AOPP Defended: What the Critics Got Wrong

In a recent blog, a competitor attacked 21 Analytics’ Address Ownership Proof Protocol (AOPP), the leading solution for verifying self-hosted wallet ownership. Below, we tackle each of the fallacies they spouted, with the actual facts.  

False Claim #1: Wallets Stepped Back after User Response

The regulatory requirement of proving ownership can be controversial, considering the privacy-conscious crypto crowd. 

In 2020, AOPP was an early solution to a problem most crypto users outside of Switzerland didn't have when it was launched: the Travel Rule. At this time, the Travel Rule was only getting started, and the ecosystem was unfamiliar with the usability issues of having to prove wallet ownership. Therefore, AOPP was widely misunderstood and received the reaction which was in fact directed to the regulatory requirement.

Most of the reactions came from people who had never used AOPP or had experienced the pain of using alternative methods, which resulted in some wallets scaling back their support. But this did not impact the main point users were concerned with: 

The requirement to verify wallet ownership, which is still there and, now, has reached most countries, making even the biggest critics of the technology become raving fans. Without AOPP, withdrawals and deposits to self-custody wallets are headaches to the users, resulting in many of them requesting their VASPs to support it as soon as possible. 

False Claim #2: Most Popular Wallets Do Not Support AOPP

Our competitor stated that AOPP is only supported by a handful of wallets. This fact was accurate four years ago, when AOPP had just been invented. Since its inception, AOPP has grown exponentially. 

Currently, users can verify ownership for Trezor, Ledger, MetaMask, BitBox, Phantom, TronLink, Trust Wallet and over 400 other wallets, with 1 click when their VASP supports AOPP. 

This statement surprised us as it is common knowledge that many popular wallets, as well as lesser-known wallets, support AOPP. 

False Claim #3: AOPP Is Designed for Swiss Compliance

Switzerland was one of the first jurisdictions to require self-hosted wallet proofs. As 21 Analytics is a Swiss-based company, it is only logical that the technology gained traction within the country during its initial inception.  

However, AOPP was not designed according to the Swiss framework; it was not designed with any single framework in mind; it was designed to be functional in all Travel Rule use cases and all jurisdictions.  

AOPP is a technology that turns a cumbersome process into a 1-click process. It does not “address compliance frameworks that aren't universally applicable”.

Furthermore, there is nothing special about Switzerland's regulation on this topic. It requires exactly the same as the Travel Rule in the European Union, Turkey, Dubai, Singapore, the United Kingdom and other jurisdictions. The only minuscule difference is the circumstances under which a VASP needs to request ownership proof over a self-hosted address: some countries will request it for all transactions, some just for transactions above a threshold, while others will suggest it for high-risk transactions based on a risk-based approach.

This just impacts when a VASP will decide to use AOPP (or any other method for ownership proof, for that matter), not anything about its technology.

False Claim #4: AOPP Support  is Costly and Time Consuming for Wallets

Most tech teams have implemented AOPP with less than 10 lines of code. It is a really straightforward technology that builds on top of a feature that every wallet possesses: the ability to cryptographically sign a message.

False Claim #5: AOPP Brings User Experience Challenges

Initially, we believed that the competitor who attacked AOPP in their blog could be doing so from a lack of understanding. But the more we read, the more it became apparent that the intention of this article was purely to spread disinformation about the product.

AOPP is a truly straightforward piece of technology and makes it as easy as possible for users to prove ownership and for VASPs to integrate. It literally requires the user to perform 1 action: click the button Sign Message in their wallet.

This action automatically connects the users’ address to the VASP's backend securely and prompts the user to click once to verify. That's it. Then the user can continue to withdraw or deposit the money as they would before the Travel Rule was in place.

It effectively replaces processes that take more than 10 steps and involve a couple of compliance personnel at VASPs that don't support it. Customers have reported waiting for over 2 weeks when their VASPs have used alternatives to AOPP.

False Claim #6: AOPP Needs, But Lacks Adoption

AOPP does not need to be adopted by every VASP in the world to function appropriately. Actually, if it were only used by one VASP, it would already be helping their customers tremendously, as we have seen in user feedback.

However, it is widely adopted by many firms that prioritise a stellar user experience for their customers in the regulated jurisdictions.

In fact, the growing success of AOPP may be the reason for the attack from competitors. In a fragmented Travel Rule space, the self-hosted wallet issue seems to be the only one that reached a common standard: most VASPs choose the easier and most secure option for their users, which is AOPP.

False Claim #7: AOPP Is Not a Robust Method of Wallet Ownership Verification

In fact, AOPP is the most robust method of proving wallet ownership. While Satoshi Tests take time and can easily be faked, AOPP uses cryptography and authentication to guarantee ownership.

To verify ownership in a Satoshi Test, the wallet owner must send a small, predetermined amount of cryptocurrency to the VASP from their address within a set timeframe. Successfully completing the transaction demonstrates that the wallet owner controls the address.

This process can easily be faked as the customer performs all the steps outside of the VASP area and could request the actual wallet owner, a third party, to do it, just by sharing the instructions received from the VASP with them.

However, with AOPP, the user is logged in to their VASP's account while connected to their self-hosted wallet. From there, the user needs to use their private key to sign a message, creating a cryptographic signature that will be automatically shared with the VASP. This guarantees that the VASP is dealing with the actual wallet owner and effectively mitigates the risk of transacting with an unknown third party.

Yes, this post may read like a counterargument, but only because we believe facts deserve a voice. We stand firmly behind our statements, our team, and, most importantly, our product. While words can clarify, nothing compares to seeing the solution in action.

If you're curious, let us show you what AOPP is capable of.