While there is a need for complex criteria, there is also a need for something simple to base enforcement on.
The simple criteria should be something like having more than some number of customers/users gets you automatic scrutiny and forces you to have things like customer service people along with government required metrics (10K-type things) and some larger number of customers/users forces you to break up.
It's the uncontrolled aggregations of users and data that are the problem.