FINRA Rule 3290 (Outside Activities Requirements) replaces Rule 3270 on outside business activities and Rule 3280 on private securities transactions with a single framework. It was adopted by SR-FINRA-2026-001 and takes effect October 25, 2027. The SEC approved the rule change on September 15, 2026, and FINRA describes the amendments in Regulatory Notice 26-20.

The date is the first thing to get right. As of October 28, 2026, Rule 3290 is adopted but not yet effective. Rules 3270 and 3280 remain the operative requirements until October 25, 2027. A firm that rewrites its procedures today around the new rule, without preserving its current controls until the transition, would spend a year failing the obligations that still apply.

What Rule 3290 actually changes

The consolidation is real, but the substance is easier to understand as a change in scope than as a change in attitude. Rule 3270 required written notice of outside business activity broadly: employment or compensation from another person for activity outside the scope of the person's relationship with the member. Rule 3280 separately required notice of private securities transactions, with approval required where the associated person received selling compensation.

Rule 3290 reorganises that into two tracks built on one question: is the activity investment-related, and is it connected to a securities transaction?

• Investment-related activity not connected to a securities transaction is an "outside activity" under paragraph (a). A registered person must give prior written notice, describing the proposed activity and the person's proposed role in detail, with updated notice for a material change.
• Investment-related activity connected to a securities transaction is an "outside securities transaction" under paragraph (b). An associated person must give prior written notice, and must obtain prior written approval where the transaction involves selling compensation.
• Activity that is not investment-related is generally outside the rule. This is the substantive relief, and it is the change most likely to be overstated internally.

Two drafting details deserve attention. Paragraph (b) applies to associated persons, while paragraph (a) applies to registered persons. The populations are not identical, and a firm that redrafts its notice forms without checking who is covered will produce a form that is either too narrow or procedurally unworkable. Separately, the definition of investment-related activity expressly includes a personal investment involving a securities transaction, often called buying away, so the older shorthand that buying away sits apart from the outside activity rules no longer describes the framework.

Comparing the former framework and the new requirements

The table below summarises the frameworks at a general level. It is a planning aid, not a substitute for the rule text, and every distinction should be confirmed against the adopted rule before procedures are rewritten.

Which activities remain subject to notice and oversight

The definition of investment-related activity is where most classification work will happen. The rule describes activity pertaining to financial assets, and then lists categories: securities, crypto assets, commodities, derivatives such as futures and swaps, currency, banking, real estate, and insurance. It also lists the capacities that qualify, including acting as or being associated with a broker-dealer, an issuer, an insurance agent or company, an investment company, an investment adviser, a futures commission merchant, a commodity trading advisor, a commodity pool operator, a municipal advisor, a futures sponsor, a money services business, a bank, a savings association, or a credit union.

Three consequences follow. Crypto activity is named directly rather than left to analogy. Real estate and insurance appear as investment-related categories even where the activity is not a securities transaction, which means a registered person's role in an outside insurance or property venture is likely notice-triggering rather than excluded. And because a money services business is named, payments work outside the firm falls inside the definition, which is a category compliance departments rarely had to reason about under the old shorthand.

Examples that are likely reportable

• Serving as an officer, director, or registered representative of an outside broker-dealer or investment adviser.
• Acting as an agent for an outside insurance agency, or holding an ownership role in one.
• Consulting for a crypto trading platform, or advising a commodity pool.
• Participating in a private securities offering for compensation, including a finder arrangement.
• Serving in a role at a money services business or a payments company outside the member.

Examples the rule appears to exclude

• Activity conducted on behalf of the member or its affiliate, such as investment advisory activity for a dually registered firm.
• Securities transactions among immediate family members where no selling compensation is received.
• Personal investments in non-securities.
• Securities transactions subject to Rule 3210 on personal accounts.
• Purchasing, selling, renting, or leasing a main home and up to two secondary homes, subject to the ownership conditions in the rule.

Two categories sit in the middle and are easy to misclassify. A portfolio manager or investment committee member role for registered or unregistered investment companies is treated as an outside activity, not an outside securities transaction. Activity at an unaffiliated registered investment adviser is likewise treated as an outside activity, not an outside securities transaction. Both still require notice. Neither requires the approval track.

What member firms must do when notice arrives

For a registered person's outside activity, paragraph (c) requires the member to assess at minimum whether the activity is an outside securities transaction, involves a customer of the registered person, will interfere with or compromise responsibilities to the member or its customers, and will be viewed by customers or the public as part of the member's business. The member must then evaluate whether to impose conditions or limitations, including prohibiting the activity.

For an associated person's outside securities transaction, paragraph (d) applies the same four factors and adds a documentation sequence. A transaction not for selling compensation gets prompt written acknowledgement, with conditions at the firm's discretion. A transaction for selling compensation requires a written decision: approve, approve with conditions, or disapprove. An approved transaction must be recorded on the books and records of the member and supervised as if it were executed on behalf of the member. Where conditions or limitations are imposed, Supplementary Material .06 requires the member to reasonably supervise compliance with them.

The supervision sentence does the heaviest work in the rule. Treating an approved outside transaction as a file to be closed, rather than as activity the firm has accepted responsibility for, is the most likely source of a supervisory finding under the new framework. It is also the failure mode that existed under Rule 3280, which means many firms already have the evidence base to fix it.

How compliance departments should prepare before October 2027

The twelve months between now and the effective date are enough to do this properly and not enough to do it twice. The sequence below is ordered by dependency.

1. Keep current controls intact while planning. Rules 3270 and 3280 apply until October 25, 2027. Any transition plan should state explicitly that existing notice, review, and supervision requirements continue unchanged during the build.
2. Inventory current disclosures against the new definition. Pull existing outside activity disclosures and tag each one against the investment-related categories in the rule. The exercise usually identifies a group of low-risk items that will drop out and a smaller group that needs a closer review than it received.
3. Redraft the notice forms around the two tracks. The notice content differs between paragraph (a) and paragraph (b), and the selling compensation question has to be asked explicitly in the securities transaction form. A single blended form tends to collect neither answer clearly.
4. Separate the notice, acknowledgement, and approval workflows. Acknowledged outside activities should not sit in the same queue as approval decisions, because the deadlines and the evidentiary standard differ.
5. Rewrite the assessment template to the four factors. Reviewers should record a conclusion on each factor rather than a general narrative, so that a later reviewer can see what was considered.
6. Update the recordkeeping mapping. Confirm where the rule compliance record lives, how long it is retained under SEA Rule 17a-4(e)(1), and how approved selling compensation transactions are captured on the books and supervised.
7. Train three audiences differently. Registered representatives need to know what to report. Reviewers need the classification tests. Supervisors need the conditions and the monitoring obligation. One combined session reliably produces representatives who under-report and reviewers who over-approve.
8. Set a cutover date with a parallel period. Run the new forms and assessment template alongside the current process for a defined window before October 25, 2027, so that classification disagreements surface while there is still time to resolve them.

One gap worth flagging early: the rule includes a formal allocation agreement provision for an associated person who is associated with more than one member and participates in an approved outside securities transaction involving selling compensation. Firms that share associated persons should confirm which member is carrying the supervision and recordkeeping obligation before the transaction, not after a customer complaint.

Industry perspective

Rule 3290 follows a pattern visible across several recent rulemaking efforts: reduce the volume of low-value reporting so that supervisory attention concentrates where risk actually sits. Removing notice requirements for unrelated part-time employment is defensible on its face. A representative tending bar on weekends generated a disclosure, a review, and a file entry that told the firm nothing about investment risk.

The trade is not free. A narrower rule depends more heavily on classification judgment, and classification judgment is where firms diverge. Two firms can review the same outside insurance role and reach different conclusions about whether it is investment-related, and both can be internally consistent. That is not a reason to keep the broader rule. It is a reason to document the reasoning, define the terms in the firm's own procedures, and route edge cases to a named decision maker rather than to whoever is reviewing the queue that week.

There is also an AML/BSA boundary worth stating, because the new definition invites confusion. Rule 3290 names money services businesses and banks among the capacities that make an activity investment-related. That is a disclosure and supervision classification. It does not convert the outside activity rule into an AML obligation, and it does not extend a firm's Bank Secrecy Act program to an activity conducted elsewhere. Firms should map outside activity disclosures to their AML risk assessment only where the activity genuinely creates a customer, product, or geographic exposure the program is designed to address.

Soflo Consulting advises financial services organizations on AML/BSA program design, risk assessment, and compliance training. We are not a securities law firm and do not provide FINRA-specific legal advice. Where an outside activity disclosure raises a Bank Secrecy Act question, we can help you assess it within the program framework. Review the BSA risk assessment service or contact Soflo Consulting.

Disclaimer: This article is provided for general informational and educational purposes only and does not constitute legal advice. Rule 3290 is adopted but not effective until October 25, 2027, and Rules 3270 and 3280 continue to apply until that date. Descriptions of the rule are summaries of the published text and should be verified against the adopted rule, Regulatory Notice 26-20, and the SEC approval order. Soflo Consulting is not affiliated with, endorsed by, or approved by FINRA or the SEC.