FINRA Adopts Rule 3290: Broker-Dealers Will No Longer Have to Supervise Representatives’ Work at Unaffiliated Investment Advisers

On October 26, 2026, FINRA announced that new Rule 3290 (Outside Activities Requirements) will replace Rule 3270 on outside business activities and Rule 3280 on private securities transactions, effective October 25, 2027. Outside Activities, FINRA Regulatory Notice 26-20 (Oct. 26, 2026), available at finra.org; Exchange Act Release No. 106381 (Sept. 15, 2026), 91 Fed. Reg. 59259 (Sept. 18, 2026) (SEC approval order). For most firms the new rule will feel familiar: it combines the two existing rules into one and keeps their basic mechanics. The change that matters is narrower and much larger in effect. From the effective date, a broker-dealer will no longer have to supervise, or keep the records of, a registered representative’s advisory business at an unaffiliated investment adviser, meaning one that does not control, is not controlled by, and is not under common control with the broker-dealer. For firms with many hybrid representatives, that removes one of the heaviest supervisory burdens in the independent broker-dealer model.

What stays the same

Rule 3290 carries forward the two-track structure of Rules 3270 and 3280 under new names. An “outside activity” is the old outside business activity: the registered person gives the firm prior written notice, the firm assesses it, and the firm may impose conditions or prohibit it, with no approval required. An “outside securities transaction” is the old private securities transaction: the associated person gives prior written notice, the firm acknowledges it in writing if there is no selling compensation, and if there is selling compensation the firm must approve or disapprove it and, if it approves, record the transaction and supervise it as if it were the firm’s own. The concepts of selling compensation and a single notice for a series of related transactions carry over, and so does the firm’s general duty under Rule 3110 to follow up on red flags of undisclosed activity.

What is different

The headline change is the treatment of work at an unaffiliated investment adviser. Since Notices to Members 94-44 and 96-33 in the 1990s, a registered representative who also advised clients through an unaffiliated adviser and participated in the client trades has generally been treated as engaging in private securities transactions, which meant the broker-dealer had to approve the activity, record the trades on its books, and supervise an advisory business it did not control. Under Rule 3290, activity at an unaffiliated adviser registered with the SEC or a state is an outside activity, not an outside securities transaction. The representative gives notice and the firm assesses it, but the firm no longer has to supervise or keep records of the advisory activity itself, only records showing that it complied with Rule 3290. The firm may still impose conditions, including its own supervision, if it judges the risk warrants it, and if it imposes conditions it must supervise compliance with them. The same outside-activity treatment applies to serving as a portfolio manager or investment committee member for a fund, business development company, REIT, or tax-exempt entity, unless the person is selling the entity’s shares for compensation.

The other changes are smaller. The rule now reaches only “investment-related” activity, a broad term covering securities, crypto assets, commodities, derivatives, banking, real estate, and insurance, so representatives no longer have a rule-based obligation to report unrelated side work, although Form U4 still asks about other business and firms may keep requiring broader reporting. When a firm assesses an activity, it must now also ask whether the activity involves one of the person’s customers. The rule also spells out exclusions that firms have long handled informally, including activity on behalf of the firm or an affiliate, transactions among immediate family members without selling compensation, accounts already covered by Rule 3210, and the person’s main home and up to two secondary homes.

How the prior guidance still applies

Until October 25, 2027, Rules 3270 and 3280 remain the rules, and so does the 1990s guidance on outside advisory activity; a firm that stops supervising a hybrid representative’s advisory business before then does so under the old rules. After the effective date, FINRA states that Notices 94-44 and 96-33 are superseded only as to their treatment of outside advisory activity as private securities transactions. Until FINRA says otherwise, we expect FINRA and firms to continue to rely on the rest of the existing body of interpretation where Rule 3290 uses similar terms, including guidance on what counts as selling compensation, what it means to participate in a transaction, and when a single notice covers a series of related transactions, all concepts the new rule retains. Similarly, the enforcement history under Rule 3280 remains relevant: selling away in private placements for compensation without approval is still a violation under the new rule.

What firms should do before October 25, 2027

Firms should rewrite their written supervisory procedures and disclosure forms around the two Rule 3290 categories and add the customer-involvement question to the assessment. They should inventory every outside business activity and private securities transaction now on file and reclassify each one. For each representative who advises through an unaffiliated adviser, the firm should decide whether to stop supervising that business on the effective date, keep supervising it, or impose specific conditions, and document the reasons; the rule removes the obligation, not the risk, and a firm that walks away from supervision without a reasoned assessment will have a hard time explaining that decision after a customer complaint. Firms should also decide whether to keep requiring reports of non-investment activities, and train representatives on what they must report under the new rule so the change does not become a gap in reporting.