Key Question
With FINRA Rule 3290 approved and its effective date established, how should broker-dealers prepare for the transition from Rules 3270 and 3280?
Our View
Broker-dealers should use the period before October 25, 2027, to inventory existing outside activities, redesign disclosure and supervisory processes, revise written supervisory procedures, and train personnel, while continuing to comply with current rules until the transition date.
Executive Summary
The Securities and Exchange Commission approved FINRA Rule 3290 (Outside Activities Requirements) on September 15, 2026. FINRA subsequently issued Regulatory Notice 26-20, setting October 25, 2027, as the rule’s effective date. The new rule replaces the separate requirements of Rules 3270 (outside business activities) and 3280 (private securities transactions) with a consolidated framework focused on investment-related outside activities and outside securities transactions. Although the rule reduces certain reporting burdens, it preserves significant firm assessment, supervisory, and recordkeeping obligations. The transition is therefore not simply a matter of removing non-investment-related activities from existing disclosure forms. Firms should begin a structured implementation process now, allowing sufficient time for review, testing, training, and remediation before the effective date.
Regulatory Background: From Proposal to Implementation
Our earlier article, From Two Rules to One: FINRA’s Rule 3290 Will Reshape Supervision of OBAs and PSTs, examined the SEC-filed proposal and its implications for broker-dealer supervision. At that stage, Rule 3290 was a proposed framework, and firms were assessing its likely impact. The SEC’s approval and FINRA’s effective-date notice now set a definitive implementation schedule. The SEC approved the rule, as modified by Partial Amendment No. 1, in Exchange Act Release No. 34-106381.
Importantly, October 25, 2027, is the effective date, not a deadline for firms to begin implementation. Existing Rules 3270 and 3280 remain applicable until the new rule takes effect. Firms should avoid prematurely discontinuing current disclosures, reviews, or supervision during the transition.
Why This Matters for Broker-Dealers
The change is broader than consolidating two rule numbers. Rule 3290 narrows the rule-based reporting perimeter for registered persons to investment-related outside activities, including activities involving securities, crypto assets, banking, insurance, real estate, and other financial assets. Routine non-investment-related outside employment generally will no longer trigger Rule 3290 notice and assessment requirements. Nevertheless, the rule does not prevent a firm from maintaining broader internal reporting requirements when justified by its business and risk profile.
The rule also distinguishes outside activities from outside securities transactions, with obligations that vary by the nature of the activity and whether selling compensation is involved. Transactions for selling compensation continue to require prior written approval and, if approved, supervision and books-and-records treatment as if conducted through the firm. If a firm imposes conditions or limitations on an outside activity, it must reasonably supervise compliance with those conditions. FINRA Rule 3110 obligations and the responsibility to investigate red flags remain.
Another important change concerns activity at an unaffiliated SEC- or state-registered investment adviser. Under Rule 3290, such activity is generally treated as an outside activity rather than an outside securities transaction, which changes the member’s direct supervision and recordkeeping obligations for that advisory activity. The firm must still obtain notice, assess the activity, document its compliance, and supervise any conditions it imposes. FINRA also expressly states that Rule 3290 does not alter Form U4 Question 13 disclosure obligations; a narrower Rule 3290 reporting scope should not be mistaken for an automatic reduction in registration disclosure requirements.
Finally, the narrower reporting framework will require firms to strengthen their processes for evaluating and documenting outside activities. Firms should establish tracking mechanisms that capture sufficient information on the nature of each reported activity, the representative’s responsibilities, compensation arrangements, and other relevant circumstances. This may require additional due diligence to verify that the activity is as represented and to determine its appropriate classification under Rule 3290. Importantly, firms should document the basis for their determinations, including whether an activity is subject to reporting, approval, supervision, or other applicable requirements. Maintaining these records will help firms substantiate their regulatory decisions and show that they evaluated activities appropriately rather than simply excluding them from oversight.
Recommended Actions: Begin the Transition Now
The implementation period allows time to establish a defensible process, but it should not be used to defer work until 2027. We recommend that broker-dealers address the following workstreams in the following order:
- Inventory and classify existing activities. Review current OBA and private securities transaction inventories, identify investment-related activities and securities transactions, and flag unaffiliated advisory relationships, compensation arrangements, exclusions, and activities subject to firm-imposed conditions.
- Rebuild policies, forms, and review workflows. Map current Rules 3270 and 3280 procedures to Rule 3290. Update WSPs, associated-person notices, supervisory assessment criteria, written approvals and acknowledgments, escalation protocols, and documentation standards. Maintain separate processes required for Form U4 reporting.
- Define supervision and recordkeeping responsibilities. Establish how the firm will document classifications and assessments, monitor conditions or limitations, supervise approved outside securities transactions involving selling compensation, investigate red flags, and retain records demonstrating compliance.
- Train and test before conversion. Train registered persons, associated persons, supervisors, and registration personnel on the new distinctions. Test representative fact patterns and existing approvals against the revised procedures, correct deficiencies, and set a firm-specific cutover plan that preserves compliance with current rules through October 24, 2027.
Key Takeaways
The approaching effective date creates an opportunity for firms to simplify unnecessary reporting and strengthen controls over investment-related activities that carry greater risk:
- Approval and timing. Rule 3290 has been approved and will take effect on October 25, 2027. The existing rules remain in effect until then.
- Reduced scope does not mean reduced accountability. Some routine outside work falls outside Rule 3290, but firm assessments, conditions, supervision of compensated securities transactions, and red-flag reviews remain important.
- Implementation must be documented. A firm should be able to demonstrate not only revised WSPs but also effective forms, classification decisions, training, supervisory assignments, and testing.
Conclusion
The approval of Rule 3290 shifts broker-dealers from monitoring a proposal to preparing for a known compliance date. Firms that begin with a disciplined inventory and gap assessment will be better positioned to make measured changes, avoid disruption, and demonstrate an effective transition. This article is the first in a series: subsequent LeGaye Law articles will examine the rule’s specific requirements and the related disclosure, assessment, supervisory, and recordkeeping obligations in greater detail.
Call to Action
The LeGaye Law Group can help broker-dealers evaluate existing outside-activity programs, identify gaps under Rule 3290, and develop practical implementation plans and supervisory procedures ahead of October 25, 2027.