Regulatory Notice 26-20

By replacing Rules 3270 and 3280 with a single framework, the notice signals a move toward clearer, more consistent expectations for identifying, approving, supervising and recording outside activities. For compliance teams, the practical burden will be less about learning a wholly new policy objective and more about rebuilding procedures, controls and training around a consolidated rule set. Firms should treat the period before the 25 October 2027 effective date as an implementation window.

Priority actions include mapping current 3270/3280 processes to Rule 3290, updating written supervisory procedures and approval workflows, revising registered-person attestations and disclosure forms, and testing surveillance and recordkeeping controls for outside activities and private securities transactions. Legal, compliance, HR and business supervisors should agree who owns each control and how exceptions are escalated. The main risks are supervisory gaps during transition, inconsistent application across business lines, incomplete disclosure of outside activities, and recordkeeping or approval failures that could attract FINRA scrutiny.

The opportunity is a cleaner, more risk-based operating model: fewer duplicative processes, better data on outside interests, and more effective conflict identification. Firms with large registered-representative populations, wealth and brokerage businesses, or private-placement activity should prioritise readiness assessments now, even though the effective date is not immediate.