Precisely. You can use and old-style hardware token that only generates numbers to log in, but not to authorize an operation such as a money transfer.
The requirement is called "dynamic linking" (the 2FA code must be tied to the specific transaction) and the relevant regulation is PSD2.
