Outside Business Activities (OBAs) are a recurring employee compliance challenge in the financial services and fintech sectors.
Employees often pursue side projects, board roles, or entrepreneurial ventures outside their primary firm. Certain outside activities require regulatory disclosure because they can create conflicts of interest, interfere with professional responsibilities, or blur the line between personal ventures and firm business.
In September 2026, the SEC approved FINRA Rule 3290, which will replace Rules 3270 and 3280 and narrow the scope of reportable outside activities. The new framework focuses on investment-related activities and outside securities transactions, rather than unrelated side businesses.
FINRA will announce the effective date separately, so firms must continue following existing requirements until the new rule takes effect.
This guide explores the regulatory framework surrounding outside business activities and highlights common pitfalls. It also covers practical steps fintech firms can take to manage OBAs efficiently.
What Are Outside Business Activities?
In financial services, “outside business activities” (OBAs) refer to any work, role, or business venture that an employee undertakes outside their primary firm. In the broker-dealer context, this definition is broad and applies whether or not compensation is involved.
FINRA Rule 3270 broadly covers outside employment, business ventures, and certain compensated activities, including activities unrelated to financial services. However, under the approved Rule 3290 framework, reporting requirements will focus on investment-related activities and outside securities transactions, subject to specific exclusions.
Investment advisers may also have disclosure obligations under SEC rules, including Form ADV Part 2B requirements for certain investment-related and other business activities.
In practice, outside business activities frameworks are designed to prevent conflicts, protect clients, and keep firms from being blindsided by employees’ undisclosed activities.
Why Regulators Care About Outside Business Activities
Regulators don’t view outside business activities as minor side issues. They see them as potential entry points for conflicts, client harm, and reputational damage.
Conflicts of Interest and Client Protection
Regulators focus on OBAs as they can create conflicts of interest that compromise client trust. If an employee is earning money outside the firm, their judgment can be influenced in ways that are not always obvious.
For example, a broker who also sells insurance products might recommend policies that benefit their outside role rather than the client’s best interest. Even when no harm occurs, the perception of divided loyalty can erode confidence in both the firm and its compliance program.
Risks of “Selling Away” and Undisclosed Ventures
Undisclosed outside ventures carry a different risk: the potential for “selling away.” This happens when a registered person solicits or sells securities outside the firm’s supervision.
History shows that many fraud cases, from Ponzi schemes to unapproved private placements, have surfaced through undisclosed OBAs.
Regulators expect firms to identify and stop these activities before clients are harmed. This is why reporting and reviewing OBAs is not a box-checking exercise but a central part of supervisory duties.
Reputational and Operational Impact on Fintech Firms
For fintech firms, the consequences of mishandled OBAs go beyond regulatory fines. Unchecked outside activities can disrupt operations, damage investor confidence, and undermine partnerships.
A founder’s undisclosed side venture or an employee’s crypto project can quickly become a major issue, even if unintended. The reputational fallout often outweighs the initial regulatory penalty, especially for newer companies that are still establishing their credibility.
—
Firms that manage outside business activities effectively reduce both regulatory and reputational exposure. For fintechs looking to build scalable oversight, tools like Regly’s employee compliance platform provide a structured way to track and review OBAs →
FINRA Requirements for Outside Business Activities
Under the existing FINRA framework, registered persons must provide prior written notice of covered outside business activities, while associated persons must report certain private securities transactions. Firms are responsible for reviewing these disclosures and assessing potential conflicts, with additional approval and supervisory requirements for certain securities transactions.
FINRA Rule 3270
Rule 3270 requires registered persons to provide prior written notice before engaging in covered outside business activities. These include outside employment, business ventures, officer or director positions, and certain compensated activities, even when unrelated to financial services.
The rule is broad by design, encompassing roles such as employment, partnerships, officer or director positions, and independent contractor work. Once notified, the company must determine whether the activity could interfere with the individual’s responsibilities or create the impression that the activity is conducted on behalf of the firm.
The rule includes exceptions for certain passive personal investments. However, active involvement in the management or operations of an outside business may trigger disclosure requirements, even when the individual receives no compensation.
FINRA Rule 3280
Rule 3280 addresses private securities transactions conducted outside an associated person's regular relationship with their member firm. These can include soliciting or selling securities away from the firm, commonly referred to as "selling away."
Examples include raising money for a friend’s startup or promoting a private placement. Under Rule 3280, the individual must disclose the planned activity in writing before engaging in it.
If the activity involves any form of compensation, the individual must get the firm’s approval before participation, and the firm is required to then supervise the transaction as though it were conducted within the firm. This includes recording the activity on the company’s books and applying the same supervisory oversight as in-house transactions. For transactions without selling compensation, the firm must provide written acknowledgment of the notice and may impose conditions on participation.
The rule is rooted in the idea that “selling away” creates significant risks for investors and businesses. Undisclosed activity in this area is one of the most common grounds for FINRA enforcement actions.
FINRA Rule 3290
Approved on September 16th, the Rule 3290 introduces several changes to how FINRA-regulated firms review and manage outside activities.
The main changes include:
Narrower reporting requirements: Registered persons generally will no longer need to report non-investment-related outside activities, such as bartending or ride-share driving, under this rule. Investment-related activities involving securities, crypto assets, commodities, banking, insurance, or real estate may still require disclosure, subject to specified exclusions.
Outside securities transactions: Associated persons must continue to provide prior written notice of covered transactions. Transactions involving selling compensation require prior written approval and, if approved, generally remain subject to firm supervision and recordkeeping requirements.
Investment advisory activities: Certain activities performed through unaffiliated investment advisers will be treated as outside activities rather than outside securities transactions, changing the applicable supervisory and recordkeeping requirements.
Firm review and oversight: Firms must assess covered activities for potential conflicts, interference with professional responsibilities, customer involvement, and whether the activities could be viewed as part of the firm's business.
The rule also introduces exclusions for certain personal investments, real estate activities, and activities conducted on behalf of a member firm's affiliates.
These changes allow firms to focus their outside activity reviews on investment-related risks while maintaining oversight of activities covered by the new requirements.
Form U4 Requirements for Registered Individuals
Registered representatives must disclose reportable outside business activities to their firms and provide applicable information on Form U4. The form requires details such as the business name, the individual's role, duties, and time commitment. Amendments generally must be filed within 30 days of changes to previously reported information.
As firms prepare for Rule 3290, they should also review how the new outside activity requirements interact with Form U4 disclosures, since changes to FINRA's rules do not automatically eliminate separate registration disclosure obligations.
SEC Requirements for Outside Business Activities
Unlike FINRA, which imposes prescriptive rules, the SEC follows a disclosure-driven model for outside business activities.
Investment advisors are required to adopt a Code of Ethics under Rule 204A-1 of the Advisers Act, which must include procedures for reporting and addressing conflicts of interest. OBAs fall directly into this framework because they can influence an advisor’s judgment, divert time from client work, or create undisclosed compensation streams.
The primary mechanism for disclosure to customers of an RIA is Form ADV:
Form ADV Part 2A requires firms to disclose other financial industry activities or affiliations.
Form ADV Part 2B requires individual supervised persons to disclose outside business activities if they consume more than 10% of their time or income, or create a conflict of interest.
Learn more about Form ADV Part 2 →
The disclosure obligation frames how the firm demonstrates its fiduciary duty to act in the client’s best interest. If an outside business gives rise to financial incentives that might bias recommendations, the company must clearly explain this to clients and, where possible, adopt policies to mitigate the conflict.
Other Regulators Overseeing Outside Business Activities
Banking regulators, like the OCC and the Federal Reserve, impose restrictions on directors and officers serving on outside boards. For fintechs engaged with crypto, digital asset activities may fall under FINRA or SEC rules if they resemble securities transactions. States also play a role, particularly for state-registered advisors.
Common Compliance Challenges with Outside Business Activities
Managing outside business activities may look simple on paper, but fintech firms often run into recurring problems in practice. The most common issues involve underreporting, unclear definitions, and the practical burden of reviewing and supervising disclosures.
Employees Failing to Disclose Side Projects
The single biggest challenge is non-disclosure. Employees may assume a side gig is too minor to mention or worry that compliance will deny it. This creates risk not only for the employee but for the firm, which is responsible for monitoring OBAs even if it never received notice.
Regulators often uncover undisclosed side businesses during routine exams or through client complaints, and the penalties fall on both the firm and the individual.
Non-disclosure is one of the most frequent breakdowns in employee compliance programs, making it critical to address OBAs alongside other areas such as personal trading and gifts.
Passive vs. Active Involvement
Distinguishing between passive investments and active business roles is another gray area.
Certain passive personal investments may fall outside reporting requirements, while more active business roles may require disclosure. Under Rule 3290, some personal investments and real estate activities are expressly excluded, but other investment-related activities may still be reportable. Firms should assess the nature of the activity rather than relying solely on whether the individual receives compensation or owns the investment personally.
Compliance teams must train employees to recognize when a “personal investment” becomes an outside business.
Crypto, NFTs, and Digital Asset Activities as OBAs
Activities such as token launches, NFT projects, or staking operations may not always be classified as securities, but regulators expect firms to review them as potential OBAs. A registered person’s involvement in a crypto startup or blockchain venture can quickly move into regulated territory. Ignoring these activities exposes firms to unnecessary scrutiny.
Supervising and Documenting Approvals
Even when registered representatives disclose outside activities, firms must assess the potential risks and determine whether restrictions or other conditions are appropriate.
Not every activity requires formal approval or ongoing transaction-level supervision.
However, firms should document their reviews, decisions, and any applicable supervisory responsibilities. Without a consistent process, firms may struggle to demonstrate how they assessed and addressed outside activity risks during examinations.
Learn how Regly’s employee compliance module enables fintechs to centralize the approval process →
Keeping U4 and ADV Forms Up to Date
Maintaining current regulatory filings is a recurring compliance challenge. Registered representatives must report applicable outside business activities on Form U4, with amendments generally required within 30 days of changes to previously reported information.
Learn more about Form U4 →
Investment advisers also have disclosure obligations under Form ADV Part 2, where applicable. Firms should maintain processes that connect internal outside activity disclosures with regulatory filings and account for differences between the applicable reporting requirements.
Although different, outside brokerage accounts raise similar risks when firms don’t have a process to capture employee trading activity. Learn more in our outside brokerage accounts article →
Misconceptions That Lead to Compliance Gaps
Employees and even founders often misunderstand what qualifies as an outside business activity. As these misconceptions create blind spots, addressing them directly is essential to building a stronger compliance program.
“It’s not finance-related, so it doesn’t count”
Under Rule 3270, outside business activities can require disclosure even when unrelated to finance. However, Rule 3290 will generally remove non-investment-related activities, such as bartending or ride-share driving, from FINRA's outside activity reporting requirements.
Until the new rule takes effect, firms should continue following existing requirements. Firms may also maintain broader internal disclosure policies where appropriate.
“If I’m not paid, it’s not an OBA”
Compensation is not the only factor. Certain unpaid board memberships, leadership roles, or investment-related ventures may still require disclosure. Under Rule 3290, the nature of the activity will be particularly important in determining whether it falls within FINRA's reporting requirements.
“My startup isn’t profitable yet, so no disclosure needed”
A startup's profitability does not determine whether disclosure is required. Under Rule 3270, certain outside business roles require disclosure even before a venture generates revenue. Once Rule 3290 takes effect, involvement in an investment-related startup may still be reportable, while unrelated business ventures generally will fall outside the rule's scope.
“Crypto activities are outside the rules”
Digital assets often fall in a gray zone, but regulators expect disclosure. Token projects, NFT launches, or staking ventures can easily overlap with securities laws. Treating them as “unregulated” side projects is risky.
Learn more about tokenized securities →
“Once it’s approved, I don’t have to think about it again”
Approval is not the end of the process. Firms must supervise PSTs, and employees must report changes if the activity evolves. A role that starts as unpaid or minor can become significant over time, requiring new review or disclosure updates.
How Fintech Firms Can Manage Outside Business Activities
Managing outside business activities effectively requires more than collecting forms. Fintech businesses need a structured approach that balances regulatory expectations with the fast-moving nature of startups and innovative financial products.
The main components of effectively managing OBAs include:
Building Clear Policies and Training Employees
Policies should define what counts as an outside business activity and outline how employees should disclose them.
Training is equally important. Employees should understand which outside activities require disclosure, including certain unpaid roles. As Rule 3290 takes effect, firms should update their training to distinguish covered investment-related activities from unrelated outside businesses.
Using Disclosure Forms and Approval Workflows
A standardized disclosure form is the backbone of any OBA process. Employees should provide details about the activity’s nature, time commitment, compensation, and potential overlap with the company's business. An approval workflow, whether manual or software-driven, ensures submissions reach the right decision-makers and responses are documented.
Learn how Regly’s employee compliance can help you with approval workflow →
Risk-Based Review (High-Risk vs. Low-Risk OBAs)
Not all outside activities present the same regulatory risks or reporting obligations.
Under Rule 3290, firms will need to distinguish covered investment-related activities and outside securities transactions from unrelated activities that fall outside the rule's scope.
Activities involving private securities transactions, crypto assets, or investment advisory services may require closer review. A risk-based approach helps compliance teams focus on activities that present greater regulatory and conflict-of-interest risks.
Monitoring Approved OBAs With Conditions
Approval does not end the process. When needed (prohibiting the use of client contacts, restricting work hours, or requiring periodic updates), firms should set conditions and monitor for compliance. Supervisory oversight must be documented so that regulators can see how the firm evaluated and managed the risks over time.
Leveraging Compliance Technology and Automation
Manual processes often break down as a firm scales. Automating OBA intake, review, and recordkeeping reduces the likelihood of missed disclosures or incomplete documentation.
Platforms like Regly give fintechs a way to centralize OBA management, streamline approvals, and maintain an auditable trail for regulators.
Best Practices for Compliance Teams
Even with clear policies, compliance teams need practical routines to manage outside business activities consistently. The following practices help fintech firms mitigate regulatory risks while keeping oversight manageable.
Step-by-Step OBA Review Process
A documented review process is essential. Each OBA disclosure should follow a clear path: employee submission → compliance review → conflict assessment → decision (approve, approve with conditions, or deny). Recording each step creates a defensible audit trail for exams and protects the firm if questions arise later.
To prepare for Rule 3290, firms should review their disclosure forms, approval workflows, and supervisory procedures. This includes identifying which activities require prior notice, which require approval, and what supervision or recordkeeping obligations apply.
Annual Certifications and Attestations
Outside activities change over time, and firms can’t rely on one-time disclosures. Annual certifications give employees an opportunity to confirm their OBA status or update compliance on new commitments. Some firms also require quarterly attestations for higher-risk roles.
Regly’s employee compliance tools help in automating this cycle, making it easier to distribute questionnaires and track responses →
Monitoring for Undisclosed Activities (Public Records, Social Media)
Firms should anticipate that not every OBA will be voluntarily disclosed. Monitoring tools and processes, like scanning public records, LinkedIn profiles, or business registrations, can help identify red flags. A sudden lifestyle change, frequent travel, or unexplained absences may also warrant a closer look.
Firms often apply similar monitoring when supervising outside brokerage accounts, where undisclosed trading can expose the firm to conflicts or compliance gaps.
Documenting Decisions for Exam Readiness
Regulators expect evidence of careful review. Compliance teams should record the rationale behind every approval or denial, noting why the activity was considered low or high risk.
Well-documented files reduce vulnerability during exams and protect the firm in the event of disputes with clients or regulators.
Creating a Culture of Transparency
Employees are more likely to disclose OBAs if they believe the firm will give fair consideration rather than blanket denials. Training sessions, leadership messaging, and case studies all help foster a culture where disclosure is seen as routine and protective, not punitive. This cultural element often determines whether compliance hears about OBAs early or only after a regulator does.
—
Outside investment-related activities and securities transactions remain important compliance concerns for broker-dealers and other regulated fintech firms. Regulators like FINRA and the SEC view them as potential sources of conflict, client harm, and reputational risk.
A strong OBA compliance program combines clear policies, employee training, structured review workflows, and ongoing monitoring. It also requires careful recordkeeping and timely updates to regulatory filings like Form U4 and Form ADV.
When done well, OBA oversight can protect both the company and its employees while reinforcing a culture of transparency.
Ready to Get Started?
Schedule a demo today and find out how Regly can help your business.