Couldn't you not support SMS 2FA for noncompliant countries, and then check that it's not in an ITU registered premium range?