How BotOrNot report cards work

The five results

The rules, in order

We check every rule. The most serious level that applies is the result, and the bot page lists the exact facts (with source links) that triggered it.

1. R1 · Red flags: A regulator or prosecutor has alleged or found fraud or misappropriation by the operator (sourced to the official release), within the last 5 years.
2. R2 · Red flags: The bot’s own official domain appears in a regulator scam list (California DFPI Crypto Scam Tracker). Look-alike domains do not count; they are shown as impostor warnings instead.
3. C1 · Closed: The operator has announced a shutdown, or the product is discontinued (sourced).
4. Y1 · Caution: A documented security incident affecting users’ funds or keys within the last 5 years, at the bot or its parent exchange (refunds are noted but still count).
5. Y2 · Caution: A regulator or prosecutor action that is not a fraud allegation (for example licensing or anti-money-laundering violations) against the operator or its parent exchange, within the last 5 years.
6. Y3 · Caution: The bot publicly advertises a performance figure that we could not verify from public data (quoted and linked).
7. L1 · Limited data: If none of the above apply but fewer than two of pricing, markets and custody are verified from a source, the card reads “Limited data” rather than “Clear record”.
8. G1 · Clear record: Otherwise: “Clear record”. That means no record found in the sources we checked, not that the bot is safe or profitable.

What counts as a fact

• A fact must link to a public source: the regulator’s own release or filing, the operator’s own notice, or reputable reporting (labeled when third-party).
• Regulator complaints are allegations until a court rules or the case settles. We say “alleged” or “per the SEC” and link the release.
• Matters involving a parent exchange (for example an exchange-level hack or licensing case) are labeled “exchange operator” so you can tell them apart from problems with the bot product itself.
• The lookback window is 5 years. Older incidents stay on the fact sheet as context but don’t drive the result.
• Impostor scam sites that borrow a bot’s name are shown as warnings on the bot’s page. They don’t count against the real bot unless its own official domain is on a regulator list (rule R2).

What a report card is not

• It is not a rating of performance, profitability or quality, and it is not investment advice.
• “Clear record” means we found nothing in the sources we checked as of the check date. It is not an endorsement.
• We never add a red flag on our own judgment. If you think a fact is wrong or missing, send a correction with a source.

How the money works

Payouts never change a report card. Some outbound links are referral links, labeled right next to the link. A bot or exchange that pays us gets exactly the same rules as one that doesn’t. Full disclosure.

How your money is held

Each card also states the custody model. It is shown for context and does not change the result:

• Self-hosted: you run the software and your keys stay on your machine.
• Connects to your exchange or broker with API keys; funds stay in your account there.
• Your funds sit on the operator’s own platform or exchange.
• The bot creates and controls a wallet for you; it holds the keys.
• Signals or analysis only; it does not hold funds.
• Trades through your account on a regulated exchange via its API.

Changes

When a report card changes, it appears in the changelog and the Atom feed, and people watching that bot are notified. Machine-readable rules: /api/methodology.json.