On October 26, 2026, FINRA published Regulatory Notice 26-20, adopting Rule 3290 (Outside Activities Requirements) with an effective date of October 25, 2027. That is the date Rules 3270 and 3280 go away, and the date the 1990s-era guidance in Notices to Members 94-44 and 96-33 — which pulled outside investment advisory work into private-securities-transaction supervision — is superseded. Until then, your current OBA and PST obligations apply exactly as written.
We covered what the rule changes in our earlier article. This one is about what to do with a twelve-month runway, because the most natural first move — a shorter rule means a shorter questionnaire — is also the riskiest one.
The tempting mistake: shrinking the form to match the rule
Rule 3290 narrows what has to be reported under FINRA's outside-activity framework to investment-related activity. Bartending, refereeing, or driving for a car service no longer triggers a rule-based notice. It is easy to conclude that every question about non-investment activity can now come out of your disclosure forms.
That conclusion treats one regulatory purpose as the only one. Information about what your people do outside the firm rarely serves a single master. It typically also feeds Form U4 reporting, state investment adviser representative requirements, conflicts management, licensing, and the broader supervisory picture your examiners expect you to have. FINRA says so directly: Regulatory Notice 26-20 states that Rule 3290 does not alter existing Form U4 disclosure obligations, and that Question 13 ("Other Business") continues to require disclosure about outside activities. A form that collects only what Rule 3290 requires can leave you short on what the rest of your program still depends on.
Map every question to the obligation it supports
The better exercise runs in the opposite direction. Take each field on your current OBA and PST disclosure forms and record why you collect it and which requirement or risk it supports. Then sort every question into one of three buckets:
- Keep as is — it supports Rule 3290, Form U4, state registration, or another live obligation.
- Keep, but route differently — the information is still needed, but not every response needs the same review path. A non-investment side job may only need to be captured for U4 purposes, not escalated for a Rule 3290 assessment.
- Retire — nothing downstream uses it, and a documented rationale says so.
Write the decision down. The point of the exercise is not only a leaner form; it is a record showing that each deletion was deliberate and tied to a purpose, which is exactly what an examiner will want to see if a gap ever surfaces. It also helps you avoid the fragmented pattern where the broker-dealer, the advisory affiliate, and the licensing team each ask the same person overlapping questions.
Where the rule stops and your duty doesn't
Regulatory Notice 26-20 is explicit that a narrower rule does not shrink the surrounding obligations:
- Red flags still count. Rule 3290 does not alter your Rule 3110 duty to investigate and respond to red flags suggesting an undisclosed outside activity, undisclosed compensation, or other misconduct — including activity the new rule no longer requires anyone to report.
- Conditions must be supervised. If you approve an activity subject to conditions or limitations, Rule 3290.06 requires you to reasonably supervise compliance with them.
- You can go broader. The rule sets a floor. Firms remain free to require more reporting, impose stricter conditions, or prohibit activity based on their own risk assessment.
- You still keep records. You must maintain and preserve records demonstrating compliance with Rule 3290 under Exchange Act Rule 17a-4(e)(1).
How Compliers Can Help
We help firms inventory their disclosure forms, tie each question to the obligation behind it, and rebuild approval and monitoring workflows before a rule change lands — so the transition is documented, not improvised. Learn more about our Code of Ethics & Oversight engagement.
Dual registrants and hybrid representatives need a second look
Activity at an unaffiliated SEC- or state-registered investment adviser moves from being a private securities transaction to being an outside activity. The broker-dealer must still receive notice and perform its assessment, but Rule 3290 no longer requires it to supervise or keep records of the advisory activity itself.
That is a real simplification for the broker-dealer, and a quiet risk for everyone else. The advisory firm retains its own fiduciary, compliance, and supervisory obligations, and none of them were reduced by FINRA's rulemaking. Investment advisers that work with hybrid representatives should confirm their own oversight did not quietly depend on broker-dealer supervision that is about to narrow. Broker-dealers, for their part, keep full discretion to impose conditions on this activity, including supervision, if their risk assessment calls for it — and should document whichever choice they make.