There could be "N" number of reasons for sending attach reject from MME to UE. For this particular case, when authentication and security procedures have already been completed, I would suggest you to look into Update-Location-Answer message if MME has not yet triggered Create Session Request towards SGW.
Soon after completion of NAS authentication and security procedure, MME triggers Update-Location-Request message towards HSS to update the HSS on current serving PLMN of UE. Afterwards, HSS responds with Update-Location-Answer message. Update-Location-Answer message contains many AVPs but the most significant one is "Subscription-Data" AVP for MME.
Please cross check values of sub AVPs of Subscription-Data AVP, hopefully you will get the reason.The one, I am suspecting is value of Subscriber-Status as OPERATOR_DETERMINED_BARRING.
