AML compliance for smaller firms – how deep do you really go?

Running a smaller advisory shop, the AML guidelines can feel like a bottomless pit of documentation. We're obviously doing our due diligence on clients, but for those of you also at smaller to mid-sized firms, what's your practical threshold for 'sufficient' ongoing monitoring and enhanced due diligence without drowning in paperwork? Any tips on streamlining without cutting corners on actual risk?