If your customer has provided a waiver of an actual CSR (i.e., a tier-1 requirement that may be found here*) it doesn't make much difference that you've gotten away with it in the past.In my opinion, if I ask my customer for a waiver for a CSR (and I have), and they send me one, then that has been waived. I have a couple of these cases. The CSR's and waivers have been viewed by at least 4 third party auditors and deemed good enough.
* A customer requirement is not necessarily the same thing as a customer-specific requirement.