Alert | FINRA Adopts Rule 3290: When the Rule Shrinks, Your Framework Should Not

On October 26, 2026, FINRA published Regulatory Notice 26-20, setting October 25, 2027, as the effective date for new Rule 3290 (Outside Activities Requirements) and the rescission of Notice to Members 94-44 and 96-33. Rule 3290 replaces the outside business activity (OBA) and private securities transaction requirements in Rules 3270 and 3280 with a single framework. Until October 2027, Rules 3270 and 3280 still apply.

What Rule 3290 Changes

The most visible change is scope. Rule 3290 focuses on “investment-related activity,” which FINRA defines as activity pertaining to financial assets, including securities, crypto assets, commodities, derivatives, currency, banking, real estate, and insurance, as well as personal securities investments made away from the firm unless excluded. Consulting, accounting, legal, and tax services standing alone are not covered, but they become investment-related when they accompany investment activity. Activities with no investment connection, such as refereeing or bartending, will no longer require rule-based reporting.

Registered persons must give prior written notice of an outside activity, and the firm must assess it and evaluate whether to impose conditions. Associated persons must give prior written notice of an outside securities transaction, and the firm must acknowledge it in writing. Where selling compensation is involved, the person also needs the firm’s prior written approval, and the firm must record and supervise the transaction as if executed on its behalf. Firm assessments now include one new factor: whether the activity involves a customer.

Activity at an unaffiliated SEC- or state-registered investment adviser becomes an outside activity requiring notice and assessment, rather than broker-dealer supervision and recordkeeping of the advisory activity itself. Firms keep full discretion to impose conditions on that activity, including supervision.

What Does Not Change

The rule excludes activity on behalf of the member or its affiliates, certain immediate family transactions, specified personal investments, and activity under certain banking or insurance networking arrangements. However, reduced coverage does not eliminate a broker-dealer’s broader supervisory responsibilities. Rule 3110 red-flag obligations remain, firms must reasonably supervise any conditions they impose and preserve records demonstrating compliance with Rule 3290, and firms may set requirements broader than the rule’s minimum. Form U4 disclosure obligations, including Question 13, also do not change.

Bates Group’s Perspective

The operational challenge may be less about deciding what Rule 3290 eliminates than determining what the firm still needs to know for other reasons. Outside activity information supports Form U4 reporting, state investment adviser representative requirements, conflicts management, Regulation Best Interest and Form CRS considerations, licensing, and broader supervision. During the rulemaking, FINRA indicated it would work with the SEC and state regulators on possible Form U4 harmonization. Until that happens, firms may still need information that Rule 3290 no longer requires.

This matters most for dual registrants and firms with affiliated or unaffiliated investment advisers. A broker-dealer may no longer need to supervise certain advisory activity, but the advisory firm keeps its own fiduciary, compliance, and supervisory framework. Investment advisers that work with hybrid representatives should confirm that their oversight does not depend on broker-dealer supervision that may narrow. Firms should resist treating the new rule as simply an opportunity to delete questions from an OBA questionnaire.

The better exercise is to identify why each piece of outside activity information is collected and which regulatory regime or risk it supports, then eliminate reporting that serves no continuing purpose. This approach also avoids fragmented processes in which broker-dealer, investment adviser, and licensing functions collect overlapping information from the same individual.

Action Items

Firms preparing for October 25, 2027, should consider:

1. Mapping each current OBA and private securities transaction question to the regulatory or business purpose it supports.
2. Identifying associated persons with dual or multiple roles, including IAR, insurance, banking, real estate, and private fund activities, and determining their treatment under Rule 3290.
3. Updating disclosure forms, attestations, and assessment workflows for the new customer-involvement factor and material change requirements.
4. Deciding whether to adopt Rule 3290’s minimum reporting scope or retain broader internal reporting, and documenting any decision on supervising unaffiliated investment adviser activity.
5. Reviewing procedures for supervising conditions the firm imposes and for preserving records under Exchange Act Rule 17a-4(e)(1).
6. Building a timeline for procedure, systems, and training changes while maintaining Rules 3270 and 3280 processes until the effective date.

When outside activity rules change, firms that leave disclosure forms, workflows, and training untouched risk gaps between written procedures and actual practice. Bates Group helps broker-dealers, investment advisers, and dual registrants prepare for Rule 3290 before the effective date. Our consultants map outside activity questions to their regulatory purposes, assess policies and written supervisory procedures, test outside activity monitoring during branch and OSJ inspections, and train supervisors. We also work with leadership to document oversight decisions and strengthen long-term governance.

Contact Bates Group today to discuss how we can support your firm’s transition to Rule 3290.