Licensees must ensure that at least one of the factors for authentication referred to in Paragraph CRA-5.9.2 is a dynamic or non-replicable factor unless one of the factors is inherence.