|=[ PRIVACY POOLS :: FOR OPERATORS ]=
RUN YOUR OWN ASP.
THE SCREENING LAYER · AS A ROLEThe Association Set Provider is the one piece of Privacy Pools that isn't immutable code. A permissioned operator decides which deposits are accepted and rejected, and can be curated to include anything you like. This page shows you how to create your own ASP, from index and screen to publishing, and legal implications. Just want to plug the protocol into your app? Integrate it instead.
BUILD YOUR OWN ASP
The Association Set Provider is a role, that can be changed and updated. Here’s how it works.
Watch Deposited events offchain. Every deposit gets a label (keccak256(scope, nonce)); your association set is a set of approved labels.
Screen the depositor and the source of funds. You can use Free Inputs: the OFAC SDN list and the onchain Chainalysis Sanctions Oracle, Paid Inputs: TRM, Elliptic, MistTrack, or Public Inputs: Chainabuse, rekt, exploit drains. Statuses: pending, approved, declined, poi_required
Build a LeanIMT over the approved labels and call Entrypoint.updateRoot(root, ipfsCID). Withdrawals prove against latestRoot() only. 0xbow posts roughly hourly; clean deposits turn withdrawable at the next root.
Pin the full set to IPFS and serve the leaves by API, so wallets prove membership locally without telling you anything. Every set you post is publicly auditable, anyone can diff consecutive roots and watch you add and remove.
THE CATCH
For Privacy Pools, you need the ASP_POSTMAN role to updateRoot. There are currently two ways to deploy:
· Get a slot on an existing deployment — Brevis runs the ASP on the BSC pools, and
the client already ships a pluggable ASP config.
· Deploy your own Entrypoint and pools.
ASPaaS
You are selling Trust as a Service. As a provider you are permissioned and let only those who meet your rules into the pool. You can censor, revoke, and grief pending proofs.
THE LEGAL READ
Non-custodial attestation is likely not money transmission; FinCEN's line is custody, and software providers are exempt. OFAC strict civil liability: screening the SDN list is self-preservation, not a feature. Van Loon protects immutable code; the ASP is the mutable pressure point. The EU's 2027 AMLR could make ASPs the middleware that keeps privacy tools usable. Not legal advice.
THE OPERATIONAL REALITIES
Removal is retroactive by design: a label admitted today and tainted tomorrow just vanishes from the next root, and the depositor ragequits.
Update latency is your risk window: the gap between an exploit and your next root is when laundered funds become "clean".
A self-report kill switch exists in the reference UI: a user can sign to poison their own label so a key thief can't launder.
Integrating Privacy Pools but not sure it fits? Talk to Ben.
TALK TO BEN →