NASAA Says FINRA’s Outside Activities Rule Could Leave Investors Exposed

Wealth Management

Jul 2

State securities regulators are urging the Securities and Exchange Commission to tighten FINRA’s proposed overhaul of broker side-business and private-deal rules, warning that the current version could leave gaps in investor protection.

The proposal, known as FINRA Rule 3290, would replace two existing rules: Rule 3270, which governs outside business activities, and Rule 3280, which governs private securities transactions, often called “selling away” or “buying away.” FINRA says the new rule would simplify compliance by focusing broker-dealer attention on investment-related outside activities and reducing unnecessary review of low-risk side jobs.

NASAA agrees with the goal of reducing irrelevant compliance noise. But the state regulator group says the proposal still needs stronger language. Its core concern is that risky side businesses, private funds, lending arrangements, crypto-related activity, informal investment clubs and other alternative investment-style arrangements may not always fit neatly into FINRA’s proposed categories.

That is why this fight matters. It is not a paperwork debate. It is a dispute over where broker-dealer supervision should begin and end when an advisor, registered representative or firm employee is doing financial work away from the firm.

TL;DR

NASAA urged the SEC to require changes to FINRA’s proposed Rule 3290 on outside activities.
FINRA Rule 3290 would replace Rules 3270 and 3280, consolidating outside business activity and private securities transaction requirements into one framework.
FINRA says the proposal would reduce unnecessary compliance burdens by removing low-risk, non-investment side jobs from the reporting process.
NASAA supports streamlining in principle, but says the definition of “investment-related activity” remains too narrow in expression.
NASAA wants the rule to explicitly cover more activity, including collectibles, lending, private funds, informal investment clubs and broader crypto or money-transmission businesses.
NASAA also wants firms to consider risk to all customers, not only the customers of the person submitting the notice.
The most controversial issue is outside investment advisory work at unaffiliated RIAs.
NASAA wants tailored broker-dealer supervision for outside advisory activity, rather than eliminating supervision and recordkeeping obligations.
FINRA later responded to comments by proposing clarifying amendments, including adding “but not limited to” language and expressly adding money services business to the definition.
Main takeaway: the rule fight is about the supervision perimeter. FINRA wants less noise and more focus. NASAA wants to make sure that focus does not create blind spots.

The Rule Boundary Is The Real Story

NASAA urged the SEC to step in on FINRA’s outside activities proposal, arguing that the proposed rule could leave too much room for risky financial side activity to avoid broker-dealer oversight.

The disagreement is easy to misunderstand.

FINRA is not saying side deals should be ignored. NASAA is not saying every weekend job should be treated like a securities transaction. Both sides agree that the existing rules are messy and that firms spend time reviewing low-risk activities that do not matter much to investors.

The fight is over the boundary.

Where does a side job stop being harmless and start becoming an investor-protection risk?

That boundary matters because many investor losses start outside the clean lines of a firm’s approved product shelf. A client may trust an advisor, follow that advisor into a private deal, invest in a loan arrangement, join an informal investment club or buy into an outside opportunity that sounds connected to the advisor’s professional role.

When that happens, the investor may believe the broker-dealer is watching. The firm may later say the activity was outside its business. Regulators then have to ask whether the firm should have known, reviewed, limited or prohibited the activity.

What FINRA Is Trying To Fix

FINRA’s proposal has a practical goal: reduce unnecessary compliance burden.

Under current Rule 3270, registered persons generally must provide prior written notice before engaging in outside business activities. That can include a wide range of side work, even if the activity has little to do with investing.

FINRA has argued that this creates “white noise.”

A registered representative who referees a weekend sports game, drives for a car service or bartends may technically create reporting and review obligations under the current framework. FINRA wants firms to spend less time on activities like those and more time on outside activities that could harm investors.

The Consolidation Goal

FINRA wants Rule 3290 to replace two current rules:

Rule 3270: Outside business activities of registered persons.
Rule 3280: Private securities transactions of associated persons.

Combining the rules could make compliance easier because firms would have one framework for outside activities and outside securities transactions.

That part is not especially controversial.

The harder issue is how much the new rule should narrow the scope of what must be reported, reviewed or supervised.

The Investment-Related Filter

FINRA’s proposed rule focuses on “investment-related activity.”

The definition includes activity pertaining to financial assets such as securities, crypto assets, commodities, derivatives, currency, banking, real estate and insurance. It also includes roles connected to broker-dealers, issuers, insurance companies, investment companies, investment advisers, futures businesses, municipal advisors, banks, credit unions and similar financial entities.

The idea is to focus on activity that looks financial enough to create customer confusion, conflicts of interest or investor harm.

NASAA’s concern is that the rule may still miss activities that are marketed like investments but do not always fit neatly into the listed examples.

NASAA’s First Objection: The Definition Still Needs A Wider Net

NASAA’s comment letter to the SEC said the proposed definition of “investment-related activity” is broad in principle but too narrow in expression.

That phrase captures the heart of the dispute.

NASAA is not saying FINRA ignored financial activity. It is saying the rule should be clearer and broader so risky products do not slip through because they are structured creatively.

The Categories NASAA Wants Covered More Clearly

NASAA pointed to activities such as:

collectibles,
lending,
private funds,
informal investment clubs,
pooled ventures,
broader crypto-asset businesses,
money-transmission or money-services businesses,
alternative investment-style arrangements.

These categories matter because investor harm does not always arrive through a standard stock, bond or mutual fund transaction.

A side opportunity may be pitched as a loan, collectibles investment, crypto venture, real estate deal, private fund, pooled business, promissory note or club arrangement. The label may change, but the investor-protection concern can be the same.

A client trusts the financial professional and invests because that professional appears credible.

Why “Fits Neatly” Is The Danger

NASAA’s worry is that a bad actor can exploit narrow language.

If the rule names certain categories but leaves others ambiguous, a representative may argue that a side arrangement was not clearly reportable. A firm may say it did not have enough notice. A client may be left arguing after the loss that the activity should have been reviewed.

That is the gap NASAA wants the SEC to close.

The Second Objection: Firms Should Look Beyond One Advisor’s Book

NASAA also wants the rule to require firms to assess potential risk to all firm customers, not only the customers of the person who provides notice.

This may sound technical, but it is important.

Under the proposal, firms assess whether the outside activity involves the member’s customers. NASAA worries that limiting the analysis too narrowly could miss risks created by employees who do not have assigned clients but still interact with accounts, systems, documents or operations.

Why Non-Advisor Employees Matter

Not every risk comes from a financial advisor with a client book.

A branch employee, operations person, assistant, administrative staffer or non-registered associated person may still have access to client information or firm systems. That person may also be involved in an outside financial opportunity.

If the firm only asks whether the activity involves that person’s own customers, the answer may be too narrow because the person may not technically have customers.

The better question is whether the activity creates risk to any customer of the firm.

The Client-Confusion Problem

Clients do not always understand legal distinctions between a broker-dealer, an RIA, an affiliate, an outside business and a personal side project.

If the person pitching the opportunity works at the firm, uses firm-like language, communicates through a familiar channel or appears to have authority, a client may assume the firm is involved.

That is why customer-confusion analysis must be broad enough to capture how clients actually experience the relationship.

The Third Objection: Outside Advisory Work Is The Hardest Part

The most sensitive part of the debate is outside investment advisory activity at unaffiliated RIAs.

This is where broker-dealer and RIA regulation overlap.

Many financial professionals operate in hybrid environments. Some are registered representatives of broker-dealers. Some are investment adviser representatives. Some are both. Some work with affiliated RIAs. Some have outside advisory relationships with unaffiliated RIAs.

FINRA’s proposed approach has drawn industry support because broker-dealers often argue that supervising unaffiliated advisory activity is difficult, duplicative and sometimes impractical.

NASAA is not convinced that the answer should be less oversight.

NASAA’s Tailored Supervision Idea

NASAA does not appear to be asking broker-dealers to supervise every detail of every outside RIA activity without limits.

Instead, it wants a tailored approach.

That could include requiring firm approval of outside advisory roles and limiting supervision to areas where the broker-dealer has a clearer interest, such as clients who are also brokerage customers or advisory accounts held at the broker-dealer.

That approach tries to balance two concerns:

broker-dealers should not be forced to supervise information they cannot access or activity they cannot control;
investors should not be left in a regulatory gap when the same financial professional serves them through multiple channels.

Why The Hybrid Model Makes This Difficult

Hybrid wealth management creates complicated client relationships.

A client may have:

a brokerage account at a FINRA member firm,
an advisory account at an outside RIA,
insurance products through an affiliated or outside entity,
private investments through another channel,
financial planning through a separate agreement.

The client may not understand which regulator, firm or account type applies at each moment.

That is why NASAA wants caution before FINRA reduces broker-dealer obligations for outside advisory work.

FINRA’s Case: Less Noise, Better Focus

FINRA’s argument is that the proposal makes compliance more effective by narrowing the rule to investment-related activity.

That is a serious point.

Compliance teams have limited time and resources. If they are reviewing non-investment side jobs, they may have less capacity to examine activities that actually put investors at risk.

A rule that forces firms to review everything can sometimes make supervision worse, not better.

Low-Risk Side Jobs Can Distract Compliance Teams

A weekend bartender job is not the same as selling private placements away from the firm.

A registered person renting a personal vacation home is not the same as running a crypto investment business.

FINRA wants to remove low-risk activities from the rule so firms can focus on the second category.

That is the strongest argument for the proposal.

But The Risk Is Overcorrection

NASAA’s concern is that FINRA may move too far.

If the rule narrows the reporting perimeter too much, firms may miss activities that are not obviously traditional securities transactions but still behave like investment products.

The question is not whether FINRA should reduce noise. It should.

The question is whether the new filter catches enough risk.

The Activities Most Likely To Create Disputes

Some activities are clearly outside the concern. Others are clearly inside it.

The problem is the gray area.

Private Lending Arrangements

A representative may help arrange loans between customers, friends, business contacts or outside entities.

These arrangements may not always look like securities transactions, but they can create major conflicts, repayment risk and customer confusion.

Collectibles And Tangible Assets

Collectibles can be personal hobbies. They can also be marketed as investments.

If a broker is promoting rare coins, art, watches, wine, sports memorabilia or other collectible assets as investment opportunities, the activity may create investor-protection concerns even if the asset is not a traditional security.

Crypto Ventures

Crypto activity can involve personal investment, mining, staking, token promotion, exchange activity, wallet services, money transmission, private placements or pooled ventures.

FINRA wants personal non-security crypto investments excluded from reporting. NASAA wants broader crypto-related business activity clearly covered.

The difference matters.

Informal Investment Clubs

An investment club may sound casual, but it can become risky if a financial professional organizes it, influences investment decisions, pools money or gives clients the impression that the activity has firm backing.

Private Funds And Pooled Ventures

Private funds and pooled ventures can create conflicts, valuation issues, liquidity risk and suitability concerns.

They should not evade review just because the structure is outside the firm’s approved product platform.

Why This Matters For Alternative Investments

The Rule 3290 debate connects directly to the broader supervision concerns aroundalternative investments in wealth management.

Many alternative-investment problems begin with the same basic pattern: a financial professional introduces clients to something that feels exclusive, income-producing or sophisticated, but the product is hard to value, hard to exit or poorly supervised.

That does not make every alternative investment bad.

It means side-channel alternatives need serious oversight.

The Firm Shelf Versus The Side Door

When a product is on a broker-dealer’s approved shelf, the firm can conduct due diligence, set concentration limits, train advisors, review disclosures and supervise recommendations.

When a product comes through a side door, the firm may not have the same controls.

That side-door risk is exactly what outside activity rules are meant to address.

The Client Often Follows The Person, Not The Entity

Clients may not invest because they studied the legal structure.

They invest because they trust the person.

If that person is a registered representative, the client may assume the opportunity has some connection to the firm’s professional standards.

This is why the rule perimeter matters so much.

What FINRA Later Changed After The Comment Fight

The debate did not stop with NASAA’s February letter.

FINRA later responded to SEC comments and proposed amendments to clarify parts of Rule 3290.

Those later changes do not fully adopt NASAA’s approach, but they show that the comment process affected the proposal.

The “But Not Limited To” Change

FINRA proposed adding “but not limited to” language to the definition of investment-related activity.

That matters because it makes the listed examples non-exclusive. In other words, an activity does not have to appear word-for-word in the rule to be covered.

This responds to one of the core concerns about narrow expression.

Money Services Business Added

FINRA also proposed expressly adding “money services business” to the definition.

That is important because money transmission and money-services activity can overlap with crypto, payments, digital assets and financial intermediation.

Adding the term gives firms clearer guidance that those activities may require notice and review.

Supervision Of Conditions And Limitations

FINRA also proposed clarifying that if a firm imposes conditions or limitations on an outside activity or outside securities transaction, the firm must reasonably supervise compliance with those conditions.

That clarification matters because a firm’s conditions are only meaningful if the firm checks whether they are followed.

What The SEC Has To Decide

The SEC’s role is to decide whether FINRA’s proposed rule, as amended or further revised, should be approved.

That decision requires balancing two competing goals.

Goal one: reduce unnecessary burden so firms can focus on meaningful risk.

Goal two: preserve investor protection so risky side activity does not slip through gaps.

The best version of Rule 3290 would do both.

It would stop forcing firms to spend time reviewing low-risk non-investment jobs, but it would clearly require notice, assessment and appropriate supervision for outside financial activity that could harm investors.

The Industry’s Main Argument For A Narrower Rule

Broker-dealers and industry groups generally want less duplication and more practical limits.

Their concern is that the existing framework can force firms to supervise activities that are already regulated elsewhere or that the broker-dealer cannot reasonably monitor.

That concern is strongest in the outside RIA context.

If an advisor works with an unaffiliated RIA, the broker-dealer may not have complete access to advisory client data. Privacy rules, separate systems, separate contracts and different regulators may make supervision difficult.

The Practical Burden Is Real

Firms have to track notices, review outside activities, make approval decisions, impose conditions, monitor compliance, maintain records and respond to exams.

For large firms, the volume can be enormous. For small firms, the cost can be heavy.

A more focused rule can free compliance staff to review higher-risk activity.

The Investor-Protection Burden Is Also Real

But investor harm from outside activity can be severe.

Selling away cases, private deals, promissory notes, crypto ventures and unapproved advisory activity can produce large losses.

That is why NASAA does not want the pendulum to swing too far toward burden reduction.

What Broker-Dealers Should Do Before The Rule Is Final

Broker-dealers should not wait for a final rule to improve their outside activity controls.

The debate itself identifies the risk areas firms should review now.

Rebuild The Outside Activity Inventory

Firms should know what outside activities their registered and associated persons have disclosed.

The inventory should separate:

clearly low-risk non-investment activities,
investment-related outside activity,
outside securities transactions,
outside advisory work,
crypto or money-services activity,
lending arrangements,
private funds or pooled ventures,
real estate investment activity,
collectibles marketed as investments.

A firm cannot supervise what it cannot see.

Test The Gray Areas

The highest-risk cases are often not labeled correctly.

Firms should review whether disclosed activities were misclassified. A representative may call something consulting, education, lending, marketing, coaching or a club when the practical effect is investment-related.

The label should not control the analysis.

Review Customer Overlap

Firms should identify whether outside activity involves firm customers, former customers, prospects, family members of customers or people connected to client relationships.

Customer overlap is one of the strongest risk signals.

Document Conditions Clearly

If a firm approves an outside activity with conditions, those conditions should be specific.

Weak condition: “Do not create confusion.”

Better condition: “Do not solicit firm customers, do not use firm email, do not use firm title, do not refer to the firm in marketing materials and provide quarterly attestations.”

The more specific the condition, the easier it is to supervise.

What Advisors Should Understand

Advisors should not treat outside activity rules as minor paperwork.

A side business can create serious professional risk.

Disclosure Is Not Optional

If the activity is investment-related or could be viewed as connected to financial services, the advisor should disclose it before engaging in it.

Waiting until after money is raised, clients are involved or compensation is received can create major compliance problems.

Approval Is Not A Shield For Everything

Even if a firm acknowledges or approves an activity, the advisor still has responsibilities.

The advisor must follow any conditions, avoid misleading clients, manage conflicts and make sure activity is not misrepresented as firm-approved when it is not.

Client Trust Raises The Standard

If a client invests because they trust the advisor’s professional role, the advisor cannot pretend the side activity is purely personal.

That trust is exactly why regulators care.

What Investors Should Watch For

Investors should be careful when a financial professional introduces an opportunity away from the firm’s normal platform.

That does not automatically mean the opportunity is improper. But it should trigger questions.

Is this approved by your firm?The investor should ask whether the broker-dealer has reviewed or approved the activity.

Will this appear on my firm statement?If the investment will not appear on official statements, the investor should understand why.

Who receives compensation?The investor should ask whether the advisor, advisor’s family, outside company or affiliated entity receives money.

What regulator oversees this?The investor should understand whether the investment is a brokerage product, advisory service, private fund, loan, real estate deal, crypto activity or something else.

Can I lose all my money?Many side investments are illiquid, speculative or hard to value.

Why is this better than approved alternatives?The advisor should be able to explain why the opportunity fits the investor’s needs, not only why it sounds attractive.

Reader Guide: FINRA Rule 3290 And NASAA’s Objections

What Is FINRA Rule 3290? Rule 3290 is FINRA’s proposed replacement for current Rules 3270 and 3280. It would create one framework for outside activities and outside securities transactions.
What Is NASAA Worried About? NASAA is worried that the proposal may leave gaps in oversight for risky side businesses, private deals, lending arrangements, crypto-related activity and outside advisory work.
Why Does FINRA Want The Rule? FINRA wants to simplify compliance and let firms focus on investment-related activity instead of low-risk side jobs that create little investor risk.
What Does “Buying Away” Mean? Buying away generally refers to a financial professional participating in securities transactions outside the normal scope of the broker-dealer relationship.
Why Are Outside Activities Risky? They can create conflicts, client confusion and investor losses if clients believe the opportunity is connected to the broker-dealer or reviewed by the firm when it is not.
What Is The Outside RIA Issue? The question is whether broker-dealers should supervise advisory activity that a registered person conducts through an unaffiliated RIA. Industry groups often see this as duplicative or impractical. NASAA sees investor-protection risk if oversight is removed.
What Did FINRA Later Clarify? FINRA later proposed clarifying changes, including adding “but not limited to” language to the definition of investment-related activity and expressly adding money services business.
What Is The Main Lesson? The main lesson is that regulators are trying to redraw the line between burden reduction and investor protection. The final rule will shape how firms police financial activity away from the firm.

What To Watch As The SEC Reviews The Proposal

Whether The Definition Gets Broader

The biggest issue is whether the final definition of investment-related activity becomes broad enough to capture the gray areas NASAA identified.

How Outside RIA Activity Is Treated

The outside advisory activity issue may be the most difficult part of the rule. The SEC will have to weigh privacy, practical supervision limits and investor-protection concerns.

Whether Firms Must Look At All Customers

NASAA wants firms to consider risk to all customers, not only the customers of the person giving notice. That change would broaden firm review.

How Crypto And Money Services Are Handled

Crypto and money-services businesses can create complicated risks. FINRA’s later amendment moves in NASAA’s direction, but firms will still need facts-and-circumstances analysis.

How Small Firms Implement The Rule

Small broker-dealers may benefit from reduced low-risk reporting, but they may also need clearer systems to identify higher-risk outside activity.

The Bigger Takeaway: This Is A Fight Over Regulatory Blind Spots

FINRA’s Rule 3290 proposal is designed to reduce unnecessary compliance noise.

That goal makes sense. Firms should not have to spend the same energy reviewing weekend bartending that they spend reviewing a private fund, crypto venture or outside lending arrangement.

But NASAA’s warning also makes sense.

Investor harm often grows in the gray area between firm-approved business and personal side activity. If the rule is too narrow, risky financial arrangements can avoid meaningful review. If the rule is too broad, firms waste compliance resources on activity that does not matter.

The best rule has to draw the line carefully.

It should remove low-risk non-investment side jobs from unnecessary review while making sure private deals, side businesses, outside advisory work, lending arrangements, crypto activity and alternative-investment-style opportunities do not disappear into regulatory gaps.

For firms, the message is practical: do not wait for the SEC’s final answer to improve your outside activity controls.

For advisors, the message is simple: disclose before you act.

For investors, the warning is even simpler: when an advisor offers something away from the firm, ask who is supervising it.