On September 15, 2026, the Securities and Exchange Commission (SEC) approved new Financial Industry Regulatory Authority (FINRA) Rule 3290, which will replace existing FINRA rules on outside business activities (OBAs) and private securities transactions (PSTs).¹ Among other changes, FINRA Rule 3290 will narrow the scope of FINRA’s “outside activities” rules to focus on “investment-related activities,” which are more likely to pose a risk to member firms and the public. The rule will take effect after FINRA issues a regulatory notice and announces the effective date. When FINRA proposed Rule 3290 last January, we discussed the rule proposal in a client alert. In this alert, we note the key takeaways from the SEC’s approval of the new rule.

I. Recap of FINRA’s Prior OBA and PST Rules

Historically, FINRA has addressed OBAs and PSTs in FINRA Rules 3270 and 3280, respectively. Rule 3270 provides that no person registered with a FINRA member may serve in certain roles (e.g., employee, officer, director) with respect to another person or be compensated, or have a reasonable expectation of compensation, as a result of any business activity, unless he or she provides prior written notice to the member. Upon receipt of written notice, the member must consider whether the proposed activity will (1) interfere with or otherwise compromise the registered person’s responsibilities to the member and/or the member’s customers or (2) be viewed by the customers or the public as part of the member’s business. Based on its review of these factors, the member must determine whether to limit or prohibit the activity. The member also must evaluate whether the proposed activity is properly characterized as an OBA or whether it should be treated as a PST subject to Rule 3280.

Separately, under FINRA Rule 3280, no person associated with a FINRA member (regardless of registration status) may participate in any manner in a PST unless they comply with certain requirements. A PST includes any securities transaction outside the scope of an associated person’s employment with the member firm. The associated person must provide written notice to the member describing in detail the proposed transaction and their proposed role. If the associated person will receive “selling compensation,” the member must approve the transaction, record the transaction on its books and records, and supervise the transaction as if it were executed on behalf of the member. If no selling compensation will be received, the member must provide the associated person with prompt written acknowledgment and may, at its discretion, require the associated person to adhere to specified conditions.

II. Takeaways From the SEC’s Approval of FINRA Rule 3290

a. Final Rule 3290 is consistent with FINRA’s January proposal.

Final Rule 3290 is consistent with FINRA’s January 2026 proposal:

• Structure. The final rule combines Rule 3270 and Rule 3280 into a single rule (i.e., Rule 3290). It maintains the distinction between OBAs and PSTs but redefines them to be more limited and renames them as “outside activities” and “outside securities transactions.” If any activity triggers the new definitions of outside activities or outside securities transactions, the obligations are similar to the obligations under Rule 3270 and Rule 3280, respectively. 
• Limitation to Investment-Related Outside Activities. Unlike old Rule 3270, Rule 3290 will only apply to outside activities that are investment-related.
• New Exclusions for Activities for Affiliates and Certain Real Estate Activities. Rule 3290 also will exclude (i) the purchase, sale, rental or lease of a main home and up to two secondary homes that meet certain requirements and (ii) any activity on behalf of a member or its affiliate, including investment advisory, insurance or banking activity.²
• Investment Advisory Activities for Unaffiliated Advisers. Activity on behalf of an unaffiliated investment adviser registered with the SEC or with a state securities commission will be considered an outside activity rather than an outside securities transaction, meaning that members will not be required to supervise the activity under Rule 3290. As noted above, investment advisory activity on behalf of an affiliate (like any other activity on behalf of an affiliate) will be excluded from the rule entirely.
• Codified Interpretive Positions. Rule 3290 will codify existing FINRA interpretive positions regarding portfolio managers, Regulation R and agreements to allocate supervisory responsibilities among FINRA member firms
• Exemptive Relief. The final rule will allow members to seek exemptive relief under FINRA Rule 9610. 

We describe the above points in greater detail in our prior alert.

b. FINRA members should reexamine the scope of their outside activity rules based on guidance in the SEC’s approval order.

The approval order provides additional guidance on which activities will be considered investment-related and thus fall within the scope of FINRA Rule 3290. Under the final rule, “investment-related activity” means “pertaining to financial assets, including, but not limited to, securities, crypto assets, commodities, derivatives (such as futures and swaps), currency, banking, real estate or insurance.” In its response to comments, FINRA confirmed that the rule will apply to “money transmission, lending, collectible activity, and financial planning to the extent they pertain to financial assets.”³ In addition, investment-related activity includes “crypto asset development, promotion or market intermediation.”⁴ The definition “captures tax advice and other similar types of services to the extent [they] are performed concomitant to investment-related activity.”⁵ FINRA noted that fundraising activity may be investment-related under certain circumstances but did not provide additional details.⁶ Firms seeking to narrow the scope of their outside activities policies and procedures should review the approval order, along with the regulatory notice FINRA intends to publish, which will provide additional guidance on the new rule.

c. While the scope of Rule 3290 is narrower than the scope of its predecessors, where members are required to supervise activity, Rule 3290 does not lessen their supervisory obligations.

Rule 3290 will have a narrower scope than Rule 3270 and Rule 3280, but where it applies, members will be subject to similar supervisory obligations as under the prior rules. Registered persons will still be required to provide prior written notice to members before engaging in any investment-related outside activity, and members must decide whether to limit or prohibit the activity. Associated persons will still be required to provide prior written notice before they participate in any manner in any outside securities transaction. The member must approve or disapprove transactions with selling compensation, and if the member approves the transaction, the member must record and supervise the transaction. For outside securities transactions without selling compensation, the member must provide the associated person with prompt written acknowledgment and may require the associated person to adhere to specified conditions in connection with the transaction. Members communicating any policy change to their associated persons may wish to clarify that these requirements remain in effect.

Unlike its predecessors, Rule 3290 requires members to assess, among other things, whether an outside activity or outside securities transaction involves a customer of the registered person or associated person.⁷ A registered person or associated person also must provide notice to the member of any material change to an outside activity or outside securities transaction, respectively.

d. Members must be attentive to red flags indicating problematic activities.

The approval order repeatedly notes that “nothing in the proposed rule change would alter the well-settled principle that members must investigate ‘red flags’ indicating problematic activities.”⁸ For example, members must be attentive to red flags that an associated person may be engaging in undisclosed outside activities. In addition, while Rule 3290 will not impose on members “per se supervisory obligations” with respect to unaffiliated investment advisory activity, members may not ignore suspicious activity.⁹ Supervisors should continue to escalate suspicious activity, where appropriate, and should not assume that they may ignore suspicious activity simply because it is not subject to Rule 3290.

e. FINRA is still working with the SEC and the states to amend Form U4.

As we noted in our prior client alert, independent of existing Rule 3270, Question 13 on Form U4 currently requires individuals registered with FINRA to disclose whether they engage in certain OBAs. When it proposed Rule 3290, FINRA said that it “would endeavor to work with the SEC and states to harmonize the requirements where appropriate.”¹⁰ The approval order does not provide additional details. For now, members may be required to include OBAs on the Form U4 for a registered person, even if the OBA is not an investment-related activity under Rule 3290.