FINRA sets 2027 start for rule covering outside crypto work

FINRA has set October 25, 2027, as the effective date for a new outside-activities rule that expressly places crypto-asset development, promotion and market intermediation inside its investment-related framework. The implementation date, announced in FINRA’s October 26 Regulatory Notice 26-20, gives broker-dealers and their personnel a defined transition point after the Securities and Exchange Commission approved the rule on September 15.

The change matters because it replaces two longstanding rulebooks with a single risk-based structure. It does not decide whether any particular token is a security, regulate ordinary crypto holders or bring all digital-asset work under broker-dealer supervision. Its focus is narrower: activities conducted by people associated with FINRA member firms outside the scope of their work for those firms.

Crypto work enters the covered category

Rule 3290 will replace FINRA Rules 3270 and 3280, which separately govern outside business activities and private securities transactions. The SEC’s approval order says the new definition of “investment-related activity” covers financial assets including securities, crypto assets, commodities, derivatives, currency, banking, real estate and insurance.

FINRA told the SEC that the definition also reaches crypto-asset development, promotion or market intermediation. Money transmission, lending and financial planning are covered when they pertain to financial assets, while consulting, marketing, accounting, legal and tax services can fall within the rule when performed alongside an investment-related activity.

For a registered person’s covered outside activity, prior written notice to the member firm is the basic requirement. The firm must assess whether the activity involves an outside securities transaction or one of the person’s customers, compromises responsibilities to the firm or its customers, or could appear to the public to be part of the firm’s business. The firm may condition, limit or prohibit the activity and must supervise compliance with any conditions it imposes.

Outside securities transactions receive stricter treatment. An associated person must provide prior written notice, including the proposed role and whether selling compensation is involved. Transactions involving selling compensation require the member’s prior written approval; approved activity then carries supervision and recordkeeping obligations.

Personal holdings remain outside the rule

The crypto language is broad, but the exclusions are material. The adopted rule excludes personal investments in non-securities. A broker’s own purchase of an asset treated as a non-security is therefore not swept in merely because the asset is crypto. Activity performed for the member firm or an affiliate is also excluded from Rule 3290 because it remains within the firm relationship and is already subject to other supervisory obligations.

Work for an unaffiliated registered investment adviser is treated as an outside activity rather than an outside securities transaction. That removes the automatic transaction-level supervision associated with the older framework, although notice, assessment and any firm-imposed conditions still matter.

What the notice does not settle

The October 26 implementation notice establishes timing; the SEC’s September order establishes the approved substance. Neither record classifies individual crypto assets. The line between a personal non-security investment, outside crypto business activity and an outside securities transaction will still depend on facts including the person’s role, compensation and the asset’s legal status.

Member firms also retain discretion to impose broader reporting or tighter controls than the rule’s minimums, and FINRA may grant case-specific exemptions. Until October 25, 2027, the existing Rules 3270 and 3280 remain the governing FINRA framework; the new date marks a future compliance switch, not an immediate change in obligations.