ASN Bank, a Dutch state-owned institution that markets itself on sustainability and privacy, has deployed Google Play Integrity as a mandatory gate for its iDEAL | Wero mobile payment functionality. Users running alternative Android builds — AOSP-based ROMs, GrapheneOS, de-Googled devices — are locked out entirely. The bank's templated response to multiple complaints confirms this is a deliberate architectural choice, not a bug. The bank's defense rests on European regulations requiring strong device integrity for payment transactions. This framing is misleading. The regulation requires security — it does not prescribe Google Play Integrity as the sole mechanism. AOSP-attestation and hardware-backed key attestation exist as alternatives that do not route trust decisions through a single US advertising company's proprietary API. The bank chose the path of least resistance for its vendor relationship, not the path of strongest user sovereignty. The templated complaint response — identical language sent to multiple users — reveals institutional capture in miniature. ASN acknowledges the problem exists, expresses sympathy, then states it follows 'frameworks and security requirements that parties jointly establish.' Translation: the consortium (iDEAL/Wero) made the call, individual banks follow. Responsibility diffuses upward into a multi-party structure where no single entity owns the exclusion. This matters because iDEAL is not a niche payment rail. It is the dominant online payment method in the Netherlands, processing the vast majority of Dutch e-commerce transactions. Being excluded from iDEAL is not an inconvenience — it is a meaningful reduction in economic participation. And the gatekeeper is not a regulator or a bank, but Google's device-attestation infrastructure. The irony is structural: ASN Bank is wholly owned by de Volksbank, which is 100% owned by the Dutch state via NLFI. A government-owned bank is enforcing a private US company's device-attestation monopoly as a condition of basic payment access. The sustainability and privacy branding that ASN trades on is contradicted by the dependency it has accepted. ASN's promise to 'investigate whether alternative operating systems will be supported in the future' is the softest possible commitment — no timeline, no guarantee, no mechanism. The users filing complaints are doing the only thing that might move the needle: creating a paper trail of demand that regulators or consumer authorities could eventually act on. The 20-year question is whether European payment infrastructure will entrench Google and Apple as de facto trust anchors for financial access, or whether regulators will mandate open attestation standards. Right now, the trajectory favors the former.
