SEC Approves FINRA Rule 3290, Reshaping Outside Activity Rules for Broker-Dealers

WHAT CHANGES

Scope: From ‘Business’ Activities to ‘Investment-Related’ Activities

While current Rule 3270 reaches essentially any outside business activity of a registered person, new Rule 3290 is triggered only by “investment-related” activity outside the scope of the person’s relationship with the firm. The rule defines that term as activity pertaining to financial assets, including securities, crypto assets, commodities, derivatives, currency, banking, real estate, and insurance. It expressly includes acting as, or being associated with, a broker-dealer, issuer, insurance agent or company, investment company, investment adviser, futures commission merchant, commodity trading advisor, commodity pool operator, municipal advisor, futures sponsor, money services business, bank, savings association, or credit union. It also covers “buying away” (personal securities investments outside the firm), except for transactions subject to Rule 3210.

In response to comments, FINRA amended the definition of “investment-related activity” to add “money services business” and to make clear that the enumerated examples are illustrative, not exhaustive. FINRA also said in its responses to comments that the definition captures capital raising, lending, financial planning, private fund sales, investment partnerships, and crypto-asset development, promotion, or market intermediation, as well as consulting, marketing, accounting, legal, and tax services that are concomitant to investment-related activity. The Commission accepted FINRA’s position that the definition should be interpreted broadly.

The practical result is that routine nonfinancial activities, such as coaching youth sports, bartending, refereeing, or serving on a civic board, generally fall outside the rule.

Two Categories of Reportable Activity

Rule 3290 sorts covered activity into two buckets, with obligations that track risk:

• Outside activities of registered persons—investment-related activity not in connection with a securities transaction—require prior written notice, updated notice on any material change, and a firm assessment under Rule 3290(a) and (c)
• Outside securities transactions of associated persons require prior written notice, updated notice on any material change, and a firm assessment under Rule 3290(b) and (d); if the person will receive selling compensation, the firm must also approve the transaction in advance

Firm Assessment Factors

On receiving notice, a firm must assess at a minimum whether the activity (1) is an outside securities transaction (or, for a securities transaction, is for selling compensation), (2) involves a customer of the registered or associated person, (3) will interfere with or compromise the person’s responsibilities to the firm or its customers, and (4) will be viewed by customers or the public as part of the firm’s business. Factor (2) is tied to customers of the person, not of the firm, a choice that FINRA defended over objections from the North American Securities Administrators Association (NASAA). Based on that assessment, the firm must determine whether to permit the activity or condition, limit it, or prohibit it.

Tiered Firm Obligations for Securities Transactions

• Not for selling compensation: The firm must promptly acknowledge the activity in writing and may, at its discretion, place conditions or limitations on the activity.
• For selling compensation: Written approval (with or without conditions) is required before the activity may proceed. The firm may impose conditions, must record the activity on its books and records, and must supervise the activity as if the transaction were executed on the firm’s behalf. Where a person is associated with more than one firm, Supplementary Material .01 permits a written allocation arrangement under which firms may enter into a written agreement allocating compliance responsibilities, as long as at least one firm assumes responsibility for compliance. This codifies guidance in NASD Notice to Members 96-33.

Recategorized Activities

Three categories that have long been treated as private securities transactions become outside activities, requiring notice and assessment but not firm supervision or recordkeeping of the activity itself:

• Serving as a portfolio manager or investment committee member for registered investment companies, unregistered investment companies, BDCs, REITs, and tax-exempt entities (Supp. Material .02); selling those entities’ shares remains an outside securities transaction
• Activity at an unaffiliated SEC- or state-registered investment adviser (Supp. Material .03); this revises the supervision and recordkeeping expectations set out in 1990s NASD Notices to Members
• Securities activity that qualifies under the Gramm-Leach-Bliley Act (GLBA) or Regulation R exceptions from broker-dealer registration (Supp. Material .05)

Exclusions

Rule 3290 does not apply to the following:

• Activity on behalf of the member or its affiliates (defined by control)
• Securities transactions among immediate family members without selling compensation
• Personal securities transactions subject to Rule 3210
• Personal investments in non-securities
• The purchase, sale, rental, or lease of a main home and up to two secondary homes, held directly or through specified wholly owned entities and trusts
• Activity conducted under a firm contract, such as bank or insurance networking arrangements, which remains subject to Rule 3110 supervision (Supplementary Material .04)

New Express Supervision Duty

Supplementary Material .06, added by Amendment No. 1, requires a firm that imposes conditions or limitations on an outside activity or transaction to reasonably supervise compliance with them. FINRA characterized this as already implicit in Rules 3270 and 3280, but it is now explicit. A commenter representing law-firm-type “professional OBAs” argued that this duty cannot be squared with privilege obligations. FINRA responded that firms are not required to impose conditions in the first place, and it pointed to the general exemptive authority in Rule 3290(h) (with a conforming amendment to Rule 9610). It declined to create a safe harbor.

Recordkeeping

Firms must keep records of their compliance with Rule 3290 and preserve them in accordance with Exchange Act Rule 17a-4(e)(1).

HOW COMMON DUAL-HATTED ROLES ARE TREATED

Many firms’ most difficult outside-activity questions involve individuals who wear more than one hat. Rule 3290 does not have a separate “dual-hatted” provision, so the treatment turns on which category the second role falls into. In practice, the deciding questions are (1) whether the other entity is an affiliate of the member (defined by control), (2) whether the activity involves a securities transaction, and (3) whether the individual receives selling compensation.

POINTS TO WATCH

The Affiliate Line Is Key

An adviser under common control with the broker-dealer is excluded. An adviser outside the corporate family is not, and the person’s role there becomes a notice-and-assess item. Firms with complex ownership structures should document their control analysis for each adviser relationship.

‘No Required Supervision’ Is Not ‘No Responsibility’

For unaffiliated adviser activity, the SEC order confirms that firms remain subject to Rule 3110 and must investigate red flags. Commenters, including NASAA and the Public Investors Advocate Bar Association (PIABA), argued that removing the supervision requirement weakens investor protection without meaningfully reducing litigation or arbitration exposure. Firms should expect claimants to question how the firm identified, escalated, and addressed red flags arising from unsupervised activity.

Conditions Create Supervision Duties

Rule 3290 lets a firm approve dual-hatted activity subject to conditions, such as restrictions on soliciting the firm’s customers or reporting requirements. Once imposed, the firm must reasonably supervise compliance with them. Any conditions should therefore be ones the firm can realistically monitor, given the privacy and access problems that may arise with unaffiliated advisers.

Mischaracterization Risk

The firm’s assessment must confirm the activity is properly characterized. A representative described as working “only” as an adviser who also sells securities away from the firm, especially for compensation, may fall into the outside securities transaction category, with the heavier obligations.

The Customer Factor Is New

The assessment must now ask whether the activity involves a customer of the registered person. That will often be the case for dual-hatted representatives serving the same clients through two entities.

Other Regimes Continue to Apply

Form U4 disclosure, state investment adviser representative registration, and Regulation Best Interest and Form CRS obligations are unaffected by this rule change, and Form U4 Question 14 has not yet been harmonized with Rule 3290.

FIRMS MAY ADOPT BROADER REQUIREMENTS

The SEC repeatedly stressed that Rule 3290 sets minimum requirements. Firms may adopt broader requirements, require notice of activities outside Rule 3290’s scope (including affiliate activity), and impose conditions or prohibitions based on their own risk assessments. The order also confirms that the rule does not change a firm’s Rule 3110 supervisory obligations or the duty to investigate red flags, including red flags arising from activity the rule no longer requires them to supervise.

OPEN ISSUES AND POINTS OF FRICTION

• Effective date: FINRA has not announced an effective date and has said it will balance sufficient implementation time against its goal of reducing unnecessary burdens in a timely manner. Rules 3270 and 3280 remain in effect until Rule 3290 becomes effective. At least one commenter asked for 12 months or more.
• Further guidance: FINRA said it will consider guidance on what constitutes a “material change” and on the scope of “investment-related activity,” including real estate, banking, and insurance edge cases.
• Form U4: Commenters, including the Securities Industry and Financial Markets Association, noted that Form U4 Question 14 still calls for disclosure of non-investment-related outside activities, which could blunt the rule’s burden reduction. FINRA treated this as outside the proposal but said it would work with the SEC and state regulators on harmonization.
• Investor-protection opposition and litigation risk: NASAA, PIABA, state regulators, and plaintiff-side practitioners objected, particularly to removing supervision of unaffiliated adviser activity. Some argued that this shifts, rather than reduces, arbitration and enforcement exposure. The Commission concluded the rule is consistent with Section 15A(b)(6), but the “red flags” doctrine and Rule 3110 may remain the focus of claims and examinations.

PRACTICAL TAKEAWAYS

• Keep current processes running: Rules 3270 and 3280 govern until FINRA announces the effective date in a Regulatory Notice.
• Decide where to sit relative to the floor: Firms must choose whether to keep broader disclosure (including non-investment OBAs) or align with the minimum. That choice affects supervisory procedures, attestations, and Form U4 practices.
• Map activity categories: Review how dually registered and unaffiliated RIA personnel, portfolio managers, and Regulation R activity are currently handled, since supervision and recordkeeping obligations change for those groups.
• Re-map the dual-hatted population, including affiliated and unaffiliated adviser roles, bank and insurance arrangements, and multi-firm associations, to the appropriate Rule 3290 category, and update procedures for each.
• Establish procedures to supervise conditions and limitations: If your procedures impose conditions or limitations, plan how you will supervise and evidence compliance, including for licensed professionals.
• Update forms, workflows, and training, including the new customer-of-the-person assessment factor and material-change updates.
• Maintain red-flag escalation procedures: Reduced reporting does not reduce the duty to investigate.
• Watch for guidance on materiality, scope, and the exemptive process under Rule 3290(h).