# XBC-007 — A public company must finish two-factor identity before any campaign

> A PUBLIC_PROFIT brand must complete its Authentication+ two-factor identity step before a campaign is created against it.

- **Rule ID:** XBC-007
- **Layer:** Brand ↔ campaign (`CROSS`)
- **Checks:** `brand.entity_type + brand.vetting + campaign submission`
- **Severity:** BLOCKING — Breaking this rule gets the submission rejected outright.
- **When it bites:** Gates approval — get this wrong and registration is refused
- **How it is detected:** Deterministic (settled in code from the submitted values)
- **Fix type:** Wait on an external system or a required interval
- **Required by:** TCR
- **Applies:** Applies when the brand is a public company.
- **Depends on:** XBC-006
- **Canonical URL:** https://ekas.io/rules/10dlc/cross/xbc-007/

## Why this rule exists

Publicly traded brands carry an extra identity step that no other entity type has, and it is the one gate that produces no error while it is outstanding: the brand verifies, looks healthy, and every campaign against it is refused. The two-factor mail goes to the business contact address, so it is routinely missed by the person doing the registration, who is rarely the person on that mailbox.

## How to fix it

Order the Authentication+ vet explicitly after the identity check, watch the business contact mailbox for the two-factor mail, and hold the campaign until the vet is recorded on the brand. Done when the brand shows an Authentication+ vet before the campaign is submitted.

## Check this yourself

**Do you know who receives mail at the business contact address, and that they are expecting the Authentication+ two-factor message?**

1. Name the person on the business contact mailbox out loud. It is rarely the person doing the registration.
2. Tell them the two-factor mail is coming and what to do with it, then confirm the completed vet appears on the brand before submitting the campaign.

*What wrong looks like:* The brand verifies and looks healthy, every campaign against it is refused, and the two-factor mail is unopened in a shared inbox nobody watches.

## Notes

The vet is an action at the registry, not a field on the submission, and the PIN arrives by mail on the registry's schedule. What the user has to do is confirm who receives the business contact mail and that they know to expect it — BRD-225 covers ordering the vet, BRD-226 the window it must be completed in; this rule is the campaign-side consequence of either being outstanding.