The Securities and Exchange Commission (SEC) has approved Financial Industry Regulatory Authority (FINRA) Rule 3290, which reclassifies a registered person’s work at an unaffiliated investment adviser as an outside activity rather than an outside securities transaction — retiring a supervision duty that National Association of Securities Dealers (NASD) guidance imposed on broker-dealers in May 1994 — and it did so without naming an effective date.

The approval order, Release No. 34-106381 in File No. SR-FINRA-2026-001, is dated September 15, 2026 and was published at 91 FR 59259 on September 18, 2026. It adopts Rule 3290 in place of Rule 3270 (Outside Business Activities) and Rule 3280 (Private Securities Transactions of an Associated Person). The operative change sits in Rule 3290.03, one piece of supplementary material that moves dual-registrant advisory work out of the supervision-and-recordkeeping regime. This analysis covers what the rule says, how other regimes treat the same facts, and why the missing effective date is the harder problem.

Methodology and sources

This analysis rests on primary documents. The approval order was read in full from the Government Publishing Office text of 91 FR 59259, and every quotation below was checked against it. The procedural history comes from Section I and the two earlier Federal Register items it cites: the notice of filing of February 3, 2026 (Release No. 34-104746, 91 FR 5003) and the order instituting proceedings of May 6, 2026 (Release No. 34-105355, 91 FR 24613). Comment letters come from the SEC public comment file; those from the Public Investors Advocate Bar Association (PIABA) and the Financial Services Institute (FSI) were read in full, while the Commonwealth of Massachusetts letter of February 24, 2026 is a scanned image that could not be read as text. Comparative references were checked on EUR-Lex and the FCA Handbook. Window: January 22 to September 18, 2026.

What Rule 3290 actually says about outside advisory work

Rule 3290.03 is the paragraph that matters. It treats an associated person’s activity at an adviser registered with the Commission under Section 203 of the Investment Advisers Act, or with a state securities commission, as an outside activity rather than an outside securities transaction. The order records the consequence in FINRA’s words: the change would “eliminate members’ supervision and recordkeeping obligations for investment advisory activities performed by associated persons at unaffiliated investment advisers, which were set forth in FINRA guidance issued in the 1990s.” Footnote 56 identifies that guidance as NASD Notice to Members 94-44 of May 1994 and 96-33 of May 1996.

The reclassification matters because the categories carry different consequences. An outside securities transaction runs through Rules 3290(b) and (d): written notice from the associated person, a member assessment against four enumerated factors, and, where selling compensation is involved, a duty under Rule 3290(d)(4) to book the transaction and supervise participation as if executed on behalf of the member. An outside activity runs only through Rules 3290(a) and (c): notice by the registered person, and an assessment by the member. There is no obligation to supervise the advisory activity and none to keep records of it. Dual-hat work has moved from the first column to the second, and the shift was made by definition rather than by amending any supervision duty.

FINRA gave three reasons, all in the order. The 1990s guidance “has caused significant confusion and practical challenges, including privacy challenges to members seeking account information for clients of an unaffiliated investment adviser.” Without that access, members “would unreasonably bear regulatory responsibility and potential liability without adequate means to fulfill their regulatory obligations.” And such advisers “are generally directly regulated by either the Commission or the states, and subject to fiduciary obligation to their clients.” The first two deserve a fair hearing: a broker-dealer cannot compel an unaffiliated adviser’s clients to hand over statements, and supervising a book you cannot see is a liability trap rather than a control.

Rule 3290 also narrows the reporting trigger. Under Rule 3270 a registered person reports outside business activities; under Rule 3290(f)(3) the trigger is outside investment-related activity, covering securities, crypto assets, commodities, derivatives, currency, banking, real estate and insurance. Rule 3290(g) excludes activity for a member or its affiliate, family transactions without selling compensation, personal investments in non-securities, and a main home plus two secondary homes. Rule 3290(h) keeps a safety valve: FINRA may exempt any provision on good cause through the Rule 9600 Series.

How four supervisory regimes treat the same dual-hat fact pattern

Jurisdiction / Regulator	Effective date	Scope	Key requirement	Penalty / sanction
US — FINRA Rule 3290 (approved)	Approved September 15, 2026; not yet set	Associated persons of FINRA members	Rule 3290.03: unaffiliated adviser activity is an outside activity — notice and assessment only, no supervision or recordkeeping	Rule 8310: censure, fine, suspension, bar, expulsion
US — FINRA Rules 3270 / 3280	In force until 3290 commences	Associated persons of FINRA members	Rule 3280(c)(2): an approving member must record the transaction and supervise participation “as if … executed on behalf of the member”	Rule 8310: censure, fine, suspension, bar, expulsion
US states — securities administrators	Continuing; unaffected	Broker-dealers and dual registrants	State cases proceed independently: In re Purshe Kaplan Sterling Investments, Inc., Mass. Docket No. E-2021-0014 (January 4, 2024)	Investor restitution plus required supervisory enhancements
EU — Delegated Regulation (EU) 2017/565	Since January 3, 2018	Investment firms and their “relevant persons”	Article 29(5)(b)–(c): the firm must be “informed promptly of any personal transaction entered into by a relevant person” and keep a record	Directive 2014/65/EU Article 70(6)(f): fines of at least €5 million or up to 10% of annual turnover
UK — FCA Handbook SYSC 10.1	MiFID business, since January 3, 2018	Firms carrying on regulated activities	SYSC 10.1.3R: all appropriate steps to identify and prevent or manage conflicts, including those involving employees and appointed representatives	FCA penalties under DEPP 6, no ceiling, plus prohibition orders

Sources: SEC Release No. 34-106381; FINRA Rule 3280; FINRA Rule 8310; Delegated Regulation (EU) 2017/565; Directive 2014/65/EU; FCA SYSC 10.1. Updated September 20, 2026.

The comparison exposes the shape of the change. Neither the European Union nor the United Kingdom imposes anything resembling the 1994 NASD expectation that a broker-dealer supervise its representative’s separate advisory book; Europe relies on a notification-and-record duty for personal transactions under Article 29 and a conflicts framework under SYSC 10.1. Measured against those regimes the United States was the outlier, and Rule 3290 narrows the gap. The complication is that the narrowing happens in one layer only. State administrators did not sign the order, and the North American Securities Administrators Association (NASAA), through President and Commissioner Marni Rock Gibson, argued on February 24, 2026 that FINRA should tailor rather than eliminate member responsibilities — limiting supervision to advisory clients who are also customers of the member and to accounts the member custodies. The order records the suggestion and does not adopt it.

“A dually registered representative presents a high risk of using the RIA OBA to conduct unregistered broker-dealer activity. FINRA’s proposal unreasonably creates an enormous blind spot in members’ ability to supervise violations – not only of IAA violations but of the Exchange Act’s registration requirements.”

— Michael C. Bixby, President, Public Investors Advocate Bar Association (comment letter to the SEC, February 18, 2026)

Enforcement context: what the Purshe Kaplan file shows

The clearest test of the blind-spot argument is a case the investor bar put before the Commission. In In re Purshe Kaplan Sterling Investments, Inc., Massachusetts Docket No. E-2021-0014 of January 4, 2024, the Commonwealth found the firm lacked written policies to review the advisory transactions of its dually registered advisers during 2017 and 2018 in accounts managed solely by unaffiliated advisers. PIABA quotes the Massachusetts finding that the firm “did not flag for further review any accounts that the Harvest Group DRAs invested in leveraged ETFs for periods of time in excess of days, weeks, months, and even years despite the risks outlined in the prospectuses.” The Secretary of the Commonwealth, in a letter PIABA quotes, said investors “were offered restitution and my office required the firm to enhance its supervisory practices.”

PIABA also cites Purshe Kaplan Sterling Invs., Inc. v. Thomsen, No. 2:24-CV-00002-JNP, 2024 WL 1307268 (D. Utah, March 26, 2024), where a dual registrant ran private funds through an adviser, Foresight Wealth Management, while registered with a broker-dealer. The firm argued the transactions had occurred through the adviser; the court found at *9 that the investment “was not made through the [investor’s] accounts with Foresight.” The point is narrow: a claim that activity happened at the unaffiliated adviser is an assertion, and under Rule 3290.03 the member has little reason to test it. FINRA’s answer is not that the conduct is acceptable but that the tool was wrong — a member that cannot obtain client account data cannot detect leveraged exchange-traded fund concentration inside an adviser’s accounts. Detection now rests with the SEC and the states, which hold access the broker-dealer never had, as in FINRA’s 145-day Rule 2165 hold.

What this means for brokers, advisers, custodians and compliance teams

For broker-dealers, the immediate work is a rewrite, not a relaxation. Rule 3290(d)(1) introduces a four-factor assessment Rule 3280 never contained, covering selling compensation, customer involvement, interference with duties to the member or its customers, and public perception of the activity as part of the member’s business. Supervisory procedures, disclosure forms, attestation cycles and surveillance rules built for Rules 3270 and 3280 key off the old categories. Intake forms must be rebuilt around the Rule 3290(f)(3) definition, and the allocation arrangements Rule 3290.01 permits re-papered.

For dual registrants and their advisers, the notice duty survives even though the supervision duty does not: Rule 3290(a) still requires the registered person to report the activity, and Rule 3290(b)(2) an update where a prior notice becomes materially inaccurate. Advisers should not read the change as removing their own exposure, since FINRA stepped back precisely because these firms are directly regulated and owe fiduciary duties. For custodians and fund managers with dual-registrant distribution, risk shifts to documentation — where the broker-dealer no longer books or supervises the activity, the adviser’s records become the only contemporaneous evidence of what was recommended.

For legal and compliance teams, three tasks are time-sensitive whatever the commencement date. Inventory every control that exists solely because of NASD Notice to Members 94-44 or 96-33 and decide whether to retire it or keep it voluntarily — FINRA confirmed the rule does not limit a member’s ability to widen its assessment or add safeguards. Preserve red-flag escalation, which NASAA asked FINRA to confirm in guidance. And map state exposure, because cases of the Purshe Kaplan type are unaffected by a FINRA rule change.

“As we stated previously, consolidating FINRA Rules 3270 and 3280 into a single outside activities framework will improve consistency, reduce operational inefficiencies, and allow firms to focus compliance resources on activities that present the greatest potential risk to investors.”

— David T. Bellaire, Executive Vice President and General Counsel, Financial Services Institute (comment letter to the SEC, May 27, 2026)

The missing effective date is the harder operational problem

FINRA Rule 3290 was approved without a commencement date, and that is the detail compliance teams will feel first. The American Securities Association, through Chief Legal Officer Jessica Giroux, asked for an effective date at least 12 months after approval so members could update systems designed for Rules 3270 and 3280. FINRA replied that it “would determine an effective date balancing sufficient time for implementation with its objective of reducing unnecessary burdens in a timely manner.” The Commission’s answer, in footnote 240, is one sentence: FINRA “reasonably declined to establish an effective date for the proposed rule change at this time.” The rule is final, the old rules still bind, and the interval between them is FINRA’s to choose.

That asymmetry has a cost. A firm that dismantles its unaffiliated-adviser supervision now applies a rule that has not commenced while Rule 3280 still binds it. A firm that waits may be handed a short runway to rebuild forms, procedures, surveillance logic and training. Carrying both frameworks in parallel is the rational course, the most expensive, and the one the absence of a date imposes. The contrast is visible elsewhere in the 2026 rulebook: the SEC order dropping Inline XBRL from broker-dealer audits removed a requirement cleanly, which is what a dated commencement looks like.

What is next — the forward view

Three things are worth tracking. The first is FINRA’s Regulatory Notice announcing commencement, which will carry the implementation period the order declined to set and may carry the guidance commenters requested on what is a material change to an outside activity, and how far a member may go beyond the minimum assessment without creating an implied supervision duty. The second is the red-flag question. NASAA asked for supplementary material stating that members must weigh red flags from unsupervised advisory activity as part of their core supervisory obligations; the order notes the request without resolving it, leaving the line between “not supervised” and knowingly ignored to be drawn in enforcement.

The third is the state layer. NASAA’s alternative — supervision limited to shared clients and member-custodied accounts — is the most developed template a state administrator might adopt, and the Purshe Kaplan matter shows Massachusetts will act without waiting for FINRA. Multi-state firms should assume divergence rather than harmonisation. Rule 3290(h) and the Rule 9600 Series provide a case-by-case exemptive path, but relief is not an architecture. Related: the CFTC’s Letter 26-25 on software relief, the CFTC’s 4.13(a)(4) exemption for SEC-registered advisers, and the FCA’s decision that acting as principal is a permission, not an entitlement.

FAQ

What exactly did the SEC approve on September 15, 2026?

The Commission approved FINRA’s proposal, as modified by Partial Amendment No. 1, to adopt Rule 3290 (Outside Activities Requirements) and replace Rules 3270 and 3280. The order is Release No. 34-106381 in File No. SR-FINRA-2026-001, published at 91 FR 59259 on September 18, 2026, approved under Exchange Act Section 15A(b)(6) and signed by Sherry R. Haywood, Assistant Secretary, under delegated authority.

When does FINRA Rule 3290 take effect?

No date has been set. A commenter asked for at least 12 months after approval; FINRA said it would determine a date “balancing sufficient time for implementation with its objective of reducing unnecessary burdens in a timely manner,” and the Commission found FINRA reasonably declined to fix one. Commencement is expected in a Regulatory Notice. Until then, Rules 3270 and 3280 remain in force.

Do broker-dealers still have to supervise a representative’s work at an unaffiliated RIA?

Once Rule 3290 commences, no. Rule 3290.03 treats that work as an outside activity, triggering only the notice duty in Rule 3290(a) and the member assessment in Rule 3290(c). FINRA stated the change would eliminate the supervision and recordkeeping obligations set out in 1990s guidance. Until then, the existing expectations under Rules 3270 and 3280 and the related NASD notices continue to apply.

What are the four factors in Rule 3290(d)?

On receiving written notice of an outside securities transaction, a member must assess whether it is for selling compensation, involves a customer of the associated person, will interfere with or compromise the person’s responsibilities to the member or its customers, and will be viewed by customers or the public as part of the member’s business. FINRA acknowledged Rule 3280 requires no such assessment.

Which activities does Rule 3290(g) exclude?

Rule 3290(g) excludes activity conducted for a member or its affiliate, securities transactions among immediate family members for which the associated person receives no selling compensation, personal investments in non-securities, transactions already subject to Rule 3210, and a main home plus up to two secondary homes meeting specified ownership conditions. Rule 3290(h) allows case-by-case exemptions through the Rule 9600 Series.

Who watches the dual-hat adviser now?

The SEC or the relevant state securities commission, depending on where the adviser is registered, together with the fiduciary duty the adviser owes its clients — the rationale FINRA gave. The member firm keeps the notice and assessment duties and may voluntarily apply safeguards beyond the minimum. Investor-side commenters argued this leaves a detection gap; FINRA’s answer is that members never had the data to close it.

This article is informational analysis only and does not constitute legal, regulatory, tax, or investment advice. Regulatory frameworks change frequently and interpretation depends on facts and circumstances; primary documents and official regulator guidance always supersede summaries. Firms should consult qualified legal counsel and their relevant supervisory authority before taking any action based on the analysis above.