The SEC approved FINRA Rule 3290 on 15 September 2026. Once implemented, it will replace two rules that firms currently use to manage employees’ activities outside the business: Rule 3270 on outside business activities and Rule 3280 on private securities transactions.
The central change is a narrower reporting requirement for registered persons’ outside activities. Rule 3290 focuses that requirement on investment-related activities, while retaining a separate set of requirements for associated persons’ outside securities transactions. FINRA’s aim is to give firms more time to assess activities with a greater potential to harm customers or create confusion about the firm’s involvement. sec.gov
Rule 3290 has been approved, but FINRA has yet to set its effective date. Firms should continue following Rules 3270 and 3280 until the new rule takes effect. sec.gov
What does FINRA Rule 3290 replace?
Today, firms manage outside activities under two rules:
- Rule 3270 generally requires registered persons to give their firm prior written notice of certain outside business activities. The firm considers whether the activity could interfere with the person’s responsibilities or appear to the public to be part of the firm’s business.
- Rule 3280 governs private securities transactions conducted by associated persons outside the scope of their work for the firm. Its notice, approval and supervisory requirements depend in part on whether the person receives selling compensation.
Rule 3290 brings these requirements into one framework, with distinct provisions for outside investment-related activities and outside securities transactions. Some existing notice, assessment, supervision and recordkeeping obligations will remain, but firms will need to check how the approved rule applies to each type of activity.
What changes under FINRA Rule 3290?
A narrower scope for outside activity reporting
Under Rule 3270, the reporting requirement can capture outside business activities unrelated to investing. Rule 3290 narrows the requirement for registered persons to outside investment-related activities, subject to the rule’s exclusions and exceptions. That term covers activities concerning financial assets beyond securities, including areas such as crypto assets, insurance, banking and real estate. sec.gov
Firms should pay close attention to how an activity is classified. An outside role connected to crypto assets, for example, should not be dismissed simply because it does not involve a securities transaction. FINRA has described the list of investment-related activities as illustrative rather than exhaustive.
Different obligations for different activities
Rule 3290 preserves a distinction between an outside activity and an outside securities transaction. The firm’s obligations also vary according to the circumstances of the transaction, with the most extensive requirements applying to outside securities transactions involving selling compensation.
The narrower rule does not prevent firms from applying stricter internal requirements where their own risk assessment calls for them. Firms also remain responsible for investigating red flags that suggest problematic activity. sec.gov
Is FINRA Rule 3290 in effect?
No. The SEC approved the rule change on 15 September 2026, but FINRA has not yet established the effective date. In the approval order, the SEC noted that FINRA would set a date that gives firms time to implement the change while bringing the revised requirements into use in a timely way.
For now, firms should continue to operate under Rules 3270 and 3280. They can prepare their Rule 3290 procedures, but should time any change to live reporting and supervisory processes to FINRA’s implementation announcement.
What should firms do now?
A useful starting point is to compare the firm’s current policies, disclosure forms and review processes with the approved Rule 3290 framework. In particular, compliance teams can examine:
- Which activities employees currently disclose under Rule 3270, and which would qualify as investment-related under Rule 3290.
- How the firm distinguishes outside activities from outside securities transactions.
- Where prior notice, written approval, supervision and recordkeeping requirements differ by activity.
- Which internal requirements the firm may choose to retain, even where the new rule no longer requires them.
- Who will monitor FINRA’s effective-date announcement and coordinate the change to procedures and training.
Firms should also avoid assuming that a narrower Rule 3290 reporting requirement automatically resolves every other disclosure obligation. The SEC’s approval order notes that Form U4 disclosure requirements were outside the scope of this rule change. Those requirements need to be considered separately.
The practical challenge: changing the process at the right time
Rule 3290 gives firms a clear piece of preparation work now and a separate implementation step later. Policies can be reviewed, forms drafted and affected teams briefed while Rules 3270 and 3280 remain in force. Once FINRA announces the effective date, firms can put the new procedures into operation and retain a clear record of when they made that change.
That distinction matters whenever a regulatory update passes through several stages before becoming applicable. The SEC’s approval tells firms what is coming. FINRA’s implementation announcement will tell them when to change how they work.
At Adclear, we work with regulated teams on applying requirements and firm policies consistently within their marketing approval processes. Rule 3290 concerns a different compliance workflow, but it shows why teams need to keep the status and timing of a rule clear when updating the processes people use every day.
Once you're booked in, we'll send you a free playbook on Financial promotions compliance for FinTechs.
