Navigating AML flags for offshore entity onboarding - UK/EU perspective

Curious to hear from others who are dealing with onboarding offshore entities, particularly those incorporated in jurisdictions that are not on a specific watch list but might still trigger some internal yellow flags for AML teams. We're talking about situations where the beneficial ownership chain is clear, documents are all present and accounted for, but perhaps the nature of the business or the origin of funds (even if legitimate and provable) just requires an extra layer of scrutiny. The classic dilemma of managing risk without creating unnecessary friction for legitimate clients. Are firms leaning more heavily on enhanced due diligence (EDD) even for these borderline cases, or are there specific frameworks you've found effective for rationalizing the risk appetite? Specifically interested in experiences from those operating under UK or EU regulatory frameworks, as the interpretation of 'risk-based approach' can vary significantly.