FINRA outside crypto work rules start in October 2027

FINRA has set October 25, 2027 as the start date for revised outside-activity requirements that expressly cover crypto-related work by people associated with its member firms. Its October 26 notice gives firms an implementation timetable for Rule 3290, which will replace the existing outside-business and private-securities-transaction rules.

The change is not a new rule for everyone who owns cryptocurrency. It concerns activities undertaken outside a person's relationship with a FINRA member. The Securities and Exchange Commission approved the framework on September 15; the newly published notice establishes when it takes effect, rather than announcing that approval for the first time.

Outside crypto work is expressly covered

The SEC's approval order describes investment-related activity as involving financial assets, with crypto assets specifically included alongside securities, commodities, derivatives, currency and other financial fields. Coverage is therefore not restricted to work involving a security. The list of activities is illustrative, not exhaustive.

That distinction has a concrete crypto application. The order records FINRA's clarification that the definition captures crypto-asset development, promotion and market intermediation. It also covers consulting, marketing, accounting, legal and tax services when performed alongside investment-related activity. These are explanations of the approved framework, not a separate crypto licensing regime announced this week.

For a registered person, an outside investment-related activity that is not connected with a securities transaction requires advance written notice to the member firm. The notice must describe the proposed activity and the person's role in detail. A material change to that activity also requires an update to the written notice.

The firm must examine the activity's classification rather than simply accept the description supplied. Its assessment includes whether the person's customer is involved, whether the work could compromise responsibilities to the firm or its customers, and whether customers or the public could mistake it for the firm's own business.

Notice and approval are different requirements

After reviewing an outside activity, the firm must consider whether to impose conditions, limit participation or prohibit it. If conditions or limits are imposed, the firm must reasonably supervise compliance with them. The SEC order explains that the framework makes this responsibility explicit while retaining the underlying investor-protection approach.

A different route applies to an outside securities transaction. An associated person must provide advance written details of the transaction, their role and whether they will receive selling compensation. Participation for selling compensation requires prior written approval, including approval for material changes. Associated persons include registered persons, but the transaction provision is not confined to them.

For an outside securities transaction without selling compensation, the firm must promptly acknowledge the notice in writing and may set conditions. For one involving selling compensation, it must communicate its decision in writing. An approved transaction in that latter category must be recorded on the firm's books and supervised as though it were conducted on the firm's behalf.

The personal-investment exclusion has limits

The framework excludes personal investments in non-securities. That exclusion is separate from its coverage of outside professional activities involving financial assets. It should not be read as a blanket exemption for all crypto-related work, or as a determination that every crypto asset is a non-security. The rule distinguishes the activity and the applicable transaction category.

The SEC's discussion also stresses that exclusions do not remove a member firm's general supervisory obligations under federal law or FINRA Rule 3110. Firms remain able to impose additional safeguards. They can require reporting beyond the new rule's minimum coverage, restrict activities where appropriate and investigate warning signs of problematic conduct.

The October implementation notice gives firms a future commencement date, not an immediate replacement of the current rules. The September order supplies the detailed basis for the distinction between outside crypto work, securities transactions and excluded personal investments. Those differences matter more than treating every activity involving a token as the same compliance event.

Firms also have a recordkeeping obligation under the approved framework. They must retain evidence of compliance with Rule 3290 in accordance with the time and accessibility requirements of Exchange Act Rule 17a-4(e)(1). This covers the firm's compliance record, separately from the transaction-specific books-and-records requirement for approved outside securities transactions involving selling compensation.

This report summarises official regulatory documents and is not investment or legal advice. SEC information is used under its public-information redistribution policy; no regulatory endorsement is implied.