SEC Approves FINRA's Overhaul of Outside Activities Rules for Broker-Dealer Personnel

On September 15, 2026, the SEC approved a long-anticipated Financial Industry Regulatory Authority (FINRA) rule change that consolidates and modernizes the regulatory framework governing outside activities of broker-dealer associated persons.¹ The new rule — FINRA Rule 3290 — replaces the existing pairing of FINRA Rule 3270 (Outside Business Activities of Registered Persons) and FINRA Rule 3280 (Private Securities Transactions of an Associated Person) with a single, streamlined regime. The approval marks the culmination of a rulemaking process that began with FINRA’s January 2026 filing, which drew extensive public comment across two comment periods.

What Changes and Why It Matters

At its core, the rule change narrows the universe of reportable activities. The change focuses “the rule on investment-related activities to reduce unnecessary burdens while maintaining the core investor protections of existing Rules 3270 and 3280.”² Under the old rules, registered persons were required to report all outside business activities — a requirement that swept in everything from bartending on weekends to refereeing youth sports, alongside genuinely investment-related conduct. The new Rule 3290, however, replaces this broad mandate with a focus on “investment-related activities,” defined as activities “pertaining to financial assets, including securities, crypto assets, commodities, derivatives (such as futures and swaps), currency, banking, real estate or insurance.”³ The SEC found this risk-based scoping “reasonably designed” to let firms redirect limited compliance resources toward activities most likely to cause investor confusion or harm.⁴

The new rule preserves the existing bifurcated structure: Registered persons must report outside activities, while associated persons must report outside securities transactions. Prior written notice remains required for both categories, and members must still assess whether the activity involves a customer, could be confused for firm business, or would compromise the person’s responsibilities to the firm and its clients.

Key Exclusions and Reclassifications

Several categories of activity are now excluded from Rule 3290 entirely:

• Affiliate activity. An associated person’s activity on behalf of a member or its affiliate — defined as any “entity that controls, is controlled by, or is under common control with the member”⁵ — falls outside the rule. This encompasses investment advisory activity at a dually registered broker-dealer/investment adviser as well as insurance or banking activity at an affiliate.
• Certain personal investments. Personal investments in non-securities, securities transactions already subject to FINRA Rule 3210, and limited personal real estate transactions (a main home and up to two secondary homes, subject to ownership conditions) are carved out.⁶

Perhaps the most significant operational change concerns unaffiliated registered investment adviser activity. Under the old framework, a series of 1990s-era FINRA Notices to Members required members to supervise and maintain records for their associated persons’ advisory activities at unaffiliated registered investment advisors: obligations that FINRA acknowledged had created “significant confusion and practical challenges,” including privacy barriers to obtaining client information from an unaffiliated firm.⁷ Rule 3290 reclassifies this activity as an “outside activity” rather than an outside securities transaction, which means the member must still receive prior written notice and conduct an upfront assessment but is no longer required to supervise or keep records of the activity.

Similarly, securities activity qualifying under the Gramm-Leach-Bliley Act or Regulation R exceptions to broker-dealer registration is now treated as an outside activity subject to notice and assessment — but not supervision or recordkeeping.⁸

Practical Takeaways

Compliance teams should begin preparing now. While FINRA has not yet announced an effective date — it stated it would determine one “balancing sufficient time for implementation with its objective of reducing unnecessary burdens in a timely manner” — firms will need to retool systems currently designed around Rules 3270 and 3280.⁹ The new rule’s risk-based architecture means that the categorization exercise at intake—is this an outside activity, an outside securities transaction, or excluded altogether?—becomes the critical compliance decision point.

The floor, not the ceiling. The SEC emphasized repeatedly that Rule 3290 establishes minimum requirements. Firms retain full discretion to impose stricter standards, broader assessment criteria, or additional conditions.¹⁰

Red flags obligations persist. Nothing in Rule 3290 alters members’ overarching supervisory duties under FINRA Rule 3110 or the well-settled obligation to investigate red flags suggesting potential misconduct, including undisclosed outside activity or undisclosed securities transactions.¹¹

 

---

 

1 See Order Approving a Proposed Rule Change, as Modified by Partial Amendment No. 1, to Adopt FINRA Rule 3290 (Outside Activities Requirements), Exchange Act Release No. 34-106381, at 21 (Sept. 15, 2026).
2 Notice of Filing of a Proposed Rule Change to Adopt FINRA Rule 3290 (Outside Activities Requirements), Exchange Act Release No. 34-104746, 91 Fed. Reg. 5003, 5004 (Feb. 3, 2026).
3 Id.
4 See FINRA Rule 3290, supra note 1, at 21 (“The proposed rule change is reasonably designed to focus member supervisory and compliance resources on the types of outside activities — that is, investment-related activities — of a member’s registered or associated persons that are appropriately within the member’s purview, particularly where the activities are most likely to be viewed by investors or other members of the public as part of the member’s business and thus under its supervision”).
5 See 91 Fed. Reg. 5010; see also FINRA Rule 3290, supra note 1, at 61–62 (“According to FINRA, activity conducted on behalf of an affiliate occurs within the scope of the person’s relationship with the broader corporate organization and therefore does not pose the same risks as other outside activities targeted by the proposed rule change”).
6 See id. (“[S]ome of these transactions are covered by FINRA Rule 3210, which already requires a member to consent to an associated person’s opening an account with another member or financial institution in which securities transactions can be effected ...”).
7 See 91 Fed. Reg. 5006.
8 See FINRA Rule 3290, supra note 1, at 16–17.
9 See id. at 71, n. 240.
10 See id. at 7 (“Importantly, the proposed rule change would not limit a member’s ability to expand the scope of its assessment for reportable activities beyond the minimum requirements established in the proposed rule change or to exercise discretion to apply stricter criteria and impose conditions or prohibitions based on the member’s own assessment of the risk presented by the identified activity”).
11 See id. at 22–23 (“[T]he proposed rule change does not alter members’ overarching supervisory responsibilities under the federal securities law and FINRA Rule 3110 to supervise its business and to investigate and act upon red flags indicating potential misconduct”).