Notice on Automatic Risk Control Tightening for High-Risk Scenarios

Dear Cobo Customers,

To further protect institutional accounts and assets, Cobo is updating its risk control procedures for high-risk scenarios, effective from the date of this notice.

1. Changes to Risk Control Procedures
When your organization triggers a high-risk rule:
Before: A member of your organization was required to confirm whether the activity was unauthorized before Cobo tightened the organization’s risk controls.
After: Cobo will tighten the organization’s risk controls directly, without requiring prior confirmation from your organization’s members. These measures will take effect immediately.
Once the risk controls have been tightened, all transactions under the organization will require manual security confirmation. Transactions can proceed only after approval.

2. Manual Security Confirmation and Risk Control Release
2.1. Authorized Reviewers
By default, members with the Admin or Manager role within your organization are authorized to perform security confirmation.
If you would like other designated members to participate in the review process, please configure the relevant approval permissions in advance to avoid delays in transaction processing.
2.2. How to Configure Security Reviewers
Log in to Cobo Portal and follow this path:
Profile icon (top-right corner) → Team → Business Risk Control → Team → Security Confirmation → Edit
2.3. Requesting the Release of Tightened Risk Controls
To release the tightened risk controls and restore your organization’s previous risk control settings, an organization Admin must submit a request via email to [email protected].
Cobo's relevant team will review the request and release the tightened risk controls upon approval.

3. Recommended Configuration Checks
To reduce the risk of triggering tightened risk controls due to configuration errors, please review and verify the following settings in advance:
Whitelist Configuration: Ensure that your IP and address whitelists are accurate, complete, and consistent with your actual business requirements.
Callback Configuration: Ensure that your Callback URL and related settings are correct, that your callback service is operating normally, and that it returns valid responses as expected.
Approval Permissions: If members other than Admins or Managers need to participate in manual security confirmation, please configure the relevant permissions in advance.

4. Configure Transaction Policies Appropriately
Beyond the configurations above, Transaction Policies serve as an independent layer of protection for your assets. Even if issues occur with your API Keys or Callback service, well-configured Transaction Policies can still limit outflows, both per transaction and over short periods. We recommend that you review and refine the following rules under Transaction Policies in Cobo Portal, based on your business needs:
Use “Auto-approve” with caution: Avoid applying Auto-approve to overly broad conditions (e.g., any amount or any address), so that abnormal transactions cannot go through without review.
Set per-transaction limits: Require manual approval for any single transfer above a set amount.
Set time-based transfer limits: Cap the cumulative transfer amount within set time windows (e.g., 1 hour or 24 hours). Transactions that exceed the limit will require approval.
Configure a fallback rule: For transactions that do not match any rule, we recommend requiring approval or setting the action to “Auto-reject”, so that no transaction slips through.
For configuration details, please refer to: Default Transaction Policies

5. Additional Notes
The risk control mechanism described above is triggered by abnormal patterns that Cobo can identify. It is one of several measures that complement your own asset security and cannot cover every risk scenario. Some risks may not be detectable or preventable on Cobo’s side, for example those originating within your own systems where transaction patterns resemble normal business activity.
Completing the checks above helps reduce risk, but it does not guarantee that every abnormal transaction will be blocked. We recommend that you continue managing the security of your API Keys, account permissions, servers, and Transaction Policies, and carry out regular self-reviews. If you notice anything unusual, please contact us immediately.

Thank you for your understanding and continued support.

Cobo Support
October 19, 2026