Outside Business Activities (FINRA 3270)

FINRA Rule 3270 requires your registered persons to give your member firm prior written notice before engaging in outside business activities (OBAs), including being employed, serving as an officer/director/partner, acting as an independent contractor, or receiving compensation outside the firm (FINRA Rule 3270). To operationalize it, implement a notice-and-review workflow, document supervisory decisions, and keep evidence that OBAs are disclosed, evaluated, and supervised under your overall supervision program (FINRA Rule 3110).

Key takeaways:

• You need a written OBA notice process that captures roles, compensation, time commitment, and conflicts before the activity starts (FINRA Rule 3270).
• Supervisory follow-through matters: exams focus on how you assess risk, impose conditions, and monitor OBAs over time (FINRA Rule 3110).
• Auditability wins: keep approvals/denials, conditions, attestations, and surveillance evidence tied to each disclosed activity.

Outside business activities create a predictable failure mode: a registered person starts a “side gig” that later intersects with customers, marketing, referral compensation, private securities activity, or misuse of firm resources. FINRA Rule 3270 addresses the earliest control point, requiring prior written notice to the member firm before a registered person takes on certain outside roles or receives outside compensation (FINRA Rule 3270).

For a CCO or GRC lead, the practical problem is not understanding the concept, it’s building a repeatable system that captures OBAs early, routes them to the right reviewers, documents supervisory decisions, and keeps monitoring evidence in a form you can produce fast in an exam. You also need to reconcile 3270 with your broader supervisory obligations under FINRA Rule 3110, because FINRA will evaluate whether your controls work in practice, not whether a policy exists (FINRA Rule 3110).

This requirement page gives you requirement-level implementation guidance: who must comply, how to define what must be disclosed, how to design the intake and review workflow, what artifacts to retain, and where exams commonly find gaps. The goal is simple: no undisclosed OBAs, consistent supervisory dispositions, and clean evidence.

Requirement summary (plain-English)

The outside business activities (FINRA 3270) requirement is: a registered person cannot engage in certain outside roles or accept outside compensation tied to an outside business activity unless they provide prior written notice to the member firm (FINRA Rule 3270).

Operationally, your firm must:

1. collect OBA notices before the activity begins,
2. review and document the firm’s supervisory response, and
3. supervise the activity as needed under your supervision program (FINRA Rule 3110).

Regulatory text

FINRA’s rule text states: “No registered person may be an employee, independent contractor, sole proprietor, officer, director or partner of another person, or be compensated from any other person from outside business activity, unless prior written notice is provided to the member.” (FINRA Rule 3270)

What the operator must do with that text:

• Treat “prior written notice” as a gating control. Your process should make it difficult for a registered person to start an OBA without disclosure and review (FINRA Rule 3270).
• Define covered scenarios in your procedures using the rule’s role/compensation triggers (employee, independent contractor, sole proprietor, officer, director, partner, or compensated) so staff can self-identify what must be disclosed (FINRA Rule 3270).
• Connect OBA review to supervision. The exam question will not stop at “did they disclose.” It becomes “how did you supervise the risk once you knew” (FINRA Rule 3110).

Who it applies to (entity and operational context)

In-scope people

• Registered persons associated with the member firm who may take on outside roles or compensation arrangements (FINRA Rule 3270).

In-scope activities (what triggers notice)

Use the rule’s triggers as your baseline. Notice is required if the registered person is:

• an employee of another person/entity,
• an independent contractor,
• a sole proprietor,
• an officer, director, or partner, or
• otherwise compensated by another person/entity in connection with an outside business activity (FINRA Rule 3270).

Where it shows up operationally

• Recruiting and onboarding (new hires with pre-existing businesses/boards).
• Annual compliance questionnaires and periodic attestations.
• Changes in personal circumstances (new consulting, real estate work, board seats).
• Marketing and social media (promotion of an outside venture using professional identity).
• Use of firm devices/email for an outside venture (often discovered after the fact).

What you actually need to do (step-by-step)

Step 1: Write an OBA standard that is usable

Create a written procedure that:

• lists disclosure triggers using the rule’s language (FINRA Rule 3270),
• requires prior written notice,
• describes who reviews and approves/denies,
• sets documentation standards and monitoring expectations under your supervision program (FINRA Rule 3110).

Keep it short enough that supervisors can follow it, and specific enough that staff can’t rationalize “this doesn’t count.”

Step 2: Build an intake mechanism that captures decision-grade facts

Your OBA notice form (or system workflow) should collect:

• activity name and legal entity (if applicable),
• registered person’s role/title (employee, officer, director, etc.) (FINRA Rule 3270),
• compensation type (salary, commission, referral fees, equity, crypto, revenue share, “paid in-kind”) (FINRA Rule 3270),
• time commitment and working hours,
• whether any firm customers/prospects are involved or targeted,
• whether the activity touches securities, investments, or referrals (flag for escalated review),
• whether firm resources will be used (email, devices, office space),
• start date (to validate “prior” notice) (FINRA Rule 3270),
• supervisory contact and business-unit acknowledgment (if relevant).

Design tip: require the submitter to attach supporting documents when available (offer letter, consulting agreement, board appointment letter). If they do not have documents, capture a written description and require follow-up when documents are executed.

Step 3: Route to structured review and record the disposition

A workable triage model:

• Compliance review for rule applicability, conflicts, and required conditions (FINRA Rule 3270).
• Business supervisor review for time/attention risk, reputation risk, and client impact (FINRA Rule 3110).
• Escalation to legal/senior management when the activity creates higher conflicts (for example, outside compensation tied to referrals, fundraising, or investment-related marketing).

Document one of three dispositions:

1. Approved
2. Approved with conditions
3. Denied

Conditions should be specific and testable, such as restrictions on customer solicitation, restrictions on use of firm name/materials, required disclosures, heightened supervision, or periodic re-attestation. Tie conditions to the supervisory program and who will monitor them (FINRA Rule 3110).

Step 4: Integrate OBAs into ongoing supervision (not “approve and forget”)

Operationalize monitoring in ways you can evidence:

• Require periodic re-attestation that the activity and compensation have not changed.
• Trigger re-review on life events: role change, new compensation, new entity, new marketing channel.
• Add targeted supervisory checks where risk is higher, aligned to your supervisory framework (FINRA Rule 3110).

If you have Daydream in your control stack, treat it as the system of record for:

• workflow routing and approvals,
• evidence retention,
• reminders for re-attestation and periodic review,
• exam-ready exports that show each OBA from disclosure through supervision.

Step 5: Train the population and test the control

Training should answer one question: “What must I tell the firm before I do it?” Use the rule’s exact triggers (FINRA Rule 3270).

Testing should be practical:

• compare OBAs disclosed in questionnaires to what shows up in email signatures, public profiles, or marketing materials found during routine supervision (FINRA Rule 3110),
• sample a set of approvals and verify conditions were monitored and documented.

Required evidence and artifacts to retain

Maintain records that show the control exists and operates:

• OBA policy/procedure and training materials (FINRA Rule 3270).
• Completed OBA notices (including submission date proving “prior” notice) (FINRA Rule 3270).
• Review notes, approvals/denials, and condition statements (FINRA Rule 3270).
• Supporting documents (agreements, appointment letters) when available.
• Supervisory monitoring evidence tied to conditions (checklists, reviews, attestations) (FINRA Rule 3110).
• Exception handling: late disclosures, remediation steps, and disciplinary actions if used.

Common exam/audit questions and hangups

Expect examiners to ask:

• “Show me your OBA policy and how registered persons are required to provide prior written notice” (FINRA Rule 3270).
• “How do you ensure OBAs are disclosed before they start?” (FINRA Rule 3270).
• “How do you review OBAs for conflicts and business impact, and who signs off?” (FINRA Rule 3110).
• “What monitoring occurs after approval, and where is it documented?” (FINRA Rule 3110).
• “Show me examples of denials or approvals with conditions, and evidence those conditions were followed.”

Hangups that slow production:

• approvals stored in email with no central log,
• unclear start dates, so “prior” cannot be proven,
• no documented rationale, so decisions look arbitrary.

Frequent implementation mistakes (and how to avoid them)

1. Relying only on annual questionnaires. OBAs can start mid-year. Require event-driven notice and provide an easy intake path (FINRA Rule 3270).
2. Treating “unpaid” as out of scope by default. The rule includes roles, not only compensation. Capture officer/director/partner and contractor roles even when compensation is not obvious (FINRA Rule 3270).
3. Approving without conditions that match the risk. If the activity touches customers or marketing, define restrictions and a monitoring owner (FINRA Rule 3110).
4. No evidence of ongoing supervision. Keep a monitoring cadence and artifacts; otherwise approval becomes a paper exercise (FINRA Rule 3110).
5. Letting supervisors “handle it locally.” Centralize logging and require compliance visibility so you can answer exam requests quickly (FINRA Rule 3110).

Enforcement context and risk implications (practical, non-speculative)

No public enforcement cases were provided in the source catalog for this page, so this section focuses on exam risk. The core exposure is straightforward: undisclosed or poorly supervised outside roles can create conflicts of interest, customer confusion, and supervisory breakdowns. FINRA will evaluate your process under the OBA notice requirement and your broader duty to supervise (FINRA Rule 3270; FINRA Rule 3110).

Practical 30/60/90-day execution plan

First 30 days (stabilize intake and visibility)

• Publish or refresh an OBA procedure aligned to the rule’s triggers and “prior written notice” requirement (FINRA Rule 3270).
• Stand up a single intake channel (form or workflow) and a central OBA log.
• Train supervisors and registered persons on what must be disclosed and how.

Next 60 days (make decisions consistent and monitorable)

• Implement triage criteria and required fields so each notice is reviewable without back-and-forth.
• Standardize disposition templates (approve/approve with conditions/deny) and condition language.
• Start a sampling QA: pick recent OBAs and confirm approvals, conditions, and any monitoring evidence exist (FINRA Rule 3110).

By 90 days (prove operation and close gaps)

• Run a reconciliation: compare disclosed OBAs to public profiles and internal signals found during supervision reviews.
• Remediate late or incomplete disclosures with documented follow-up.
• Prepare an exam-ready evidence pack: policy, training, OBA log, sample files showing end-to-end operation (FINRA Rule 3270; FINRA Rule 3110).

Frequently Asked Questions

Does FINRA Rule 3270 require firm approval of outside business activities?

The rule text provided focuses on prior written notice to the member, not an explicit approval mandate (FINRA Rule 3270). In practice, firms document a supervisory disposition and any conditions as part of their supervision program (FINRA Rule 3110).

What counts as “prior written notice” in an exam?

You need a record showing the registered person submitted notice before starting the activity, and that the firm received it (FINRA Rule 3270). A dated workflow submission or logged form is easier to defend than an informal email thread.

Are unpaid board roles or volunteer positions in scope?

Roles can be in scope even without obvious compensation because the rule includes being an officer or director (FINRA Rule 3270). If you decide certain volunteer roles are not treated as OBAs, document the criteria and keep it consistent.

How do I handle OBAs discovered after the fact?

Treat them as exceptions: collect the notice immediately, document the late discovery, assess risk, and document supervisory conditions or remediation under your supervision framework (FINRA Rule 3110). Keep the exception record with the OBA file to show control operation and follow-up.

How should we monitor approved OBAs?

Tie monitoring to the conditions you imposed and document the checks as supervisory evidence (FINRA Rule 3110). Common approaches include periodic attestations, targeted reviews of communications, and re-review when role or compensation changes.

How can Daydream help without turning this into a tool-first project?

Use Daydream as the workflow and evidence layer: structured intake, routed approvals, a complete OBA register, automated reminders for re-attestation, and an exam export that shows notice, disposition, conditions, and monitoring artifacts in one place (FINRA Rule 3270; FINRA Rule 3110).