Customer due diligence works only when the depth of effort is proportional to the risk in front of the analyst, but in practice many programmes drift toward a single uniform process because tiering rules are unwritten or inconsistently applied. The intent is rarely the problem. Where we see CDD programmes lose proportionality is in the absence of a clear, documented trigger framework that moves customers between simplified, standard and enhanced tiers as their risk profile changes.