What broker-dealers should do now to update Outside Business Activities (OBA) and Private Securities Transactions (PST) disclosures, risk assessments, supervisory workflows and Form U4 processes
The Securities and Exchange Commission approved FINRA Rule 3290, Outside Activities Requirements, on September 15, 2026. The new rule will replace FINRA Rules 3270 and 3280 with a consolidated framework governing outside activities and outside securities transactions. FINRA will announce the rule’s effective date separately in a Regulatory Notice.
Although the rule is intended to reduce unnecessary compliance burdens, implementation will require more than a policy update. Broker-dealers will need to reconsider how they collect disclosures, distinguish among activity types, assess risk, document decisions and monitor conditions imposed on approved activities.
One issue deserves particular attention: Rule 3290 changes FINRA’s outside activity requirements, but it does not change the separate Form U4 reporting framework. Firms should therefore be cautious about eliminating existing intake processes for non-investment-related activities until regulators provide further guidance or amend Form U4 requirements.
A Consolidated, More Risk-Focused Framework
Rule 3290 replaces two existing rules:
- FINRA Rule 3270, which governs outside business activities of registered persons
- FINRA Rule 3280, which governs private securities transactions of associated persons
The new rule organizes the requirements around two categories: Outside Activities and Outside Securities Transactions. Its purpose is to concentrate firms’ compliance resources on activities that present heightened risk to firms, customers and the investing public, while reducing the burden associated with lower-risk activities. The complete regulatory history, filings and amendments are available on FINRA’s SR-FINRA-2026-001 rule-filing page.
A fundamental change is the shift from broadly capturing outside business activities to focusing Rule 3290’s notice and assessment requirements on investment-related activities. The definition encompasses a broad range of financial activities, including those involving securities, crypto assets, commodities, derivatives, currency, banking, insurance, real estate and money services.
As a result, activities such as bartending, driving for a car service or refereeing sports may no longer require notice, review or supervision under Rule 3290. FINRA’s goal is to reduce the compliance “white noise” associated with activities that generally present less investor protection risk, allowing firms to direct greater attention to financial and investment-related activities.
The operational challenge will be translating that risk-based distinction into repeatable workflows. Questionnaires, routing rules and reviewer guidance must be designed to identify whether an activity is investment-related, whether it involves firm customers and whether it could reasonably be viewed as part of the firm’s business.
Do Not Overlook the Rule 3290 and Form U4 Disconnect
Rule 3290 narrows the activities subject to FINRA’s outside-activity notice and assessment framework, but it does not amend Form U4.
Form U4 is used by FINRA, other self-regulatory organizations and jurisdictions to collect employment history, disciplinary information and other information used to register securities professionals. Item 13 asks whether an individual is engaged in another business as a proprietor, partner, officer, director, employee, trustee, agent or otherwise.
This creates a significant operational distinction. A registered person’s low-risk, non-investment-related work may fall outside Rule 3290 while remaining reportable on Form U4. For example, driving for a ride sharing service may no longer require approval or supervision under Rule 3290, but it may still need to be collected by the firm to support the individual’s Form U4 reporting obligations.
The Form U4 is a separate reporting requirement. Because it is a Uniform Form used by multiple regulators and jurisdictions, any future harmonization would involve a broader regulatory process. Firms should therefore avoid dismantling their existing OBA intake processes while the current Form U4 framework remains in place.
A practical response may be to separate collection for registration reporting from review and supervision under Rule 3290. Firms can continue capturing information needed for Form U4 while applying different review paths based on whether an activity falls within the new rule. This approach can help prevent an effort to streamline OBA oversight from creating gaps elsewhere in the registration process.
Reconfigure Intake and Risk Assessment
Under Rule 3290, broker-dealers must be able to differentiate among non-investment-related activities, investment-related outside activities and outside securities transactions. That distinction should be made through structured questions and documented decision criteria, not through informal interpretations by individual reviewers.
Compliance teams should evaluate whether their questionnaires capture the information necessary to determine:
- Whether the proposed activity is investment-related
- Whether it involves a customer of the associated person
- Whether it could interfere with or compromise the person’s responsibilities to the firm or its customers
- Whether customers could view the activity as part of the firm’s business
- Whether the activity involves a securities transaction
- Whether selling compensation will be received
- Whether the activity should be permitted, prohibited or permitted subject to conditions
These assessment considerations are described in the SEC’s Rule 3290 approval order.
Firms with a single, generalized OBA questionnaire may need to introduce branching logic that routes disclosures to the appropriate review path. Annual certifications and event-driven amendment processes should also be evaluated so registered persons understand what must be disclosed, when an updated notice is required and how Form U4 obligations differ from Rule 3290 supervision.
Strengthen the Oversight of Conditional Approvals
Rule 3290 expressly addresses an area that is often difficult to manage through email and spreadsheets: activities permitted subject to conditions or limitations.
When a firm permits an outside activity subject to conditions, it must reasonably supervise the associated person’s compliance with those conditions. The clarification was introduced through Amendment No. 1 and is reflected in the final SEC approval order.
Conditions may include restrictions on solicitation, communications, working hours, compensation arrangements or interactions with firm customers. The initial approval is only the beginning of the supervisory process. Firms must also be able to show what conditions were imposed, who is responsible for monitoring them, how compliance is tested and what happens when an exception is identified.
Conditional approvals should therefore be recorded as distinct, supervisable requirements rather than stored only in reviewer notes or email correspondence. Firms should consider assigning each condition an owner, review frequency, supporting documentation requirement and escalation path. Periodic attestations can then be used to confirm whether the activity and its conditions remain current.
Revisit Treatment of Unaffiliated Investment Advisers
Rule 3290 also changes the treatment of certain advisory activity conducted through unaffiliated registered investment advisers.
Under the new framework, activity performed for an unaffiliated SEC- or state-registered investment adviser is treated as an outside activity rather than an outside securities transaction. The broker-dealer must receive notice and conduct the required assessment, but Rule 3290 does not require the broker-dealer to supervise or maintain records of the advisory activity itself.
For dual registrants and hybrid firms, this change may reduce overlapping supervision. It also makes accurate classification essential. Firms should review procedures governing unaffiliated RIA relationships, verify that intake captures the adviser’s registration status and document why the activity was assigned to the applicable review category.
Broker-dealers may still impose requirements that are more restrictive than Rule 3290. Any decision to do so should be reflected consistently in written supervisory procedures, disclosure forms and system workflows.
Account for the Rule’s Exclusions
Rule 3290 excludes several categories of activity from its reporting requirements, including specified activities conducted on behalf of affiliates, personal investments in non-securities and certain personal real estate transactions. The specific exclusions and qualifying conditions are detailed in the SEC approval order.
These exclusions may reduce unnecessary submissions, particularly for larger financial institutions with affiliated insurance agencies, banks or investment advisers. However, firms should not treat an exclusion as a reason to remove controls without analysis.
Implementation procedures should define how reviewers confirm that an activity qualifies for an exclusion and what documentation supports that conclusion. Firms should also evaluate whether another regulatory requirement, internal policy or Form U4 obligation continues to apply even when Rule 3290 does not.
A Rule 3290 Readiness Checklist
Before the rule becomes effective, broker-dealers should consider the following actions:
- Map current processes to Rule 3290. Identify every questionnaire, certification, approval path, supervisory procedure, training course and recordkeeping process that references Rules 3270 or 3280.
- Preserve Form U4 data collection. Avoid eliminating the collection of non-investment-related activities until the firm has separately evaluated its Form U4 obligations.
- Redesign disclosure questionnaires. Add structured questions that support activity classification, customer risk analysis and compensation determinations.
- Establish differentiated workflows. Route non-investment-related activities, outside activities and outside securities transactions according to their distinct regulatory treatment.
- Document risk assessments. Require reviewers to record the basis for permitting, prohibiting or conditionally approving an activity.
- Operationalize conditional supervision. Track each restriction as a separate obligation with an owner, review schedule, evidence requirement and escalation process.
- Review unaffiliated RIA procedures. Update policies and workflows to reflect the treatment of qualifying advisory activity as an outside activity.
- Update attestations and training. Explain the difference between Rule 3290 disclosure and supervision requirements and continuing Form U4 reporting responsibilities.
- Test reporting and audit trails. Confirm that the firm can produce evidence showing what was disclosed, how it was assessed, who approved it and how ongoing conditions were monitored.
- Monitor implementation guidance. Follow FINRA’s Rule 3290 filing page for the effective date and any subsequent implementation information.
Turning the Rule Change into a More Defensible Process
Rule 3290 gives broker-dealers an opportunity to reduce low-value review activity, but the transition should not be approached as a simple reduction in the number of disclosures collected. The more consequential work involves creating a process that consistently classifies activities, directs scrutiny toward higher-risk conduct and produces clear evidence of the firm’s decisions and ongoing supervision.
RegEd’s Outside Activities solution has extensive capabilities to support centralized management of disclosures, attestations and amendments, along with configurable questionnaires and review workflows. RegEd’s current materials also describe integration with the FINRA API Platform to receive Form U4 information and support amendments to Sections 12 and 13 through the OBA Filing Manager.
As firms prepare for Rule 3290, configurable technology can help them preserve necessary Form U4 processes while adapting intake, assessment and supervision to a more risk-focused regulatory framework. The objective is not simply to collect less information. It is to apply the right controls to the right activities and retain a defensible record of how those controls were carried out.
Please note: This article is provided for informational purposes and does not constitute legal advice. Firms should consult qualified counsel regarding the application of Rule 3290 and Form U4 requirements to their specific operations.
About RegEd
RegEd is the market-leading provider of RegTech enterprise solutions with relationships with more than 200 enterprise clients, including 80% of the top 25 financial services firms.
Established in 2000 by former regulators, the company is recognized for continuous regulatory technology innovation with solutions hallmarked by workflow-directed processes, data integration, regulatory intelligence, automated validations, business process automation and compliance dashboards. The aggregate drives the highest levels of operational efficiency and enables our clients to cost-effectively comply with regulations and continuously mitigate risk.
Trusted by the nation’s top financial services firms, RegEd’s proven, holistic approach to RegTech meets firms where they are on the compliance and risk management continuum, scaling as their needs evolve and amplifying the value proposition delivered to clients. For more information, please visit www.reged.com.