These are very good questions.
The preliminary question is: is there a reasonable suspicion of the book that the player multi-accounted? If no, the case is over. The book can ask for KYC stuff, but nothing intrusive.
SBR is ultimately a player site. If there is a reasonable basis for believing there is multi-accounting, then 1. The standard I use is clear and convincing (this is higher than a civil court would require), but 2. The player must cooperate. If there is a lingering doubt and the player is giving all information we request, I would recommend the book to pay the player, even if I thought there was a 55% chance that the player was multi-accounting.
In most cases, when both sides cooperate fully, you can be 99% certain which side is right.
As mentioned earlier, an IP issue does not mean with 100% certainty that a player is multi-accounting. I had two cases (one involving about ten players) in the last year where there were (apparent) shared IPs, and I ultimately recommended that the players be paid. But in both of those cases, there was a lot of questioning of the players... And they were more than happy to give me anything and everyhing I asked for, including allowing me to log in to their cell phone records. However, if there is an IP issue and the player won't work me me, there isn't much I can do.