Dutch ASN Bank Blocks Non-Google Android, GrapheneOS Users Hit Hard

Background: A Compatibility Controversy at an "Idealistic" Bank

Dutch bank ASN has reportedly blocked non-Google-certified Android systems, including the privacy-focused GrapheneOS, in its mobile banking app. The news originated from the banking app compatibility report maintained by PrivSec-dev on GitHub and sparked heated discussion on Hacker News, receiving over 300 upvotes and 200+ comments.

ASN Bank has long projected an "idealistic" image, emphasizing sustainability and social responsibility. However, this restriction on non-standard Android systems creates a subtle contrast with that brand image. Users found that the ASN app fails to run properly on systems like GrapheneOS, sparking debate over the tension between the bank's technical strategy and users' freedom of choice.

Technical Limitation or Security Excuse?

According to community feedback, ASN Bank's app appears to rely on the Google Play services framework for integrity verification. Systems like GrapheneOS enhance privacy by removing or replacing Google services, and therefore cannot pass the banking app's device attestation checks.

This approach is not uncommon in the security field. Banks typically need to ensure the runtime environment has not been tampered with, to guard against malware and fraud. But critics point out that this "one-size-fits-all" blocking shuts out privacy-conscious users—precisely the group that may be more security-sensitive. In the Hacker News discussion, some users argued that banks should offer alternative verification methods rather than simply relying on Google's ecosystem.

Google Play Integrity Verification (Play Integrity / SafetyNet)

The mechanism ASN's app relies on is commonly known as the Play Integrity API (formerly SafetyNet Attestation). It is executed on-device by Google Play services and returns a set of verdicts to the app, such as whether the device passes Google's compatibility tests, whether the system has been rooted or the bootloader unlocked, and whether the app binary has been tampered with. Developers use these results to decide whether to allow sensitive operations. The problem is that this verdict system is fundamentally premised on "whether the device runs a Google-certified Android build." Systems like GrapheneOS remove Google Play services for privacy reasons or run them in a sandbox, and thus often cannot produce a trusted attestation token. If a bank treats attestation results as the sole gate, it will inevitably block these systems as well. Conversely, if it adopts alternatives based on hardware keys, behavioral risk controls, or multi-factor authentication, it can maintain security without depending on Google's verdicts.

GrapheneOS and "Non-Google-Certified Android"

GrapheneOS is a privacy- and security-hardened operating system based on the Android Open Source Project (AOSP), primarily running on Google Pixel devices. It retains Android's app sandbox and hardware security module support (such as the Titan M chip), but does not preinstall Google services by default; users can optionally install Play services as a sandboxed regular app. "Non-Google-certified" means the device has not passed Google's Compatibility Test Suite (CTS) certification and therefore cannot obtain a device attestation issued by Google. This does not mean the device is "insecure" or "has been rooted"—it simply means its software stack falls outside Google's certification system. Many bank risk-control systems treat this difference directly as a high-risk signal, which is the technical root of this controversy.

Community Reaction and the Compatibility Report

The PrivSec-dev compatibility report project aims to track support for non-standard Android systems across various banking apps. ASN Bank's case has been included and become a focus of community attention. The report shows that not all banks impose similar restrictions; some financial institutions have achieved compatibility with systems like GrapheneOS through custom verification mechanisms.

This suggests differences in technical choices: banks can support more diverse device environments without sacrificing security. ASN Bank's approach is therefore seen by some users as "lazy" or "overly dependent on Google."

The Significance of the PrivSec-dev Compatibility Report

The banking app compatibility list maintained by PrivSec-dev is essentially a community-crowdsourced "field-test database": volunteers install various banking and payment apps one by one on systems like GrapheneOS and CalyxOS, recording whether they can log in, complete transfers, or trigger integrity check failures. Its value lies in transforming scattered user experiences into comparable public information, giving users a basis for choosing a bank or ROM and exposing financial institutions' technical strategies to public view. That is precisely why ASN's inclusion in the "incompatible" list quickly escalated—it was not just an individual error report, but was placed in a side-by-side comparison with peer institutions, highlighting the divergent approaches different banks take to verification mechanisms.

Impact on Privacy Advocates

For GrapheneOS users, banking app compatibility has always been a pain point. ASN Bank's explicit blocking further highlights the tension between privacy and convenience. Users are forced to choose between giving up their privacy-enhanced system or switching banks.

This incident has also sparked broader discussion: in an era of increasing concentration of digital identity and financial services, is users' control over their device environment being eroded? ASN Bank's case may prompt more users to pay attention to banks' technical policies and push the community to pressure financial institutions for more open compatibility strategies.

What's Next

ASN Bank has not yet made a public response to the matter. The community hopes the bank will reassess its compatibility strategy or at least provide a transparent explanation. As privacy awareness rises, how financial institutions balance security and user choice will remain an ongoing topic of attention.

For the technical community, this incident is another reminder: the ecosystem development of open-source systems and privacy-oriented custom ROMs still needs to overcome compatibility barriers from mainstream services.

One-line Summary

ASN Bank's app blocks non-Google-certified Android systems like GrapheneOS, sparking debate over privacy and security.

Paragraph Summary

The mobile app of Dutch bank ASN has reportedly blocked non-Google-certified Android systems, including the privacy-focused GrapheneOS. The issue, disclosed through the PrivSec-dev compatibility report, sparked heated discussion on Hacker News. The app appears to rely on Google Play services for device integrity verification, causing systems that remove Google services to fail attestation. It is not uncommon for banks to take such measures to prevent tampering and fraud, but critics argue that one-size-fits-all blocking shuts out privacy-sensitive users, and some banks have already achieved compatibility through custom verification mechanisms, proving that security and openness can coexist. The incident highlights the tension between privacy and convenience, with the community calling on ASN to provide alternative verification methods or a transparent explanation.