WhatsApp Business API for finance and insurance, done carefully in Kuwait

A financial firm should start with the flows where a mistake costs least and the value is obvious, and add the sensitive ones once the controls have proved themselves. That order also makes internal sign-off easier.

Lead qualification. Trigger: someone taps a Click-to-WhatsApp ad for motor insurance or a personal-finance product, or submits a Facebook lead form. Message: the bot asks what they need — motor, health, travel, takaful or a financing product — and the few facts an adviser needs before calling back. Reply: button answers, saved on the contact. Handover: a licensed adviser takes the chat. The bot never tells anyone they qualify; it tells them what happens next.

Renewal reminders and claim status. Trigger: a policy nears its end date, or a claim changes stage in your system. Message: a utility template naming the policy by a masked reference, the relevant date and a button to renew or see the next step. Reply: 'renew' opens a payment link from your gateway; a question goes to the servicing team. Handover: any dispute or complaint goes to a person, with the history attached.

Document collection. Trigger: an application needs supporting papers. Message: a WhatsApp form for the structured details and a checklist of documents — a civil ID copy or a salary certificate, for example, depending on what your process requires. Reply: the customer completes the form and sends the files as attachments. Handover: an officer reviews them in the inbox; nothing is accepted automatically.

One-time passcodes. Trigger: a login, a transaction or a change of details in your app. Message: Meta's authentication template — the code, an optional security line and a copy-code button. Reply: none needed; the customer types or pastes the code. Handover: none, but your system should fall back to SMS when WhatsApp delivery fails, because not every customer uses WhatsApp on the number you hold.

Authentication is the category finance teams notice first. Until 30 September 2026, an authentication message to a Kuwaiti number costs $0.0091, the Rest of Middle East rate. From 1 October 2026 Kuwait is priced on its own and the rate becomes $0.044, the same as utility, and Gallabox's rate card adds 15%. A firm sending passcodes at volume should re-budget before October, not after the first invoice.

Meta also has an authentication-international rate — $0.12 for Kuwait from 1 October 2026 — but it applies only to businesses Meta designates for it, not to every sender of codes. If your firm is designated, the gap is wide enough to revisit whether WhatsApp is the right channel for every passcode.

Renewal reminders and claim updates are utility at $0.044, charged even inside the 24-hour window from October. A renewal message that adds a discount or cross-sells a second policy becomes marketing at $0.0792, and Meta can reclassify a utility template it judges to be promotional. Keep service messages about the policy, and put offers in separate campaigns sent to people who opted in.

Volume helps. Meta's tiers keep the list rate for the first 300,000 authentication and 100,000 utility messages a month, then step the price down, counted per business portfolio, per market and per category. Replies to customers who have just written in draw on 1,000 free service messages per number each month before $0.044 applies.

Trust comes first. Customers are right to be wary of anyone claiming to be their bank or insurer on WhatsApp. A verified business portfolio, an approved display name that matches your brand, and the blue check all help. Meta gives the check to verified portfolios with two-step verification and 30+ days on the platform, and no provider can promise it. Your display name can't contain 'Official' or 'Verified'.

Regulation comes second. Banks, finance companies and insurers answer to their own regulators on customer communication, record keeping and outsourcing. We don't give legal advice and we don't guess at those rules: your compliance team should confirm what may be sent on WhatsApp, what must be kept and for how long, before launch. On consent, Kuwait's CITRA Data Privacy Protection Regulation is the reference to raise with them.

Language and tone come third. Many customers prefer Arabic, and financial messages read better in a more formal register than a retail bot would use. Templates are written in both languages, in plain words, without abbreviations a customer could misread. Takaful and conventional products each need their own wording, not one message with a word swapped.

And the data rule is simple: never put a balance, a full account or card number, a civil ID number or a claim amount in a template. Say there is an update, identify it with a masked reference, and show the details only after the customer has logged in to your app or website.

Passcodes and system-triggered reminders need the API. Basic ($112 a month billed yearly) includes Gallabox's message and contact API and 3 users — enough for a small broker's reminders, not for an app sending codes. Essential ($248 a month billed yearly) adds the full API at 200 messages a minute, 6 users, team management and custom inbox views, plus Conversions API attribution for lead campaigns.

Advanced ($474 a month billed yearly) is where access control starts: number masking, so an agent can work a chat without seeing the customer's phone number, custom roles, 10 users, and an API rate of 1,000 messages a minute. Enterprise adds SSO/SAML sign-in, IP whitelisting, a dedicated success manager and an uptime SLA, with seats and pricing by quote.

Gallabox states it is SOC 2 Type II compliant. That is a starting point for your vendor review, not the end of it; your security team will want the report and its own answers on where data is processed. Setup through Aahfil is free — connecting the number, preparing business verification for Meta's decision, and the first templates — so the cost is the plan plus Meta's message fees.

Decisions. A bot can collect an application, but approval, pricing and claim settlement stay with people, and nothing in the chat should read as a promise that a loan or claim will be approved.

Payments inside WhatsApp. In-chat payments aren't available in Kuwait and there is no built-in KNET integration; premiums and instalments are paid through a link to your own gateway, where your existing security applies.

Core-system features Gallabox doesn't ship. Balance updates, fraud alerts and account changes need your core banking or policy system to call the Gallabox API, because there is no ready-made connector for banking or insurance cores. There is no built-in Salesforce, Zendesk or Freshdesk connector either; if your service team works in one of them, the link is a custom build.