They should retain enough evidence to show why the chosen data set, verification source and review frequency matched the identified risk. That means keeping decision logs, source quality rationale and exception handling together. Proportionality is defensible only when the programme can explain its choices after the fact.
What proportionality looks like in customer due diligence records
Proportionality is not proven by saying the process was lighter or stricter, but by showing the logic behind the level of scrutiny chosen. Compliance teams need a record that connects the customer risk rating to the specific checks performed, the data sources used, and the cadence of review. The evidence should make the decision understandable to an external reviewer without requiring reconstruction from memory.
A useful record set usually shows three things together: the basis for the risk view, the rationale for the selected verification method, and the reason the review cycle was set at that frequency. When those elements are separated across emails, case notes and spreadsheets, proportionality becomes hard to defend. When they are linked in one case file, the programme can show that it made a reasoned choice rather than an ad hoc one.
How to evidence source quality and decision making
The strongest evidence is often not volume, but traceability. Teams should be able to explain why a particular data set was good enough for the risk level in question, why one source was preferred over another, and what would have triggered a higher standard of review. That includes documenting any reliance on third-party information, sanctions screening, beneficial ownership data, or customer-supplied documents when those inputs materially shaped the conclusion.
Identity Proofing and KYC Guide is useful here because it frames evidence quality around assurance, verification depth and the checks that justify a customer-facing decision. The same principle applies even when the due diligence is not technically identity proofing: the file should show why the evidence source was fit for the level of risk.
Exception handling also matters. If the team accepted incomplete information, shortened a review, or waived a normally required step, the file should show who approved it, what compensating control was used, and why the exception was still proportionate. That is often the point at which a review is either defensible or exposed as inconsistent.
How auditors and regulators test the proportionality argument
Reviewers usually test proportionality by asking whether the institution can explain its choices after the fact, not whether it followed a generic template. They look for consistency between the customer profile, the data collected, the verification route and the refresh interval. If a low-risk case received unusually heavy scrutiny, or a higher-risk case received minimal checks without explanation, the problem is usually not the process itself but the absence of documented judgment.
For that reason, proportionality evidence should be written in a way that survives challenge. The record should make clear what was known at onboarding, what changed over time, and why the review frequency remained appropriate or was increased. Where decision rights are split across onboarding, operations and compliance, the handoffs should also be visible so that accountability is not lost between systems.
FATF Recommendations — AML and KYC Framework is the most direct external anchor for this logic because it ties customer due diligence to risk-based measures rather than one-size-fits-all checking. EBA AML/CFT Guidance is also relevant where EU institutions need to show that their due diligence intensity is calibrated to the assessed exposure.
Risk and Threat Considerations
Proportionality fails when organisations cannot prove why they trusted a source, accepted an exception or set a lighter review cycle. That creates regulatory exposure, but it also creates control drift, because future analysts may copy the precedent without understanding the original risk basis. In practice, the weakest point is often not the check itself, but the missing rationale behind the check.
Failure mechanism: The programme makes reasonable decisions case by case, but does not preserve the reasoning, evidence quality assessment or exception approval in a form that can be audited later.
Impact: The team may be unable to defend why a customer was treated as low, medium or high risk, which can lead to findings on inadequate customer due diligence, inconsistent treatment and weak governance over risk-based decisions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 and GDPR define the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Customer due diligence needs reviewable decision evidence and exception rationale. |
| AC-6 — Least Privilege | Proportionate CDD often means limiting checks and access to what the risk justifies. | |
| Recommendation — Retain auditable decision logs that explain source choice, exceptions and review cadence. Limit customer data access and review scope to the minimum needed for the assessed risk. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | CDD evidence handling depends on controlled access to sensitive customer records and rationale. |
| Recommendation — Restrict access to due diligence records and rationale to authorised reviewers only. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Proportionality depends on preserving the history of who decided what and why. |
| Recommendation — Keep case logs that preserve decision history, exception handling and source rationale. | ||
| GDPR | A.5.13 — Data minimization | Proportionate CDD should limit collected data to what is necessary for the assessed risk. |
| Recommendation — Collect and retain only the customer data needed to justify the risk-based due diligence decision. | ||
Practitioner Guidance
What to verify: Before closing a case file, verify that the risk rating, selected evidence source and review frequency are linked in the record, not just implied by workflow status. If the rationale cannot be read straight through from assessment to decision, the file is not yet proportionate in an evidentiary sense.
Decision rule: If a reviewer would need to reconstruct the logic from multiple systems, capture the decision summary in one controlled place and include the source-quality rationale plus any exception approval. If the case depends on judgement, preserve the judgement, not just the final outcome.
Practitioner takeaway: Proportionality is proved by explainability, so the case record must show why this customer got this level of scrutiny, using this evidence, at this cadence.
Related resources from NHI Mgmt Group
- How should compliance teams handle customer identification and due diligence in the Netherlands for non-face-to-face onboarding?
- How should compliance teams implement customer due diligence under Kenya’s AML framework in higher-risk onboarding flows?
- How should compliance teams approach customer identification and due diligence for non-face-to-face business relationships in Latvia?
- How should compliance teams handle customer identification and due diligence for non-face-to-face business relationships in Curaçao?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org