Scoutinternal

Updating, Removing, or Unlocking Enterprise Policies

Updating, Removing, or Unlocking Enterprise Policies

Problem

Customers contact support when they need to modify, remove, or unlock an enterprise policy on the BitGo platform. Common scenarios include wanting to increase transaction velocity/spending limits, remove a policy entirely, or encountering the error "Cannot update immutable policy" when trying to edit a policy that has been locked after 48 hours. Customers are often unaware that policies become immutable after 48 hours, that a Video ID verification call with BitGo is required to unlock them, or that pending approvals from other enterprise owners may be blocking their changes.

Diagnostics

  • Identify the Policy ID: Ask the customer for the specific Policy ID they want to change. Confirm the enterprise it belongs to by looking it up in the BitGo admin tool at https://admin.bitgo.com/enterprises/<enterprise_id>/overview.
  • Check policy lock status: Determine whether the policy has been in place for more than 48 hours. If so, it is immutable and requires an unlock via Video ID call before any changes can be made.
  • Check for pending approvals: In the BitGo platform, use the Bell Icon (next to the grid of 9 dots) to see if there are pending activities such as approval requests. A policy cannot be edited or removed if another edit is already pending approval.
  • Verify enterprise ownership structure: Check how many owners exist on the enterprise. If there are multiple owners, any policy creation or modification by one owner requires approval from at least one other owner. If the enterprise has only one owner, no additional approval is required.
  • Confirm Video ID verification status: Check whether the requesting user has completed their initial enterprise video verification. If not, they must complete that step first (via a KYC call) before a policy unlock call can be scheduled.
  • Check if it is a BitGo Enforced Policy: Some policies (Video Identity Verification, Unverified Address, Fiat Liveness Check) are enforced by BitGo and may not be fully removable due to regulatory and security requirements. These can only be customized within certain bounds.

Resolution

Scenario: policy-change-changes-policies#immutable-policy-unlock

Trigger: Customer wants to update or remove a policy that has been locked (immutable) after 48 hours since creation.

Signals: immutable policy, cannot update immutable policy, policy locked, unlock policy, change policy, remove policy, increase limit, update threshold, 48 hours

Steps:

  1. Confirm the Policy ID and the enterprise it belongs to using the admin tool.
  2. Inform the customer that once a policy is created, it gets locked after 48 hours of its creation and becomes immutable.
  3. Explain that to unlock a locked policy, a Video ID-verified user from the enterprise must schedule a video verification call with BitGo.
  4. Provide the customer with the Calendly scheduling link: https://calendly.com/bitgo-client-delivery/videoid
  5. Instruct the customer to have their government-issued photo ID ready for the call.
  6. Ask the customer to reference their support ticket number when scheduling.
  7. Once the Video ID call is completed and the request is verified, unlock the policy for 48 hours.
  8. Inform the customer that the policy is unlocked for 48 hours and they can now make changes (modify thresholds, remove the policy, etc.) through the platform.
  9. Remind the customer that if there are multiple owners on the enterprise, the change will still require approval from at least one other owner.

Notes: The 48-hour unlock window is time-limited. If the customer does not make their changes within 48 hours of the unlock, the policy will become immutable again and another unlock call will be required. If the customer misses their scheduled Calendly meeting, they should reschedule using the same link and reference their ticket number.

"Thank you for meeting with us. As per your request we have unlocked the policy for 48 hours." (ticket #321709)

"Once a policy is created it gets locked after 48 hours of it's creation. If you wish to unlock a locked policy, one of your Video verified user needs to scheduled a call with us to get it unlocked." (ticket #28417)

"Please use the following link to schedule a time to meet with us and verify the request: https://calendly.com/bitgo-client-delivery/videoid Once we have verified the request with you, we will unlock the policy so you/your team can make these changes." (ticket #272874)

Scenario: policy-change-changes-policies#initial-video-verification-required

Trigger: Customer requests a policy unlock but the requesting user has not yet completed the initial enterprise video verification (KYC call) with the BitGo Trust team.

Signals: initial video verification, KYC, not verified, enterprise verification, first-time user, trust team

Steps:

  1. Check in the admin tool whether the requesting user has been video-verified for the enterprise.
  2. If not, inform the customer that before a policy unlock can be processed, they must first complete the Enterprise initial video verification call with the BitGo Trust team.
  3. Provide the KYC scheduling link: https://calendly.com/bitgo-client-delivery/kyc
  4. Once the KYC call is completed and approved, proceed with the policy unlock process by providing the Video ID scheduling link: https://calendly.com/bitgo-client-delivery/videoid
  5. After both calls are completed, unlock the policy for 48 hours.

Notes: This is a two-step process for users who have never been video-verified. The KYC call must be completed and approved before the Video ID policy unlock call can proceed.

"Yes, you may request to unlock the enterprise policy to proceed with the change. However, before we can process this, you will need to complete the Enterprise initial video verification call with our Trust team. Kindly use the following link to schedule the call: https://calendly.com/bitgo-client-delivery/kyc" (ticket #321709)

Scenario: policy-change-changes-policies#pending-approval-blocking-edit

Trigger: Customer reports they cannot remove or edit a policy because the system says "an edit is pending," but they cannot see the pending edit.

Signals: edit is pending, pending edit, cannot remove, cannot delete, pending approval, bell icon, approval queue

Steps:

  1. Instruct the customer to log in to the BitGo platform.
  2. Direct them to click the Bell Icon next to the grid of 9 dots in the top navigation.
  3. This will show pending activities such as needed approvals for changes they are making.
  4. Each individual pending item will present information about who can and needs to provide approvals.
  5. The customer (or another enterprise owner) must approve or reject the pending change before a new edit or removal can be initiated.
  6. If the customer still cannot locate the pending approval, escalate internally and check the enterprise's pending approvals in the admin tool.

Notes: BitGo only allows one in-progress change at a time per policy. The pending change must be resolved (approved or rejected) before another modification can be submitted.

"While logged in to the platform, you can choose the Bell Icon next to the grid of 9 dots. This will show you the pending activities such as need approvals for changes you are making. Choosing each individual one will present information such as those who can/need to provide approvals." (ticket #257156)

Scenario: policy-change-changes-policies#multi-owner-approval-requirement

Trigger: Customer asks whether policy changes require approval from other enterprise owners, or is confused that a policy they created earlier did not require approval but now does.

Signals: approval required, quorum, multiple owners, enterprise owner approval, who can modify, unilateral change

Steps:

  1. Explain that any owner of the enterprise can create or modify policies under the enterprise.
  2. However, if the enterprise has multiple owners, the change will require approval from at least one other owner before it takes effect.
  3. If the enterprise has only one owner, no additional approval is required for policy creation or modification.
  4. Note: when a policy was originally created with only one owner on the enterprise, no approval was needed at that time. If additional owners have since been added, modifications now require their approval.
  5. Direct the customer to navigate to the 9 dots menu → Policies to see all policies with their scope, conditions, and approvals required.
  6. Confirm that when a policy is modified, other owners are notified as the system will seek approval from them.

Notes: This scenario often arises when enterprises have grown from a single owner to multiple owners over time. The approval requirements reflect the current ownership structure, not the structure at the time of original policy creation.

"Any Owner of the enterprise can create/modify policies under the enterprise, however, it will require approval from the other owner of the enterprise. But if the enterprise has only one owner then no approval is required for policy creation/modification." (ticket #28417)

"Yes, if you would wish to unlock the policy the video verified user needs to get on a video call with us for policy unlock. Once unlocked, policy can be modified by the owners of the enterprise and approvals will be required for the same from the other owners." (ticket #28417)

Scenario: policy-change-changes-policies#finding-policies-in-new-ui

Trigger: Customer cannot find where policies are located in the platform, or is looking in the wrong section after a recent UI reorganization.

Signals: cannot find policy, where are policies, policy ID not showing, navigate to policies, 9-dot grid, new policy engine

Steps:

  1. Instruct the customer to navigate to the relevant Enterprise in the BitGo platform.
  2. Click the 9-dot grid icon in the top-right area, then select Policies.
  3. This will show all enterprise policies with their scope, conditions, and required approvals.
  4. Note: BitGo recently changed how policies are organized. For Whitelist Address additions, navigate to the Enterprise or the Wallet Policies tab. For controlling enforcement of how a policy works (e.g., spending limits, velocity limits, Video ID thresholds), use the 9-dot grid → Policies path.
  5. Once the customer locates the relevant Policy ID, they can proceed with the appropriate unlock/modification workflow.

Notes: The policy location differs between whitelist-related policies (Wallet Policies tab) and enforcement policies (9-dot grid → Policies). Customers familiar with the old UI may look in the wrong place.

"You will want to navigate to the Enterprise needing this adjustment. Once there, choose the 9-dot grid and then Policies. You should see it there. We recently changed how our policies are organized. For Whitelist Address additions, you will navigate to the Enterprise similar to your screenshot or the Wallet Policies tab. For Controling enforcement of how a policy works, the 9-dot grid I mention above is now where these Policies are found, added, controlled." (ticket #272542)

Related