Scoutinternal

Wallet and Enterprise Policy Unlock Requests

Wallet and Enterprise Policy Unlock Requests

Problem

Customers contact BitGo Support requesting that locked wallet-level or enterprise-level policies be unlocked so they can modify spending limits, whitelist addresses, update approvers, or make other policy changes. Policies automatically lock 48 hours after initial configuration and cannot be edited until BitGo Support performs an unlock. The unlock process requires identity verification via a recorded video call. Customers on non-institutional (PayGo/Starter) accounts are not eligible for policy unlocks.

Diagnostics

  • Determine account tier: Check whether the customer has an Institutional/Custody account or a PayGo/Starter account. Policy unlocks are only available for Institutional accounts. PayGo and Starter accounts are not eligible.
  • Identify policy type: Confirm whether the customer needs to unlock a Whitelist policy (to add/remove whitelisted addresses on a wallet or enterprise) or an Enforcement policy (spending limits, approval rules, etc.). Ask the customer to navigate to the 9-dot grid menu → Policies and provide the specific Policy ID(s) with the locked symbol.
  • Collect required information: Obtain the Enterprise ID, Wallet ID(s), and/or Policy ID(s) in plain text. Verify that the IDs are valid and match the customer's enterprise. Check for typos (e.g., extra characters appended to the policy ID).
  • Check video verification status: In the admin tool, confirm whether the requesting user is already video-verified for the enterprise. If the requester is not initially verified by BitGo, they must bring a previously verified person to the call who can authorize their identity.
  • Confirm the requester's role: Only enterprise Owners can view policies. Ensure the requester has the appropriate role (Owner/Admin) on the enterprise or wallet.
  • Verify unlock duration requested: Customers typically request 24 or 48 hours. The default is commonly 48 hours, but some customers request shorter windows (e.g., 4 hours, 24 hours, 36 hours). Confirm the desired duration before the call.

Resolution

Scenario: unlock-policy-policies-walletid#institutional-policy-unlock

Trigger: An Institutional/Custody customer requests an unlock of one or more wallet-level or enterprise-level policies to make modifications (spending limits, whitelist, approvers, etc.).

Signals: unlock policy, policy locked, enterprise policy, wallet policy, modify policy, spending limit, whitelist locked, 48 hours, policy ID, video call, Calendly

Steps:

  1. Confirm the customer's account is an Institutional or Custody account (not PayGo or Starter).
  2. Collect the Policy ID(s) and/or Wallet ID(s) and Enterprise ID from the customer in plain text. Validate these in the admin tool.
  3. Send the customer the Calendly video verification scheduling link: https://calendly.com/bitgo-client-delivery/videoid
  4. Instruct the customer to have their government-issued photo ID ready for the meeting and to reference their support ticket number when scheduling.
  5. If the customer is not already video-verified by BitGo, advise them: "If you are not initially verified by BitGo, please bring the person on the call who has already verified and can authorize your identity."
  6. Conduct the recorded video verification call. Verify the requester's identity against their government-issued photo ID. Record the session and upload to the designated Google Drive folder.
  7. After successful verification, unlock the requested policies for the duration agreed upon (commonly 24 or 48 hours). Use the internal BGA tool command (e.g., bga policy setmutablev2 --hours 48 or bga policy setmutablev2 -t 24).
  8. Confirm completion to the customer via email, specifying the unlock duration. Remind them that the policy will automatically re-lock after the specified period.
  9. If the customer later reports that one or more policies were missed or are still locked, verify and unlock the remaining policy IDs without requiring a new video call (if still within the same session/ticket context). If the unlock window has expired and they need more time, a new video verification call is required.

Notes: - Unlock duration varies by customer request. Observed durations in tickets: 4 hours, 24 hours, 36 hours, 48 hours, and in exceptional cases, extended periods (e.g., until a specific future date such as "16 May 2026").

  • Locking and unlocking happens at the individual policy level — not all policies at once. If a customer has 10 policies and requests to unlock 1, the other 9 remain locked.
  • Once unlocked, the customer must make all changes before the unlock window expires. After expiry, the policy locks automatically again.
  • For extended unlock periods beyond the standard 24–48 hours, confirm with the team (e.g., CSM or engineering) that this is permitted before proceeding.

"We have received your request to unlock your wallet policy. For security purposes, we will need to schedule a video conference to verify your Identification. Please use the following link to schedule a time to meet with us and verify the request: https://calendly.com/bitgo-client-delivery/videoid. Please be ready to provide your government issued photo ID during this meeting." "Thank you so much for meeting with us today. We have completed the requested unlock of Enterprise Policy for the next 4 hours." "As per your request policies were initially unlocked for 24 hours. If you wish to get the policies unlocked for extended period of time, that will need a new video ID with us."

Scenario: unlock-policy-policies-walletid#paygo-starter-not-eligible

Trigger: A customer on a PayGo or Starter account requests a policy unlock.

Signals: PayGo, Starter account, policy unlock denied, not eligible, cannot unlock, no institutional account

Steps:

  1. Verify that the customer's account is a PayGo or Starter tier (not Institutional/Custody).
  2. Inform the customer that policy unlocks are not available for their account type. Use language consistent with the standard response: "Our wallet policies will be locked 48 hours after your setup of your first policy, as stated at the top of the page. You cannot make any changes to your policy after that as we do not offer policy unlocks for PayGo customers."
  3. Advise the customer on their available workaround: "If you are trying to transact from your wallet and you are exceeding your policies, you will need to add another admin to your account in order to trigger a pending approval. Then your second admin can approve your send."
  4. If the customer asks how to get an Institutional account, direct them to the appropriate sales or onboarding channel.

Notes: - This applies to both PayGo and Starter account types.

  • The pending approval workaround (adding a second admin) allows transactions that exceed policy limits to be approved without unlocking the policy itself.
  • For customers with a Starter account who see a UI message stating they need to contact support to unlock, clarify that unlock is only available for Institutional accounts.

"Our wallet policies will be locked 48 hours after your setup of your first policy, as stated at the top of the page. You cannot make any changes to your policy after that as we do not offer policy unlocks for PayGo customers." "You need to have an Institutional Account to have our support team unlock wallet policy. Currently your account is a Starter Account. Unlock of policy is not possible for you." "You can add another admin to the wallet which will trigger a pending approval for this 2nd admin to approve, when sending to a non-whitelisted address."

Scenario: unlock-policy-policies-walletid#clarifying-policy-type-and-ids

Trigger: The customer requests a policy unlock but does not provide specific Policy IDs, or it is unclear whether they need a Whitelist unlock or an Enforcement policy unlock.

Signals: no policy ID, unclear request, whitelist vs enforcement, missing information, 9-dot grid, enterprise policies page

Steps:

  1. Ask the customer to clarify whether they need to unlock a Whitelist policy (to add/remove addresses) or an Enforcement policy (to change spending rules, approval conditions, etc.).
  2. If the customer needs a Whitelist unlock, request the Enterprise ID or Wallet ID(s) that need the whitelist unlocked.
  3. If the customer needs an Enforcement policy unlock, instruct them: "Please navigate to the 9-dot grid, go to Policies, and provide the IDs for the Policies you need unlocked. You will see a locked symbol next to those that are locked."
  4. Remind the customer that Policies are only visible to enterprise Owners.
  5. Once the Policy IDs or Wallet IDs are provided in plain text, proceed with the standard video verification and unlock process (Scenario #institutional-policy-unlock).

Notes: - Some customers send screenshots rather than plain text Policy IDs. Always request IDs in plain text to avoid transcription errors.

  • Watch for typos in Policy IDs (e.g., an extra character appended). Validate all IDs in the admin tool before the verification call.

"Are you looking to unlock the Enterprise policy to affect the Whitelist configured or to affect enforcement? If looking to affect enforcement, we would need the Policy ID for the rule to unlock." "I was able to locate the id 7c4d25c3-1e37-45c8-9bf8-59f2fcaca786, seems there was an extra e at the end in the original email so I wasn't able to locate it initially."

Scenario: unlock-policy-policies-walletid#user-not-verified-needs-kyc-first

Trigger: The customer requesting the policy unlock has not yet completed initial video identity verification (KYC) with BitGo.

Signals: not verified, KYC, initial verification, kyc link, first time verification, translator, English required

Steps:

  1. Determine that the requesting user has not been previously video-verified by BitGo.
  2. Send the KYC verification scheduling link: https://calendly.com/bitgo-client-delivery/kyc
  3. Inform the customer: "Once you have been verified, we can then get on a call to unlock the wallet policies."
  4. If the customer indicates they do not speak English, advise: "A translator will be needed during the video call, as the verification process must be completed in English. You may bring someone who can assist you with translation during the call."
  5. After KYC verification is complete, proceed with the standard policy unlock video call using the videoid Calendly link.

Notes: - The KYC link (https://calendly.com/bitgo-client-delivery/kyc) is distinct from the video ID link (https://calendly.com/bitgo-client-delivery/videoid). KYC is for initial identity verification; videoid is for verified users requesting policy actions.

  • If a verified user on the enterprise is available, they can join the call to authorize the unverified requester's identity instead.

"Kindly use the following link to schedule a call to complete your Initial verification: https://calendly.com/bitgo-client-delivery/kyc Once you have been verified, we can then get on a call to unlock the wallet policies." "A translator will be needed during the video call, as the verification process must be completed in English. You may bring someone who can assist you with translation during the call."

Related