Or, they could do it lazily. I.e., only force the 2FA at the time of money send / receive.