FINRA’s Proposed Outside Activities Rule 3290

The Financial Industry Regulatory Authority (FINRA) has proposed a sweeping update to how broker‑dealers handle outside business activities and private securities transactions. FINRA seeks to consolidate and replace Rules 3270 (Outside Business Activities of Registered Persons) and 3280 (Private Securities Transactions of an Associated Person) with a single new rule: Rule 3290 (Outside Activities Requirements). The proposal preserves the core investor protection concepts of the existing rules but refocuses them on investment‑related activities.

From Rules 3270 and 3280 to a Single Framework

Rule 3270 currently requires registered persons to provide prior written notice to their member firm before engaging in any business activity outside the scope of their relationship with the firm, i.e., an “outside business activity” (OBA). Rule 3280 governs “private securities transactions” (PSTs) by associated persons, requiring written notice and, where selling compensation is involved, member approval, books and records treatment, and supervision as if the transactions were executed through the member.

This dual structure forces firms to classify each outside role as an OBA or a PST, a distinction that has been particularly complex for investment advisory activity. Over time, this patchwork has become duplicative and not always aligned with actual risk. Rule 3290 is FINRA’s attempt to rationalize this space.

The Pivot to Investment‑Related Activity

A central innovation is the concept of “investment‑related activity.” Rather than requiring notice and review for any and all outside business activities, Rule 3290 would focus on activities that pertain to financial assets such as securities, crypto assets, commodities, derivatives, currency, banking, real estate, and insurance. It explicitly includes roles with broker‑dealers, issuers, investment advisers, funds, futures firms, banks, and similar institutions, and it captures personal securities transactions away from the firm (buying away), except where already governed by Rule 3210.

FINRA’s retrospective review confirmed that current OBA rules require reporting of countless noninvestment side gigs, such as refereeing, bartending, and rideshare driving, which are unlikely to confuse customers or implicate the firm’s business. Under Rule 3290, those activities would fall outside the rule’s scope. The expectation is that firms will no longer be inundated with low‑value OBA notices and can instead focus compliance resources on outside activities that customers could reasonably view as part of a representative’s financial services practice.

Notice and Member Assessment

The proposal leaves the basic notice architecture largely intact. Registered persons would still be required to provide prior written notice of any investment‑related outside activity. Associated persons, whether registered or not, would still be required to provide prior written notice of any outside securities transaction, describing the activity or transaction, the person’s role, and whether selling compensation will be received. Material changes would require updated notice.

On receipt of a notice, members must determine whether the activity is properly characterized (outside activity versus outside securities transaction; with or without selling compensation), whether it involves the customer of the associated or registered person, whether it could interfere with the person’s responsibilities, and whether customers or the public might reasonably view the activity as part of the firm’s business.

Outcomes differ depending on the type of activity. For a registered person’s investment‑related outside activity, the firm must consider whether to impose conditions, limitations, or a prohibition, but is not required by Rule 3290 to acknowledge, approve, or supervise the activity. For an associated person’s outside securities transaction without selling compensation, the firm must provide prompt written acknowledgment and may impose conditions on the activity, but again is not required to supervise. For an outside securities transaction with selling compensation, the firm must decide whether to approve (with or without conditions) or disapprove, must communicate that determination in writing, and if it approves, must record the transaction and supervise it as if executed on behalf of the member. In that respect, Rule 3290 preserves the familiar PST treatment for compensated away business. FINRA also emphasizes that nothing in the proposal alters firms’ existing obligation to investigate and respond to “red flags” under Rule 3110.

Targeted Exclusions

To further refine the rule’s scope, FINRA proposes several explicit exclusions. Activity performed on behalf of the member or an affiliate would not be treated as “away” activity, on the premise that firms can impose effective controls across affiliated business lines.

The proposal also excludes personal investments in nonsecurities. FINRA has clarified that personal transactions in nonsecurity crypto assets, such as bitcoin, fall outside Rule 3290, and therefore require no prior notice or approval under this rule. Where a crypto asset is a security, personal transactions would require prior written notice and acknowledgment, but absent selling compensation, would not require approval.

Similarly, Rule 3290 would exclude the purchase, sale, rental, or lease of a main home and up to two secondary homes, if owned in specified ways, including through entities or trusts controlled by the associated person and immediate family. FINRA views these personal real estate transactions as low risk from the perspective of customer confusion and firm exposure. Existing exclusions for no‑compensation transactions among immediate family and for transactions already subject to Rule 3210 (including many mutual funds, 529 plans, and variable contract transactions) are also retained.

Outside Investment Advisor (IA) Activities

One of the most notable changes relates to outside investment advisory activity at unaffiliated advisers. Under longstanding guidance, associated persons’ IA activities that went beyond mere recommendation and involved effecting or placing orders were treated as “participation in” private securities transactions, triggering supervision and recordkeeping obligations under Rule 3280. Broker‑dealers have struggled to supervise unaffiliated IA business given information and privacy constraints, and have faced litigation risk tied to activities already regulated under the Investment Advisers Act and state law.

The proposal addresses these concerns by treating an associated person’s activity at a registered investment adviser as an outside activity, not an outside securities transaction. The associated person must still provide prior written notice, and the member must still conduct an upfront assessment, but the member is not required by FINRA rules to supervise or maintain books and records for the IA activity. Firms remain free to impose contractual supervisory arrangements if they choose. For many firms, this will be a meaningful reduction in regulatory burden and ambiguity, though it underscores the continuing importance of front‑end assessment and client disclosure.

Banks, GLBA/Reg R, and Exemptive Authority

Rule 3290 also clarifies how certain bank and networking arrangements fit into the framework. Where an associated person’s activity at a nonaffiliate is conducted under a contract between the member and another entity (for example, a bank networking arrangement) and is on behalf of the member, it is not treated as an outside activity but remains within the firm’s ordinary supervisory responsibilities. By contrast, securities activity for a nonaffiliate that is not covered by such a contract but qualifies under Gramm-Leach-Bliley Act or Regulation R exceptions is treated as an outside activity rather than an outside securities transaction, subject to notice and assessment but not supervision and recordkeeping as a PST.

Recognizing that Rule 3290’s broad scope may create edge cases, FINRA also proposes general exemptive authority under the Rule 9600 Series. For good cause shown, and where consistent with investor protection and the public interest, FINRA staff could grant conditional or unconditional exemptions from particular provisions.

What Firms Should Be Doing Now

Although Rule 3290 is still a proposal, it is detailed enough that firms can begin planning. Broker‑dealers should inventory their current OBA and PST programs and consider how their populations of outside activities and IA relationships map onto the proposed framework. Policies and forms built around “any business activity” will need to be revised to focus on investment‑related activity and to incorporate the new exclusions, especially for personal nonsecurities investments and real estate. Training will need to explain the new definitions, including the distinction between personal crypto investing and investment‑related business in digital assets.

Most importantly, firms should consider how to recalibrate their risk‑based supervisory approach. If Rule 3290 is adopted substantially as proposed, regulators will expect to see less time spent on immaterial activities and more on outside roles that customers might reasonably believe fall under the firm’s umbrella.