An engineer configures a redundant design where an on-premises Cisco IOS XE router forms IPsec VTI tunnels to two AWS VGWs in separate regions. Both regions are interconnected, and AWS re-advertises the on-premises prefixes learned from one region toward the other. The IOS XE router logs no errors, tunnels are up, and BGP is established on both tunnels, but the router refuses to install the prefixes AWS advertises from the second region. 'show ip bgp' shows those prefixes received but with the reason 'received-only'. What is the most likely cause?