Rule 3290: investment-related outside activity, outside securities transaction with or without selling compensation, excluded activity, or activity outside Rule 3290.
- Revise WSPs and disclosure forms. Replace the current two-rule framework with a unified process that captures the information needed to classify an activity, assess risk, document the firm’s decision, and monitor any imposed conditions.
- Create a documented classification methodology. Supervisors should have practical standards for determining when an activity is investment-related, when it constitutes a securities transaction, and when selling compensation is present.
- Address unaffiliated RIA arrangements separately. Identify representatives engaged through unaffiliated RIAs and determine which supervision can appropriately be removed, which notice and assessment remain necessary, and whether firm-imposed conditions should continue.
- Preserve Form U4 controls. Do not assume that Rule 3290’s narrower reporting scope eliminates the need for separate Form U4 reporting. The firm’s workflow should identify information that remains reportable under CRD.
- Build monitoring for conditions and red flags. A written approval condition is not self-executing. Procedures should assign responsibility for monitoring compliance with restrictions and for escalating indications of undisclosed or changed activity.
- Train before conversion. Registered persons need to understand what must be reported under the new rule, while supervisors need more detailed training on classification, risk assessment, sales compensation, exclusions, and documentation expectations.
- Maintain the current framework until the effective date. Rules 3270 and 3280 remain in effect until Rule 3290 takes effect. Firms should plan the conversion now but coordinate the actual cutover with FINRA’s implementation notice.
Key Takeaways
Rule 3290 is now an implementation issue rather than a proposal to monitor. The following points should drive the transition:
- Approval is complete, but implementation is not. The SEC approved Rule 3290 on September 15, 2026, but FINRA has not yet announced the rule’s effective date.
- The framework is narrower, not lighter everywhere. Routine outside-activity reporting is focused on investment-related activity, while compensated outside securities transactions remain subject to substantial approval, recordkeeping, and supervisory obligations.
- Unaffiliated RIA activity changes materially. The broker-dealer’s automatic transaction-level supervision is reduced, but notice, assessment, firm restrictions, and red-flag supervision remain important.
- Documentation will determine whether the streamlined framework is defensible. Firms should be able to explain why an activity was included, excluded, approved, conditioned, or prohibited.
- Form U4 remains a separate control point. Rule 3290 does not, by itself, resolve the broader outside-business disclosure requirements reflected in Form U4.
Conclusion
Our February alert encouraged firms to treat the SEC-filed Rule 3290 proposal as the blueprint for future OBA and PST supervision. SEC approval confirms that direction. The next phase should be operational: translating the approved framework into revised procedures, forms, supervisory responsibilities, records, and training, while maintaining the existing Rules 3270 and 3280 programs until FINRA establishes the effective date. Firms that use the transition period to classify their existing outside activities and resolve workflow issues now should be better positioned to make a controlled conversion when FINRA’s implementation notice is issued.
Call to Action
The LeGaye Law Group can assist broker-dealers and dual registrants with Rule 3290 gap assessments, revisions to written supervisory procedures and outside-activity forms, classification of existing OBA/PST disclosures, and implementation planning once FINRA announces the effective date.