FINRA just filed SR-FINRA-2026-001 with the SEC, proposing to consolidate the outside activities framework that's been split across two rules for years. The proposal would delete existing Rules 3270 (Outside Business Activities) and 3280 (Private Securities Transactions) and replace them with new Rule 3290 (Outside Activities Requirements). This isn't just housekeeping — it's a meaningful shift in how firms will supervise rep activities outside the member firm.
What's Actually Changing
The current framework has always been awkward. Rule 3270 covers outside business activities — your rep wants to sell insurance or run a side business. Rule 3280 covers private securities transactions — your rep wants to participate in a friend's startup funding round. Similar risks, different rules, different procedures.
Receive future blog posts by email.
New Rule 3290 consolidates both into a single framework. The focus shifts to activities that present heightened risks for members and the public. That's the operative phrase in the filing: "appropriately within members' purview that potentially present heightened risks."
What does that mean practically? FINRA is trying to right-size the requirements. Not every outside activity carries the same risk profile. A rep coaching little league shouldn't trigger the same supervisory response as a rep raising capital for a private placement.
What This Means for Your Firm
Three operational impacts to plan for:
- WSP consolidation. If you have separate procedures for OBAs and PSTs, you'll need to merge them under the new framework. That's not optional — your procedures need to mirror the rule structure.
- Disclosure forms. Most firms use separate disclosure processes for 3270 and 3280. Expect to redesign those intake forms once the final rule is adopted.
- Supervision calibration. The new rule emphasizes risk-based supervision. You'll need to document how you're assessing which outside activities warrant heightened oversight versus routine acknowledgment.
The Risk-Based Approach
This is where the rubber meets the road. FINRA is signaling that it expects firms to apply judgment — not just check boxes. An activity that looks benign on the disclosure form might carry hidden conflicts. An activity that sounds alarming might actually be low-risk in context.
Your compliance team needs a documented framework for making those calls. When an examiner asks why you approved a particular outside activity, "we followed our procedures" is table stakes. They want to see that you understood the risk and made a reasoned decision.
Timeline and Next Steps
The proposal is now with the SEC for review. Expect a comment period, potential amendments, and an effective date likely 6-12 months after approval. That gives you time to prepare, but don't wait until the final rule drops.
Start now by inventorying your current OBA and PST disclosures. Identify which activities would fall into the "heightened risk" category under the new framework. Build your risk assessment criteria before you're forced to retrofit them under deadline pressure.
The firms that handle this transition smoothly will be the ones that treat it as an opportunity to clean up procedures that have accumulated complexity over years of patchwork compliance. The firms that struggle will be the ones that wait for the final rule and then scramble.
Subscribe to Regulated Intelligence Brief
Get new compliance intelligence delivered to your inbox.
Key Takeaways
When does Rule 3290 become effective?
The rule is still pending SEC approval. Expect a comment period followed by an effective date 6-12 months after final approval. Monitor FINRA's rule filings page for updates.
Do I need to update existing OBA and PST disclosures on file?
Likely yes, but the specifics will depend on the final rule's transition provisions. Plan to re-collect disclosures under the new framework or map existing disclosures to the consolidated requirements.
What qualifies as a 'heightened risk' activity under the new framework?
The filing focuses on activities within members' purview that present risks to firms and the public — think capital-raising, securities-related compensation, or activities creating conflicts of interest. FINRA hasn't published a bright-line list, so firms will need documented criteria for making that determination.
The content in this blog is for informational purposes only and does not constitute legal advice, regulatory guidance, or an offer to sell or solicit securities. GiGCXOs is not a law firm. Compliance program requirements vary based on business model, customer base, and regulatory classification.