On September 15, 2026, the SEC approved FINRA Rule 3290 (Outside Activities Requirements), which replaces two rules broker-dealers have built their OBA and private-securities-transaction programs around for decades: Rule 3270 (Outside Business Activities of Registered Persons) and Rule 3280 (Private Securities Transactions of an Associated Person). FINRA will announce the effective date separately in a Regulatory Notice, so 3270 and 3280 remain fully in force until then. But the shape of what's coming is now settled, and it's a genuinely different framework — not a relabeling.
The headline change is a narrower, risk-based scope: fewer notices for low-risk activity, more structure around the activity that actually matters. The change compliance teams are most likely to miss is quieter. Rule 3290 is a FINRA rule. Form U4 is not — it's a Uniform Registration form used across FINRA, other SROs, and state regulators, and this rulemaking doesn't touch it. An activity that no longer requires notice under Rule 3290 can still be reportable on Form U4 Item 13. Trim your intake process to match the new rule alone, and you can quietly create a U4 reporting gap.
How the rule got here
What actually changes: two categories instead of one broad net
Rule 3270 currently captures almost any outside business activity — employment, ownership stakes, board seats, side income — regardless of whether it has anything to do with financial services. Rule 3290 narrows that considerably. It organizes everything under two categories, both gated by a new, defined term: investment-related activity, covering securities, crypto assets, commodities, derivatives, currency, banking, insurance, and real estate, among others.
- Outside activities — a registered person's investment-related activity that is not itself a securities transaction (working for an unaffiliated RIA, bank, or insurance company, for example). Requires prior written notice and a member assessment; recordkeeping and supervision only if the member imposes conditions.
- Outside securities transactions — an associated person's investment-related activity that is a securities transaction. Requires prior written notice, and if the person will receive selling compensation, prior written approval plus full books-and-records treatment as if the member had executed the trade itself.
Because the trigger is now "investment-related" rather than "any business activity," things like bartending, driving for a rideshare service, or refereeing sports games generally fall outside Rule 3290's notice requirement entirely — FINRA's own stated rationale for the change. The member assessment itself also picks up a new required factor: whether the activity involves a customer of the associated person, on top of the existing questions about interference with duties and whether the public would view the activity as part of the firm's business.
What's now excluded outright
Beyond narrowing the general trigger, Rule 3290 carves out several categories entirely:
- Activity conducted on behalf of the member itself or an affiliate under common control.
- Securities transactions among immediate family members where the associated person receives no selling compensation.
- Personal investments in non-securities, and transactions already covered by Rule 3210 (accounts at other broker-dealers and financial institutions).
- Purchase, sale, rental, or lease of a primary home and up to two secondary homes, if held in specific, closely-defined ownership structures (solely by the associated person and immediate family, a sole proprietorship, a wholly-owned entity, or a trust with the associated person and immediate family as sole beneficiaries).
Separately, activity at an unaffiliated SEC- or state-registered investment adviser is reclassified: it moves from being treated as a private securities transaction under current Rule 3280 to being an outside activity under Rule 3290. The firm still has to receive notice and run the assessment, but Rule 3290 no longer requires the firm to supervise or keep records of the advisory activity itself — a real reduction in overlapping oversight for dual registrants and hybrid firms.
The gap nobody's fixing
Rule 3290 is a FINRA rulemaking. Form U4 — specifically Item 13, which asks whether an individual is engaged in another business as a proprietor, partner, officer, director, employee, trustee, or agent — is a separate Uniform Registration form used by FINRA, other SROs, and state regulators, and nothing in this rulemaking amends it. A registered person's low-risk, non-investment-related activity may fall entirely outside Rule 3290's notice requirement while remaining fully reportable on Form U4. If your firm simplifies or retires its OBA questionnaire to match Rule 3290's narrower scope without separately checking it against Form U4 obligations, you can end up under-collecting information you're still required to have.
How Compliers Can Help
We help firms rebuild disclosure and supervisory workflows around rule changes like this one — separating what a new rule requires from what a separate reporting form still requires, so nothing falls through the seam. Learn more about our Code of Ethics & Oversight engagement.
Conditional approvals now carry an explicit supervision duty
Under both current rules, a member could approve an outside activity or PST subject to conditions — restrictions on solicitation, working hours, compensation, or contact with firm customers, for example. Rule 3290.06 makes explicit what was previously only implicit: a member that imposes conditions must reasonably supervise the person's compliance with them. Approving an activity "subject to conditions" and then never checking on those conditions again is no longer a defensible reading of the rule, if it ever was. Firms should expect examiners to ask not just what conditions were imposed, but who owns monitoring them, how often, and what the evidence trail looks like.
What to do before the effective date
- Map every questionnaire, certification, approval workflow, and recordkeeping process that currently references Rules 3270 or 3280.
- Before trimming any intake question, check it against Form U4 Item 13 separately. Keep U4-driven data collection intact even where Rule 3290 no longer requires it.
- Add branching logic to disclosure questionnaires that distinguishes investment-related from non-investment-related activity, outside activity from outside securities transaction, and selling compensation from none.
- Build a tracking mechanism — owner, review cadence, evidence requirement — for every condition imposed on an approved activity, rather than leaving conditions in reviewer notes or email.
- Review procedures governing unaffiliated RIA relationships and update classification and recordkeeping to reflect the new outside-activity treatment.
- Watch FINRA's SR-FINRA-2026-001 filing page for the Regulatory Notice announcing the effective date, and don't retire 3270/3280 processes before that date arrives.