Once your CS is offshore and you don’t control it, the vetting process is a formality and doesn’t actually have to be anything more that a compliance process.
Having worked in call centres where strict compliance and security was critical, the reality is that doing things properly is expensive.
Source: 1st hand experience being a provider of such services.