For example, with a bank's credit card activation/registration, that user is required to authenticate with a unique code that was mailed to their address. If they don't get that mailout-with-the-code, they'd be SOL.
With that in mind, we'd like to do a self-registration system for a site where a potential registrant could login and self-register to creating an account by successfully answering some personally identifying information (SSN, DOB, address etc.) that we already have on file.
Obviously, this seems less secure than requiring that multi-factor item of the activation code.
I've gone over a lot of OWASP authentication cheat sheets and combed through the payment processing industry best practices and glossed over PCI DSS but I can't seem to find something that would indicate that the scenario that we're planning on implementing for self-registering would be minimally "acceptable" or non-compliant.