SEC approves FINRA's outside-business rewrite and leaves firms the discretion that matters

The Securities and Exchange Commission approved FINRA's long-awaited outside business overhaul on Tuesday, posting a 72-page order that consolidates Rules 3270 and 3280 into a single Rule 3290 and leaves the effective date for FINRA to set later. The order arrived two weeks before an Oct. 1 deadline at the close of a reform campaign that ran nearly a decade, through earlier proposals that stalled without final approval; FINRA had submitted the current version in January.

Two provisions carry the weight for anyone running a hybrid practice: Rule 3290 drops the reporting and supervisory machinery around outside activities FINRA treats as low risk, and it states that a broker-dealer is not obligated to supervise the unaffiliated registered investment advisory firm of a dually registered representative. The SEC's stated reason for the first — that firms relieved of assessing bartending can "dedicate resources to activities presenting higher risk to investors" — doubles as an inventory of where the compliance hours now go.

Rule 3270's old obligation reached any compensated activity, which is how a broker who drove for a car service or refereed weekend games ended up with a disclosure file and a supervisor's assessment; bartending, car-service driving and weekend refereeing now come out of that regime as activities FINRA "views as having lower risk," while everything investment-related stays, and the categories the order names are the ones that touch advisory revenue: crypto assets, fixed annuities, commodities and private placements, each still requiring prior written notice before a rep engages in it, with firms free to impose tighter restrictions than FINRA does.

Outside securities transactions in which a rep may receive compensation keep the heavier treatment: a firm must approve or reject them in writing, review them as though the transaction had been run through the firm, and assess whether an outside activity or outside securities transaction will interfere with or compromise the rep's responsibilities to customers, along with the risk the activity poses to the firm and its customers. The judgment call stays with compliance, which is why the practical reach of Rule 3290 will differ branch by branch. Supervisory capacity is a fixed cost of the brokerage channel, and a firm that stops assessing weekend refereeing can spend those hours on the private-placement reviews that need them.

The dual-registrant question drew industry comment, and the SEC sided with the argument that obligating a broker-dealer to supervise a rep's unaffiliated RIA duplicates work the Commission and the states already do, over state regulators and investor advocates who said removing that layer of scrutiny makes fraud at independent RIAs harder to detect.

For a team deciding where to sit, that carve-out outweighs the deleted paperwork, because a hybrid structure carries supervisory overhead that a standalone RIA avoids and the rule struck one line from that column; as this publication has argued, headline payouts stopped deciding multi-advisor moves and post-search economics and employee-channel support now settle them, which makes compliance a slightly heavier term in the comparison than it was a month ago. The same logic runs the other direction: a brokerage that no longer has to supervise the outside RIA has less reason to build infrastructure around it, so a rep who wants a firm's scrutiny of a private placement or an annuity is likely to have to ask for it by name.

Nothing in the order obliges a brokerage to loosen anything. The rule preserves a member's ability to impose tighter restrictions and leaves intact the firm's own judgment about what interferes with a rep's duties, so departments that spent a decade collecting disclosures on every compensated activity are unlikely to rewrite written supervisory procedures because FINRA shortened a list. When the SEC moved to repeal its pay-to-play restrictions, blanket bans firms adopted to avoid a rule tended to outlive it, and the chief compliance officer who reopens that file is doing so by choice.

Between now and the effective date, the work is paper, and it repays doing properly. Ask for the firm's current outside-activity policy in writing and note its revision date, since branch-level obligations run off the written supervisory procedures, which the order does not change. Before any investment-related activity — a private placement allocation, a crypto holding, a fixed annuity written outside the firm — file the prior written notice and keep the written approval, because the rule requires both and the review standard is the firm's own. Treat the shrunken low-risk list as negotiating material as much as relief: a rep who can point to the SEC's language about dedicating resources to higher-risk activity has a stronger case for a simplified annual attestation than one asking for less paperwork on principle.

FINRA has yet to say when the rule takes effect, and its rulemaking calendar is otherwise occupied — a proposed ten-day pause on suspicious account moves is also in circulation. Until the date lands, the outside-business rule governing most hybrid advisors is the one printed in the firm's own manual, and it is a reasonable thing to request in writing with the revision date attached.