FINRA Rule 3290 (Outside Activities Requirements) is coming. As of October 25, 2027, the FINRA outside activities rule replaces Rule 3270 (Outside Business Activities of Registered Persons) and Rule 3280 (Private Securities Transactions of an Associated Person). FINRA announced the change in Regulatory Notice 26-20.

In short, the rule eliminates the reporting of non-investment-related activities. At the same time, it preserves core protections for investors and member firms. Consequently, broker-dealer compliance teams must now confirm that their new procedures work as intended.

Rule 3290 Effective Date and Key Dates

Additionally, FINRA released the full rule text in Attachment A. Likewise, it published a helpful decision flowchart in Attachment B. Notably, the rule is part of FINRA's broader FINRA Forward modernization initiative.

What FINRA Rule 3290 Changes

"Investment-related" activity is the trigger

Under former Rule 3270, nearly any paid outside business activity required prior written notice. By contrast, FINRA Rule 3290 applies only to investment-related activity outside the scope of a person's relationship with the firm.

Specifically, Rule 3290(f)(3) defines investment-related activity as activity pertaining to financial assets. For example, this includes:

• Securities, crypto assets, commodities, and derivatives such as futures and swaps
• Currency, banking, real estate, and insurance
• Roles with a broker-dealer, issuer, investment adviser, bank, insurance company, money services business, or similar entity
• Participation in a personal securities investment, often called "buying away," unless an exclusion applies

Furthermore, FINRA clarified that consulting, marketing, accounting, legal, and tax work alone falls outside the rule. However, those services become covered when they accompany investment-related activity. For instance, recommending a tax-loss sale of a security counts as investment-related activity.

Meanwhile, low-risk outside business activities drop out of the rule entirely. Examples include refereeing sports, driving for a car service, and bartending on weekends.

Outside activities vs. private securities transactions

Importantly, the FINRA outside activities rule keeps the split structure of the former rules. First, outside activity requirements apply to registered persons. Second, outside securities transaction requirements apply to all associated persons, including registered persons.

In practice, the key difference is whether the activity connects to a securities transaction. If it does, the activity is an outside securities transaction, which replaces the old private securities transactions category. Otherwise, it is an outside activity.

Firm obligations depend on the activity type

Also, firms gained one new assessment factor. Specifically, they must consider whether the activity involves a customer of the registered or associated person. Beyond that, the other factors mirror former Rule 3270. Namely, firms must confirm proper classification, potential interference with firm duties, and whether the public could view the activity as firm business.

Exclusions remove "white noise" from the process

The rule does not apply to several activities and transactions. These include:

• Activity conducted on behalf of the member or an affiliate, such as advisory work for a dual registrant
• Securities transactions among immediate family members with no selling compensation
• Accounts and transactions covered by Rule 3210, including certain mutual fund, 529 plan, and variable annuity activity
• Personal investments in non-securities
• The purchase, sale, rental, or lease of a main home and up to two secondary homes, subject to ownership conditions

Notably, FINRA defines "immediate family" by reference to Rule 3240(c). Thus, firms should align their family transaction reviews with that definition.

Unaffiliated RIA activity receives a lighter touch

Perhaps the most significant change involves registered persons who work at an unaffiliated SEC- or state-registered investment adviser. Previously, older FINRA guidance treated much of this work as private securities transactions under Rule 3280. As a result, firms had to supervise it and keep records of it.

Under Rule 3290.03, however, this work is now an outside activity. Accordingly, the registered person gives notice, and the firm performs its assessment. From that point, the firm no longer has to supervise or keep records of the advisory activity itself.

Even so, the firm must still keep records that show its own compliance with Rule 3290. Moreover, if the firm imposes conditions, it must reasonably supervise compliance with them. Finally, firms keep full discretion to require supervision of RIA activity based on risk.

Other special treatment

In addition, the rule addresses several narrower situations:

• Portfolio manager and investment committee roles for certain funds, BDCs, REITs, and tax-exempt entities count as outside activities.
• Work under a networking contract between the member and another entity falls outside the rule when conducted for the member.
• Activity under a Gramm-Leach-Bliley Act or Regulation R exception counts as an outside activity.
• Members that share an associated person may sign a written allocation agreement for approved transactions with selling compensation.

How the FINRA Outside Activities Rule Affects Broker-Dealer Compliance

At first glance, the new rule looks like simple relief. Yet the rule shifts risk rather than removing it. In other words, firms now review fewer activities but must classify each one correctly.

Lower intake volume, higher classification risk

On the positive side, compliance teams spend less time on bartending, coaching, and other non-financial side jobs. On the other hand, every classification decision now carries more weight. For example, a "consulting" role that includes capital raising remains covered. Similarly, crypto, real estate syndication, and referral arrangements need careful review.

Form U4 reporting did not change

Equally important, the rule did not alter Form U4 disclosure obligations. In particular, Question 13 ("Other Business") still requires disclosure of outside business activities. Therefore, an activity may fall outside Rule 3290 yet still require U4 reporting. For that reason, firms must track both standards side by side.

Supervisory duties under Rule 3110 still apply

Likewise, the rule does not change a firm's obligations under Rule 3110. Firms must still investigate and respond to red flags that suggest undisclosed activity, undisclosed compensation, or other misconduct. Consequently, surveillance, email review, and complaint monitoring remain essential.

Conditions create supervision obligations

Furthermore, Rule 3290.06 links conditions to supervision. If a firm limits an activity, it must reasonably supervise compliance with that limit. Thus, firms should only impose conditions they can actually monitor.

Dual-hat RIA reps need guardrails

Although supervision of unaffiliated RIA activity is now optional, liability risk has not disappeared. Indeed, firms still face customer confusion, brand affiliation assumptions, referral conflicts, and data privacy exposure. As a result, firms with many dual-hat representatives carry the most policy risk.

Policies, systems, and records must match the rule

Finally, FINRA routed Notice 26-20 to senior management, systems, legal, operations, and compliance. That routing signals the scope of the work. Specifically, written supervisory procedures, intake forms, workflow tools, and training must now reflect the new rule. In addition, Rule 3290(e) requires firms to keep compliance records under Exchange Act Rule 17a-4(e)(1). Where a provision creates real hardship, firms may also seek exemptive relief under Rule 9610.

FINRA Rule 3290 Year-End Review Plan

Because the rule will take effect in late October, you should begin transitioning for your review proces. Accordingly, we recommend a four-phase plan that runs into early 2028.

1. November 2027

   Confirm the transition is complete

   • First, confirm that every open Rule 3270 and Rule 3280 record now maps to a Rule 3290 category or exclusion.
   • Next, verify that legacy WSPs, forms, and system workflows are retired.
   • Then, flag RIA, crypto, real estate, consulting, and referral activity for deeper review.

2. December 2027

   Test the new process

   • To begin, sample notices filed since October 25 and check each classification.
   • Next, confirm that assessments now document customer involvement.
   • After that, test whether supervisors monitor every condition the firm imposed.
   • Also, reconcile disclosures against Form U4 Question 13.

3. January 2028

   Close gaps and strengthen guardrails

   • First, fix any misclassified activities and update affected records.
   • Then, tighten written conditions for dual-hat RIA reps, such as limits on client overlap and referrals.
   • Finally, refresh training for registered persons, supervisors, and compliance staff.

4. February to March 2028

   Document and certify

   • Before your annual certification, document the test results and corrective actions.
   • Next, add Rule 3290 findings to your annual compliance meeting agenda.
   • Afterward, keep the review file ready for your next FINRA exam.

Our Recommendation: Keep Centralized Intake

Even though Rule 3290 narrows the reporting trigger, firms should not let reps decide what counts as investment-related. Instead, we recommend that reps continue to submit all outside business activities through one internal process. Then, compliance can determine which rule, if any, applies.

This approach offers several benefits. For one, it reduces misclassification by reps. Additionally, it creates a clean audit trail for exams. Above all, it keeps Form U4 reporting consistent. Notably, the rule expressly allows firms to set broader internal reporting requirements.

Final Takeaway

Ultimately, FINRA Rule 3290 is not deregulation. Rather, it redirects attention toward activities that pose real investor risk. Firms that test their new process now can reduce burden and stay exam-ready. Conversely, firms that loosen controls too far may face findings when regulators test real-world outcomes.

FINRA Rule 3290 FAQs