ASN Bank Says Wero Needs Play Integrity, Locking Out GrapheneOS

ASN Bank has told customers that paying through iDEAL | Wero in its Android app requires Google Play Integrity, which shuts out phones running GrapheneOS, according to complaint replies pasted into a public compatibility tracker as of Nov. 6, 2026.

The replies appear in issue #105 of the PrivSec-dev banking-apps-compat-report repository on GitHub. Two users, Tasqa and ranjowd, each posted a near-identical response from the bank, in Dutch. Tasqa's device is a Pixel 9 running GrapheneOS, and the complaint says payments have failed since version 1.36.3 of the app because the phone does not meet its security requirements.

What ASN and EPI say

ASN's position, as relayed in the thread, is that Wero is bound by strict European rules on privacy, security and fraud prevention. The bank says alternative operating systems skip or replace built-in protections, so Wero cannot guarantee a transaction is safe. Its only commitment is a single sentence: "Op dit moment ondersteunen we de dienst nog niet op alle toestellen en besturingssystemen." The bank adds that it is studying with Wero whether other systems could be supported later, with no date.

The user lucasvbeek then quoted the European Payments Initiative (EPI), which operates Wero, on why hardware attestation is not accepted. EPI's reply said hardware key attestation only proves a key was generated in a TEE or StrongBox. In its words: "What it does not verify is the integrity of the calling application and the runtime operating system." EPI also said Play Integrity returns a signed token that its backend verifies server to server.

The same user said that Wero has a web-to-web payment flow that needs no mobile app, and that ASN chose not to implement it.

The GrapheneOS counter-argument

GrapheneOS publishes an attestation compatibility guide that says the opposite about hardware attestation. It says apps can verify the device's hardware, firmware, operating system and app, and that the attestation "provides a verified boot key fingerprint for the OS for permitting secure aftermarket operating systems."

The guide tells developers to check that verifiedBootState is Verified or SelfSigned. For SelfSigned, the app should match verifiedBootKey against the signed list at grapheneos.org/attestation.json, and check its timestamp to block downgrades. It also says "Play Integrity API strong integrity level is directly based on the hardware key attestation API."

That last line matters for EPI's argument. If strong integrity sits on top of hardware key attestation, the two are less separate than EPI's reply implies. The guide does not say which Play Integrity verdicts GrapheneOS passes, so the thread's dispute over verdict levels cannot be settled from it.

Source	Says hardware attestation can verify
EPI, via the thread	Key origin in a TEE or StrongBox only
GrapheneOS guide	Hardware, firmware, OS and app
Developer cristobalbaixas, in the thread	OS integrity, through RootOfTrust fields

The developer cristobalbaixas also reported seeing only MEETS_DEVICE_INTEGRITY and never MEETS_STRONG_INTEGRITY across 64 verdicts from test phones. They added that their own app still gates on the Google verdict, so it would block GrapheneOS as well.

Who is affected

Anyone using GrapheneOS with an ASN account. Another user in the thread reported that version 15.0.2 of the Fortuneo banking app works with Wero on GrapheneOS release 2026110200. So the block is a choice by each bank, not a property of Wero alone.

Earlier coverage on this site touches both sides of the trust question: CERT-In's warning about AI tools and payment APIs and a Claude Code privacy fix about what software tells outside services.

Tasqa's complaint asked ASN to accept the weaker basicIntegrity check instead of ctsProfile, or to look at direct hardware attestation. Tasqa also suggested approaching Bits of Freedom. No GrapheneOS staff member comments in the thread, and no ASN or EPI statement was published outside the pasted replies.

The next fixed point is ASN's own study with Wero. The bank gave no completion date for it.