Legal situation when using auth policy token

Hi, we own a frequency usage licence from the Bundesnetzagentur and ran our network with auth policy token. So every new phone trying to attach to our network will receive a SMS with information how to register and a token. Thereafter, the phone is kicked out and will no longer be able to register again. Now there was a problem with some phones from Cupertino which, as I heard, registered to our network, received the SMS, were kicked out again but did not try to re-register with their home network. So some "nice" guys threaten to call the Bundesnetzagentur if we will not shut down the network immediately. As a quick solution, we changed the registration procedure from Token-Input to IMEI-Input. My question is: Are there really legal problems when using the "Auth Token" policy? Many Thanks, Lennart