SEC Approves FINRA Rule 3290 Consolidating Outside Business Activities and Private Securities Transa

Key Takeaways

• On September 15, 2026, the SEC approved FINRA Rule 3290, as modified by Partial Amendment No.
• 1.
• The rule replaces Rules 3270 (Outside Business Activities) and 3280 (Private Securities Transactions) with a single framework that narrows reportable activity to investment-related activities.
• Compliance teams at member firms will need to revise policies, procedures, and surveillance to reflect the new scope, categories, and assessment factors.

Deep Dive

On September 15, 2026, the SEC approved FINRA Rule 3290, as modified by Partial Amendment No. 1. The rule replaces Rules 3270 (Outside Business Activities) and 3280 (Private Securities Transactions) with a single framework that narrows reportable activity to investment-related activities. Compliance teams at member firms will need to revise policies, procedures, and surveillance to reflect the new scope, categories, and assessment factors.

Core mechanics are largely retained:
- Registered persons must give prior written notice of outside activities and update it upon material change.
- Associated persons must give prior written notice of outside securities transactions. Single notices are allowed for related transactions not for selling compensation, and for portfolio managers and investment committee members of certain funds, REITs, and tax-exempt entities who are not receiving selling compensation.
- Transactions for selling compensation still require prior written member approval, including for material changes.
- Members must assess four minimum factors: (1) whether the activity is properly characterized, meaning an outside securities transaction or one for selling compensation; (2) whether it involves a customer of the person; (3) whether it could interfere with duties to the firm or its customers; and (4) whether it could be viewed as part of the firm's business.
- Factor (2) is new for outside activities, and the four-factor assessment is new for what were PSTs, though FINRA believes it matches current practice.
- Proposed Rule 3290.06 makes explicit the duty to reasonably supervise compliance with any conditions or limitations imposed.
- "Selling compensation" keeps its existing definition, now extended to exchanges of securities.
- Firms may apply stricter criteria, and the duty to investigate red flags is unchanged.

FINRA filed on January 22, 2026, and the proposal was published on February 3, 2026. Amendment No. 1 was filed on May 1, 2026, alongside the SEC's order instituting proceedings. The SEC approved the rule on September 15, 2026, ahead of the extended October 1, 2026 deadline. The excerpt provided does not state an effective date or implementation period. Firms should watch for a FINRA Regulatory Notice announcing one, and should not retire Rules 3270 and 3280 procedures until it is published.

Compliance teams should:
- Conduct a gap analysis of written supervisory procedures, attestation forms, and disclosure workflows against Rule 3290.
- Update intake forms to capture the new categories, the customer-involvement factor, and material-change updates.
- Reclassify activities such as unaffiliated adviser arrangements and revise approval routing.
- Document the four-factor assessment and the supervision of imposed conditions.
- Train registered and associated persons and supervisory principals.
- Preserve books and records in line with Exchange Act Rule 17a-4(e)(1).
- Decide whether to retain broader internal reporting than the rule requires, since the narrower scope could create blind spots for non-investment outside business activities (for example, reputational or conflict risks). Firms retain discretion to apply stricter standards.

Overall, the burden should fall for lower-risk activities, but misclassification and thin documentation present examination and enforcement risk during the transition. Firms should be prepared to explain how they reallocated supervisory resources toward higher-risk activity.

Source: Financial Industry Regulatory Authority