FINRA’s Proposed Rule 3290: A New Framework for Outside Activities and Private Securities Transactions

FINRA’s Proposed Rule 3290: A New Framework for Outside Activities and Private Securities Transactions

FINRA has proposed a meaningful rewrite of its outside-activities rules. In January 2026, FINRA filed proposed Rule 3290, which would replace current Rule 3270 on outside business activities and Rule 3280 on private securities transactions. The proposal is designed to consolidate the framework, focus firm review on higher-risk investment-related activity, and reduce what FINRA views as unnecessary compliance burdens tied to low-risk outside work.

The proposed changes matter because Rules 3270 and 3280 sit at the center of some of the industry’s most sensitive supervisory issues. They affect how firms review outside business activities, how they handle selling away and buying away, when a representative’s conduct is treated as part of the member’s business, and when firms must approve, record, and supervise securities activity occurring outside the firm. Proposed Rule 3290 does not eliminate those concerns. Instead, it reorganizes them into a single rule and narrows the scope of what must be reported and assessed on the non-securities side.

What FINRA Is Trying to Change

Under the current framework, Rule 3270 applies to registered persons’ outside business activities, while Rule 3280 applies more broadly to associated persons’ private securities transactions. Rule 3280 also carries the more consequential supervisory obligations: if the outside securities transaction involves selling compensation and the firm approves it, the firm must record the transaction on its books and supervise it as though it were executed on behalf of the firm.

Proposed Rule 3290 would keep many core features of the existing regime, including prior written notice, firm assessment of the activity, and prior written approval only for outside securities transactions involving selling compensation. But it would also make several important changes. Most notably, it would shift the outside-activity side of the rule away from all outside business activities and toward a narrower category: investment-related activity. FINRA says the goal is to preserve investor protection while reducing low-value reporting noise.

A Narrower Focus on “Investment-Related Activity”

This is probably the proposal’s biggest practical shift.

FINRA says the new rule would focus on outside investment-related activities that may pose greater risk to firms and the public, rather than requiring reporting and review of lower-risk outside work. The proposal gives ordinary examples of the kind of “white noise” it wants to eliminate from the reporting system, such as refereeing sports games, driving for a car service, or bartending on weekends. By contrast, FINRA wants firms to concentrate their resources on activities more likely to create customer confusion, conflicts, or reputational and supervisory risk.

At the same time, FINRA’s definition of “investment-related activity” is still quite broad. It would include activity pertaining to financial assets such as securities, crypto assets, commodities, derivatives, currency, banking, real estate, and insurance. It also would include personal securities transactions outside Rule 3210, including what the industry often refers to as buying away. So while the proposal narrows the field, it does not do so in a way that would meaningfully relax scrutiny over activity that could plausibly be seen by customers or the public as part of a member’s business.

What Stays the Same

Despite the restructuring, the proposal keeps the basic split between two categories of conduct.

Registered persons still would need to give prior written notice of outside investment-related non-securities activities. Associated persons, including registered persons, still would need to give prior written notice of outside securities transactions. And firms still would need to assess whether the activity is properly characterized, whether it involves the customer of the registered or associated person, whether it could interfere with the person’s responsibilities to the firm or its customers, and whether customers or the public could view it as part of the member’s business.

The proposal also preserves the core distinction between outside securities transactions with and without selling compensation. If the outside securities transaction does not involve selling compensation, the firm would acknowledge the notice and could impose conditions, but it would not have to approve and supervise the activity. If the transaction does involve selling compensation, the firm would have to approve, approve with conditions, or disapprove it, and if approved, record and supervise it as if it were firm business.

What Really Changes in Practice

Where the proposal becomes more interesting is in the exclusions and reclassification decisions.

First, proposed Rule 3290 would exclude activity conducted on behalf of a member or its affiliate. That includes investment adviser activity at a dually registered firm and insurance or banking activity at an affiliate. FINRA says this recognizes firms’ and control persons’ ability to implement controls across business lines. Later in the process, FINRA also stated that it revised the proposal to make clear that all affiliate activity would be excluded, not just non-broker-dealer affiliate activity.

Second, and likely most significant for many firms, the proposal would change how outside activity at an unaffiliated investment adviser is treated. Instead of continuing the older approach that effectively pulled certain outside IA activity into the private securities transaction framework, proposed Rule 3290 would treat qualifying unaffiliated IA activity as an outside activity, not an outside securities transaction. That means prior written notice and upfront firm assessment would still be required, but the member would not be required to supervise or record the activity under Rule 3290. FINRA explained that this change responds to longstanding confusion, privacy issues, and practical problems associated with requiring broker-dealers to supervise unaffiliated IA business.

Third, the proposal also excludes several categories of personal activity that FINRA appears to view as lower risk. These carveouts include certain family transactions with no selling compensation, certain outside accounts and transactions already handled under Rule 3210, products such as mutual funds, 529 plans, and variable annuities, personal investments in non-securities, and certain personal real estate activity. The broader point is that FINRA is trying to reduce compliance noise around routine personal matters so firms can focus more closely on outside conduct that is more likely to raise real supervisory and investor-protection concerns.

Why Firms and Advisors Should Care

For firms, this proposal is not just a simplification exercise. It is also a classification and systems issue.

Even under the proposed rule, firms would still need to determine whether activity is properly characterized, whether it involves the associated person’s customer, whether it creates conflicts or interference risks, and whether it could reasonably be viewed as part of the member’s business. In other words, a narrower rule does not mean a casual rule. Firms would still need clear intake processes, escalation standards, and documentation practices, especially for activities near the line between an outside investment-related activity and an outside securities transaction.

The proposal also makes plain that only outside securities transactions involving selling compensation trigger the formal approval-plus-books-and-records-plus-supervision regime. That could reduce compliance burdens in some settings, but it also raises the stakes on getting the classification right. A firm that mislabels selling activity, or ignores red flags suggesting that an outside activity is really a private securities transaction, still faces the same basic supervisory risk. FINRA specifically notes in the proposal that nothing in Rule 3290 would alter the well-settled principle that firms must respond to red flags.

Final Takeaway

This proposal is not a repeal of FINRA’s outside-activity framework. It is a rewrite of it.

FINRA is proposing to move from a two-rule structure to a single consolidated rule, while narrowing the focus of the outside-activity side of the regime to investment-related conduct. The proposal preserves prior notice, preserves firm review, preserves approval and supervision for selling-compensation securities activity, and preserves the core concern that customers may mistake outside conduct for firm business. But it also would reduce reporting noise, create broader exclusions, and materially change the treatment of unaffiliated investment adviser activity.

For broker-dealers and advisors, that means any eventual final rule could require updates to outside-activity questionnaires, internal classification standards, supervisory processes, and escalation procedures. And for the industry more broadly, it shows FINRA continuing to favor a more risk-based approach rather than a broader one-size-fits-all reporting model.

At AMW Law PLLC, we represent broker-dealers and financial advisors in FINRA regulatory investigations, examinations, and enforcement matters, including matters involving outside business activities, private securities transactions, supervision, and selling away. Issues involving outside activities and private securities transactions often surface only after a FINRA exam, internal review, customer complaint, or enforcement inquiry. Understanding where the lines are drawn—and how those lines may change—can matter well before a dispute becomes formal.