Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.
Incumbent rails have no public chain settlement and no public code. They are scored with the same rubric as every other row. Their low ratings show the verifiability gap between rails whose behaviour can be inspected and rails whose behaviour must be trusted; that gap is the point of the comparison, not a claim that the incumbent is unsafe.
Offered only in the countries listed. Checked 2026-10-09. Not scored.
Oobit's help centre lists 75 countries and territories. Listed here: the 74 where the Oobit Visa card is marked available, minus the United States. Vietnam is listed but its card is on a waitlist. The help centre marks the US card as available in "most states" (not named), but both Rain card terms on oobit.com require attesting that you are not a US citizen and say the card is "intended for those outside of the United States". No US card terms were found, so the more restrictive reading is used and the US is left out. Puerto Rico is kept as listed, though the card terms may count it as part of the United States. Hungary is absent, so EU and EEA are not used. Brazil has two programmes: a local card issued by Pomelo for new customers and the Rain-issued US-dollar card for earlier ones. Not supported, per the same article: Afghanistan, Belarus, Central African Republic, China, Cuba, Ethiopia, Hong Kong, Iran, Iraq, Lebanon, Libya, Mali, Myanmar, Nicaragua, North Korea, Russia, Somalia, South Sudan, Sudan, Syria, Venezuela, Yemen. The Terms of Use also exclude Russia, Cuba, Iran, North Korea, Sudan, Syria and other embargoed countries.
Oobit's help article lists 75 countries and territories with whether the Oobit Visa card, transfers, sending and cashback are available in each, plus a not-supported list.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
Settlement token
What the balance is held in and debited from. Shown as context; it does not change any rating.
Token
Class
Issuer
Contract
USDT
fiat-backed stablecoin
Tether
USDC
fiat-backed stablecoin
Circle
USDR
fiat-backed stablecoin
StablR
EURR
fiat-backed stablecoin
StablR
BTC
native token
ETH
native token
SOL
native token
BNB
native token
TRX
native token
XRP
native token
TON
native token
DOGE
native token
LTC
native token
BCH
native token
XLM
native token
ADA
native token
XTZ
native token
VET
native token
XAUT
other token
TRUMP
other token
SHIB
other token
Conversion. The token is sold for fiat when a payment is authorised.
Fiat-backed stablecoin. An issuer holds the reserves and can freeze balances at the token contract. Value depends on the issuer redeeming at par. Censorship Resistance records whether that freeze power is disclosed.
Native token. No issuer can freeze it, but its price moves between top-up, authorisation and settlement, so the amount debited is not known in advance.
Other token. A wrapped, liquid-staking or yield token. It carries the risks of the underlying asset plus those of the wrapper or protocol; see the note.
Oobit lists 21 assets for payments; the token is sold for USD (Oobit's base currency) at the time of each card payment. Payments come either from the user's in-app balance, which the Terms of Use say Oobit holds on a custodial basis, or via DePay from an external self-custody wallet on Ethereum, BNB Smart Chain, Solana or Polygon, where the token moves to Oobit's settlement layer at payment time. No default token is stated, although Oobit markets USDT spending prominently. USDR and EURR are StablR's dollar and euro stablecoins; XAUT is Tether's gold-backed token and TRUMP and SHIB are meme tokens (class other). Chains and contract addresses per token are not published, and the Card Terms' Supported Blockchains (Ethereum, Polygon, Optimism, Arbitrum) differ from the DePay list (see C5).
Checked 2026-10-12
Evidence (3)3 documented
Documented
The FAQ lists the assets Oobit supports for payments and transfers.
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Censorship Resistance
Who can block valid use, and can users route around them?
0 FailsPillar rating: weakest of 5 0 of 5 Partial or better
What would raise this pillar
Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Oobit and the issuer can block transactions and suspend an individual account. No notice period or appeal is stated. No settlement contract was found to assess. Judgment call: anchor 0 ("can target individual addresses with no notice"), applied to account-level suspension as for HesabPay.
Evidence (1)1 documented
Documented
Card Terms s4 let Oobit and the Issuer block transactions and suspend account access; the terms may also be changed "with or without notice".
Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer? C2
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Every payment settles into Oobit's own settlement layer and reaches the merchant through Visa and the issuer. Nothing describes a path that bypasses Oobit.
Evidence (1)1 documented
Documented
The FAQ says a DePay payment moves crypto from the user's wallet to Oobit's settlement layer, and Oobit then pays the merchant over Visa.
Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Sanctions and geography screening, plus blockchain-analytics monitoring, is disclosed in the terms and on the product pages, but not in code. The settlement layer cannot be inspected. Disclosed in docs only, so 1.
Evidence (1)1 documented
Documented
Card Terms require OFAC eligibility; Terms of Use exclude residents of embargoed countries; the DePay page says payments are monitored with blockchain intelligence.
Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Tokens and chains are enumerated in docs only, and the two lists disagree. Freeze powers of USDT and USDC issuers are not stated. 1.
Evidence (1)1 documented
Documented
The FAQ lists DePay networks (Ethereum, BNB Smart Chain, Solana, Polygon) and over 20 supported assets; the Card Terms list Ethereum, Polygon, Optimism and Arbitrum as Supported Blockchains. Neither states issuer freeze powers.
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Nothing needed to run the product is public. The partner SDK is published to npm with an MIT tag, but it is a client shell around Oobit's hosted widget and its source repo is private. 0.
Evidence (1)1 verified
Verified
The only public repo in the oobit-tech org is oobit-plugins (an AI-agent plugin manifest); the npm SDK's declared repo oobit-tech/react-native-SDK returns 404.
Does the flow collect anything beyond addresses, amounts, token, and chain? P2
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
KYC plus profile data (education, job title) goes beyond settlement needs. It is disclosed in the policy, so 1.
Evidence (1)1 documented
Documented
The Privacy Notice lists name, age, passport number, tax ID, addresses, phone, education, job title and source-of-funds data, and special categories for AML checks; the FAQ requires a government photo ID.
Which third parties see a request during a payment, and can they be swapped out? P4
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The KYC, fraud-prevention and blockchain-intelligence vendors in the payment flow are not named anywhere I found. Judgment call: disclosure by category only is closer to "undisclosed third parties" than to named ones, so 0.
Evidence (1)1 documented
Documented
Processors for payment processing, identity verification, fraud prevention and cloud storage are described by category only; Rain and Third National appear only in the Card Terms.
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
? No evidence
Sets the pillar rating
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No checkable evidence settles this yet, so it counts as 0.
Security audits 1
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
Shared component: Rain EVM collateral contracts v2 (Beacon, Collateral, Coordinator, Factory), private best-efforts contest at 6f578d5b9c Contest ran 2-8 December 2024 on b432939a; 6f578d5 is the fix commit. Oobit's card runs on Rain's programme (the Card Terms are Rain Card Terms), but Oobit holds in-app crypto custodially and no Rain collateral contract could be tied to Oobit, so it is not known whether these contracts are used in Oobit's card path. The Rain repo is private.
Compiled from: oobit.com (DePay page, FAQ, Card Terms, Terms of Use; DePay is described as a "smart contract engine" but no audit is linked), docs.oobit.com, github.com/oobit-tech, the Sherlock report repo and Rain's security page (Rain says its reports are shared under NDA and names Sherlock), Hacken's portfolio, and web searches for Oobit and DePay audits. Hacken's April 2023 review of the OBT ERC-20 token is not listed: the token is not in the card payment path. No audit of the DePay spender, the Oobit settlement layer or the app was found. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 11 evidenced, 1 attested, 0 absent, 0 not applicable, 33 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
Group A: operational facts
Fees
Evidenced
Component
Paid by
Amount
Basis
card
payer
1% per card purchase, minimum 0.25 USD (Brazil 1%, no minimum)
Help article 15262354 and Oobit Spend Card Terms (effective 1 August 2025); fees may change on 30 days' notice (card terms s6).
fx
payer
Foreign exchange fee up to 1.5% on non-USD purchases
Oobit Spend Card Terms, Important Disclosures and s6.2; Brazil local card adds IOF tax and FX.
cashout
payer
ATM 2.5%, minimum 0.25 USD, plus any ATM operator charge
Help article 17253225.
cashout
payer
Send Crypto to a bank account varies by currency (Unblock fee and FX margin), shown before sending
Help article 15262354; no figure published.
provider
payer
Swap 0.95% (3% when receiving OOB); crypto withdrawal flat network fee shown before confirming
Help article 15262354.
card
payer
Returned payment fee 29 USD
Oobit Spend Card Terms s6.1(b).
limit
none
Card 1 to 2,000 USD per purchase, 10,000 USD per 24 hours; ATM 250 USD per withdrawal, 3 attempts per 24 hours
Help article 15262360; limits may change.
Deposits by bank transfer carry a conversion partner fee of about 0.65% (minimum 0.50 USD); Pix send 1% and receive 0.3% in Brazil; card purchases of crypto via Transak carry Transak's fees. Network gas for DePay/WalletConnect funding is not described as a user fee. Cashback is a reward, not recorded.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Custody model
Evidenced
Provider-custodial
Card purchases are funded by default from the Oobit balance, which Oobit holds on a custodial basis (Terms of Use s7.19). An optional WalletConnect/DePay mode funds purchases from the user's own wallet under a spending approval, so funds stay there until each purchase; that mode is rolling out gradually and does not change the S1 finding.
Money Services Business registration and state money transmitter licences (as stated by Oobit) US cryptocurrency services
All licences rest on Oobit's own pages; none was confirmed in a register. Not found: any licence held by an Oobit entity (Oobit Technologies UAB is not in ESMA's interim MiCA CASP register or its non-compliant list); an active FDIC-insured institution named Third National (FDIC BankFind search, 2026-10-09); a regulator for Rain. The Banco Central do Brasil open-data API returned errors, so Pomelo was not checked; FinCEN's MSB search is interactive and was not used.
Documented
Card terms naming the issuer; the help centre (article 17324780) says the card is issued by Rain, a Visa Principal Member.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Cash-out options
Evidenced
Where
Method
Partner
Fee
Limits
everywhere offered
card spend
Third National / Rain (issuer), Visa; Pomelo for the Brazil local card
1% (min 0.25 USD); FX up to 1.5%
Virtual card only; 1 to 2,000 USD per purchase, 10,000 USD per 24 hours.
everywhere offered
atm
Third National / Rain (issuer), Visa
2.5% (min 0.25 USD) plus operator charge
Contactless (NFC) ATMs only, via Apple Pay or Google Wallet; 250 USD per withdrawal including operator charge; 3 attempts per 24 hours.
everywhere offered
bank transfer
Unblock
Varies by currency, shown before sending
Payouts in EUR, GBP, USD, BRL, MXN, PHP, TRY, INR, IDR, ARS and NGN; USD only for US residents; 1 to 2 business days.
ALL means every country in the provider file's availability list (73 countries where the Oobit Visa card is marked available). The help centre's country table also marks transfers per country, which is not reflected row by row here. Brazil also has Pix send and receive (partner Avenia, launched 2026-06-23). The SWIFT USD payout announced on 2026-07-15 extends bank payouts to about 200 countries (provider statement).
Recorded as the card-contracting entity. The Terms of Use and Privacy Notice now name Oobit Tecnologia LTDA (Brazil), and the privacy notice says the group is headquartered in Singapore (entity not named); see B11.1.
Documented
Lithuanian Register of Legal Entities open data, registered 2022-05-06.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Security incidents
Unknown
Absence of a found incident is not evidence that none occurred.
The status page incident history holds one 2022 maintenance entry and is not maintained for the card (B3.4); no incident or breach notice found on oobit.com news, the legal pages or the help centre. Searched 2026-10-09.
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Product changes affecting users
Evidenced
2022-05-06: Oobit Technologies UAB registered in Lithuania (company code 306074900). source
2025-08-01: Oobit Spend Card Terms take effect (issuer Third National; 1% transaction fee, FX up to 1.5%). source
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Volume transacted (verified only)
Not verifiable
No listed contracts; the DePay spender and any Rain collateral contracts were not identified (provider file notes), and the custodial balance and card settlement run on Oobit's and the issuer's closed ledgers. Oobit's own volume claims (news, 18 August 2026) are provider-reported and not stored.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Group B: institutional due diligence
Control
State
What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?
Unknown
No ISO 27001 statement found on oobit.com (legal hub, terms, card terms, privacy notice, GDPR page, about; /security returns 404) or in the 82 help articles at support.oobit.com. docs.oobit.com returned a bot challenge and was not read.
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?
Unknown
Same search as B1.1; the privacy notice names "cloud storage" processors by category only.
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?
Unknown
No SOC 2 or ISAE 3402 statement found in the same search.
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?
Unknown
No independent code review report found; CROPS S6 is unknown for this provider.
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?
Unknown
No penetration-test report or attestation found. oobit.com/.well-known/security.txt lists a bug bounty mailbox (bugbounty@oobit.com) and expired on 2026-06-05; no programme terms or scope were found.
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?
Unknown
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?
Unknown implied from the component list
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?
Unknown
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?
Unknown implied from the component list
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?
Unknown
No customer incident-notification commitment found. The GDPR page describes the regulation's 72-hour breach notice as a user right, not as an Oobit commitment; the privacy notice says Oobit cannot guarantee absolute security.
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?
Unknown
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?
Unknown
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?
Evidenced
A status page exists (status.oobit.com, Atlassian Statuspage) but appears unmaintained: its components list Tap Payments, Pay Friends and per-coin deposits and withdrawals, with no card or ATM component, and its incident API returns a single 2022-06-30 maintenance entry. No post-mortems found. source 1 · source 2
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?
Evidenced
Personal accounts sign in with a password or Apple/Google sign-in; revealing card details or the PIN needs Face ID or fingerprint. No second factor for personal login is described. Oobit Business gives every team member a login with two-factor authentication. source 1 · source 2
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?
Unknown
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?
Unknown
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?
Unknown
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?
Unknown
Card number, CVV and PIN are shown in a secure session "for a short time only" (help article 15262452); no app idle-session timeout is stated.
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?
Unknown
The Partner API and Plug & Pay SDK docs (docs.oobit.com) returned a bot challenge and were not read.
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?
Evidenced
For Agent Payments on Oobit Business (beta), each agent authenticates with its own API key (prefix oobit_mcp_), one active key per agent, revocable and replaceable at any time, under a spending policy (defaults 500 USD per transaction and 2,000 USD per day). Partner API authentication not read (docs bot-protected). source 1
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?
Unknown
B5.4 Export controls If an API exports data, does it limit volumes and log exports?
Unknown
The account-deletion article tells users to export their transaction history first; no API export limits or export logging found.
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?
Evidenced
The privacy notice promises reasonable technical, administrative and organisational measures without naming encryption or a data classification. Observed: www.oobit.com still accepts TLS 1.1 (and TLS 1.2), below the partner's TLS 1.2 floor. source 1 · source 2
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?
Unknown
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?
Evidenced
On deletion, personal data is deleted except identity verification records and transaction history, kept for 7 years for AML and financial regulation. The privacy notice gives no periods (retention "for the time necessary"). See CROPS P2 for what is collected. source 1 CROPS P2
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?
Evidenced
The current Privacy Notice is issued by Oobit Tecnologia LTDA (Brazil, CNPJ 61.020.917/0001-42) under the LGPD and GDPR, with processors named by category only and data transferred to a group headquartered in Singapore. The GDPR page says a Data Protection Officer was appointed. No DPIA statement and no controller for non-Brazilian users is named. source 1 · source 2
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?
Attested
The GDPR page says Oobit rewrote its Data Protection Agreement; no DPA is published and no request route is given. source 1
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?
Unknown
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?
Unknown
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?
Unknown
See B6.1 for the observed TLS 1.1 acceptance on www.oobit.com; no hosting or hardening statement found.
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?
Unknown implied from the component list
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?
Unknown implied from the component list
B9.2 CI runs on pull requests Does every pull request trigger automated checks?
Unknown implied from the component list
B9.3 Tests run in CI Do the CI workflows run the test suite?
Unknown implied from the component list
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?
Unknown implied from the component list
B9.5 Versioned releases Are releases tagged with immutable semantic versions?
Unknown implied from the component list
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?
Unknown implied from the component list
B9.7 Changelog Is a changelog maintained with the code?
Unknown implied from the component list
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?
Unknown implied from the component list
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?
Unknown
No architecture documentation found on oobit.com or the help centre; docs.oobit.com (partner integration docs) was bot-protected and not read.
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?
Evidenced
Split across entities. The card terms are with Oobit Technologies UAB (Lithuania, company code 306074900, registered 2022-05-06) and the issuer Third National (Rain programme per the help centre). The Terms of Use link now resolves to the Brazilian terms with Oobit Tecnologia LTDA (CNPJ 61.020.917/0001-42), which also issues the Privacy Notice. US crypto services run through Bakkt Financial Solutions I, LLC. source 1 · source 2 · source 3
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?
Evidenced
Transaction fees (1% on card purchases, 2.5% on ATM, 0.95% to 3% on swaps, transfer fees) fund the service; Oobit describes itself as Tether-backed. No financial statements found. source 1
B11.3 Termination terms What happens to customer funds and data on termination by either side?
Evidenced
Oobit and the issuer may suspend, revoke or cancel the card at any time with or without cause or notice (card terms s9); Oobit may terminate all or part of the Services without prior notice (Terms of Use s14.1). Users may close the account in the app; crypto must be withdrawn first and cashback or rewards cannot be withdrawn. On closure Oobit confirms any balance due and sends it (s14.10). The card is cancelled automatically after 90 days without purchases. source 1 · source 2 · source 3
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?
Evidenced
AI agents can initiate payments: Agent Payments let AI assistants (via MCP) and automated systems pay with scoped Oobit cards under user-set limits. No statement found on automated or AI-based compliance or fraud decisions; the privacy notice lists fraud prevention processors by category only. source 1
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?
Evidenced
For Agent Payments only spending controls are documented (per-agent scoped cards with spending and transaction-count limits that expire, revocable keys, merchant allow and block lists, policy checks before the card network). No monitoring, validation, bias or decommissioning documentation for any AI system found. source 1
Scope of assessment
Components in the payment path
Component
Role
Public
Licence
Operator
Required
Oobit mobile app and DePay wallet connection
wallet
No
proprietary
Oobit
Yes
Oobit backend and settlement layer (DePay engine, gas abstraction)
None found. Absence of public code is itself a finding.
Contracts
None listed.
Assessor notes
Eligibility: no verified contract and no public repository needed to run the product, so type is incumbent. Searched 2026-10-07: GitHub org oobit-tech (only oobit-plugins, an AI-agent plugin manifest with no licence); gh search repos and code "oobit" (unrelated or third-party repos); npm @oobit/react-native-sdk and @oobit/react-web (MIT tag, declared repo oobit-tech/react-native-SDK is 404); docs.oobit.com (Plug & Pay widget and Partner API, testnet token addresses only); oobit.com FAQ, DePay page, Card Terms, Terms of Use and Privacy Notice (no contract addresses). eth.blockscout.com search "oobit" found only the OBT token, copycat OOB tokens and Oobit-tagged EOAs dormant since 2023; no DePay spender contract was identified. DePay mentions a "smart contract engine" and one-time spending approvals (provider claim); if the spender or Rain collateral contracts can be identified, this provider should be re-evaluated as a card. Card Map was used only to find the product.
