# BRD-226 — The 2FA PIN must be completed inside the vet's window

> The business contact must complete the Authentication+ 2FA PIN within 30 days of the vet being submitted, or the vet must be re-submitted.

- **Rule ID:** BRD-226
- **Layer:** Brand (`BRAND`)
- **Checks:** `the Authentication+ 2FA state`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** Not knowable before submission — reported with its deadline
- **Fix type:** Wait on an external system or a required interval
- **Required by:** TCR, Twilio
- **Applies:** Applies when the brand is a public company.
- **Canonical URL:** https://ekas.io/rules/10dlc/brand/brd-226/

## Why this rule exists

The window belongs to the vet rather than to the email, and it runs whether or not anyone saw the message — so a vet ordered before a quiet period expires quietly, and the fee goes with it. Public companies, whose contact is usually a senior person with a filtered mailbox, are the ones this catches.

## How to fix it

Tell the named contact the mail is coming, before it is sent, and get their confirmation that they have completed the PIN. Track the 30-day deadline from the order date rather than from the mail date. Done when the brand reports Authentication+ active.

## Provider rejection codes

| Provider | Code | Resubmission allowed |
| --- | --- | --- |
| TCR | `565` | yes |
| Twilio | `21737` | yes |

## Check this yourself

**Has the named contact confirmed to you, in words, that they completed the PIN?**

1. Brief the contact before the vet is ordered, not after the mail is sent.
2. Track the 30-day deadline from the order date, not from the mail date, and chase inside the first week rather than the fourth.
3. Done when the brand itself reports Authentication+ active.

*What wrong looks like:* A vet ordered before a quiet period expires quietly, taking the fee with it. The contact is usually a senior person with a filtered mailbox who never saw the message.

## Notes

The window is 30 days for the vet and 7 for the emailed link inside it (BRD-227); both are live and neither is visible to us. What the user has to do is own the deadline themselves — brief the contact before ordering, and chase inside the first week rather than the fourth.