Follow-ups and renewals

Kenya: M-Pesa, the Insurance Regulatory Authority and WhatsApp premium reminders for brokers

WhatsApp premium reminders for Kenyan brokers: the cash-and-carry rule, M-Pesa paybill references, what the IRA expects and what the Data Protection Act 2019 allows.

Published on 7 min readFCB.ai
Contents
  1. Why the cash-and-carry rule makes reminders a compliance task
  2. Building the M-Pesa reference into the message
  3. The Data Protection Act 2019 and the ODPC: what a reminder may contain
  4. Measuring whether the reminders work
  5. Frequently asked questions

In Kenya the premium reminder is not a courtesy, it is the moment cover starts or stops. Since the advance-payment rule in section 156 of the Insurance Act (Cap. 487), commonly called "cash and carry", an insurer may not assume a risk until the premium has been received, subject to the exceptions the Cabinet Secretary has allowed by regulation. For a broker in Nairobi, Mombasa or Kisumu, that turns every renewal into a race against the expiry date, and WhatsApp plus M-Pesa is how most of that race is now run. This guide describes how to organise it properly: what to send, what reference to quote, what the Insurance Regulatory Authority expects and what the Data Protection Act 2019 allows.

Why the cash-and-carry rule makes reminders a compliance task

Before the advance-payment rule was enforced, brokers carried credit for clients and chased premiums after cover had started. That practice is gone for most classes. Today, a motor policy due on the 30th that is paid on the 2nd has had a gap, and a client stopped at a police check during that gap has no cover, a problem that lands on the broker's desk. Medical schemes handled through brokers behave the same way: the insurer will not activate the member until the premium is in, and hospitals check the activation status at admission.

A reminder sequence therefore has two goals: make sure the premium lands before expiry, and produce a written trail showing that the client was told, in time, what would happen if it did not. The Insurance Regulatory Authority (IRA) licenses brokers and agents, publishes market-conduct expectations and runs a complaints desk; in a dispute about a gap in cover, the chat history is what shows who said what and when.

Three classes account for most reminder volume in a Kenyan broker's book:

ClassTypical termWhat the reminder must containPayment habit
Motor (comprehensive and third party)12 months, some short-term coversRegistration number, expiry date, premium, where to payM-Pesa paybill, bank transfer, premium financing for larger fleets
Medical (individual and SME schemes)12 months, sometimes quarterly instalmentsScheme name, member count, due date, consequence for hospital accessBank transfer, M-Pesa for individuals, employer payroll for groups
Microinsurance and embedded coversMonthly or per seasonProduct name, amount, one-step payment pathM-Pesa almost exclusively

Building the M-Pesa reference into the message

A reminder that says "please pay your premium" generates a second conversation: "how?". A reminder that contains the insurer's paybill number and the exact account reference gets paid. Most Kenyan insurers publish a Lipa na M-Pesa paybill with the policy or quotation number as the account reference; some brokers collect into their own paybill and remit, which the IRA's rules on premium handling by intermediaries constrain, so check your licence conditions before doing so.

A useful sequence for a motor renewal, adapted to the client and the insurer's references:

  1. Fourteen days before expiry, a utility template: "Hello {prenom}, the cover for {contrat} with {cabinet} expires on {date}. Renewal premium: KES {montant}. Pay via M-Pesa paybill [insurer number], account [policy number], and send us the confirmation. Reply 1 if you want us to compare quotes first."
  2. Seven days before, a personal follow-up from the account handler, not a template, ideally with the renewal quote attached as a PDF.
  3. Two days before, a short, explicit message: cover stops at midnight on the expiry date; no premium, no cover, no certificate.
  4. On receipt of the M-Pesa confirmation, an acknowledgement with the transaction code quoted back, and the certificate or cover note as soon as the insurer issues it.

Two practical points. First, ask clients to send the M-Pesa confirmation message as text rather than a screenshot: the transaction code is searchable later. Second, never ask a client to send their M-Pesa PIN or full statement; the confirmation message contains everything a broker needs to reconcile.

In ORIS, the first message runs as a campaign from a Meta-approved utility template with the renewal date and premium merged from the client record, targeted through a segment filtered on the renewal window. The replies land in the shared inbox, where "I paid" messages with a transaction code are easy to spot, and where a reply such as "too expensive this year" is classified by the AI as a risk and surfaced in Opportunities & Risks for the handler to call before expiry rather than after.

The Data Protection Act 2019 and the ODPC: what a reminder may contain

Kenya's Data Protection Act 2019 applies to every brokerage that processes client data, and the Office of the Data Protection Commissioner (ODPC) requires data controllers and processors above the thresholds in the registration regulations to register. For a reminder programme, four rules matter:

  • Purpose. A reminder about an existing policy is processing for the performance of the contract. The client's phone number was collected to service the policy; using it for that is lawful without separate marketing consent.
  • Direct marketing is different. The Data Protection (General) Regulations 2021 require that a client has been told that direct marketing is a purpose, has consented, and has a simple, free opt-out mechanism. "Renew with us and add a personal accident cover at 20 percent off" is marketing, and needs that consent and that opt-out line.
  • Minimisation. The reminder should not carry more than it needs. A medical reminder does not need to mention a diagnosis; a motor reminder does not need the client's ID number.
  • Security and retention. Conversations that contain policy and payment data should sit in the brokerage's system, not on staff handsets, and be kept for as long as the IRA and the Act require, then deleted.

The simplest way to stay on the right side of the line is to keep two template families: utility templates for renewals, payment confirmations and documents, and marketing templates only for clients who have opted in to offers. ORIS records the WhatsApp opt-in and separate marketing opt-out flags on each client, and a campaign tagged as marketing excludes anyone with an opt-out. The general principles for Southern Africa are discussed in the guide to consent rules for brokers on WhatsApp; the Kenyan regime is structurally similar but enforced by the ODPC.

Measuring whether the reminders work

Brokers who run reminders by hand rarely know their own numbers. Three figures are worth tracking monthly for each class:

  1. Paid-before-expiry rate: the share of renewals where the premium landed on or before the expiry date. This is the number that cash-and-carry makes critical.
  2. Reply rate by message: which step in the sequence actually triggers the payment. Many brokerages find the seven-day personal message does more than the fourteen-day template.
  3. Lost renewals with a stated reason: price, moved to a direct insurer, sold the car. These are the replies the inbox captures and a spreadsheet never did.

The campaign analytics in ORIS show delivered, read and replied counts for each template, and an A/B test can compare two wordings of the fourteen-day reminder on the same segment. Over a few renewal cycles, that turns a chore into a process the brokerage can defend to the IRA and improve every quarter. The broader topic of follow-ups and renewals is covered throughout this blog.

Frequently asked questions

Can a broker in Kenya collect premiums into its own M-Pesa paybill?

Premium handling by intermediaries is regulated, and many insurers now insist on payment into their own paybill. Check the IRA's rules applying to your licence and your agency agreements before collecting on an insurer's behalf.

Is a WhatsApp premium reminder a marketing message under Kenyan law?

A reminder about an existing policy's premium is servicing the contract, not direct marketing. It becomes marketing when it promotes a new product or a discount, and then the consent and opt-out rules of the Data Protection (General) Regulations 2021 apply.

What should we do when the client pays after the expiry date?

Tell the client in writing that cover restarts only from the insurer's activation date and that there was a gap. Keep that message; a claim from inside the gap will be repudiated and the conversation is your record that the client was warned.

Do microinsurance policies follow the same reminder logic?

Largely yes, with shorter cycles. The Insurance (Microinsurance) Regulations 2020 set short timelines for claims and complaints, so the same inbox that sends monthly reminders should be ready to handle a claim notification within days.

Does the brokerage have to register with the ODPC?

Registration depends on thresholds set in the Data Protection (Registration of Data Controllers and Data Processors) Regulations 2021, including turnover and the nature of the processing. Most brokerages handling medical and motor data will need to check those thresholds with counsel or the ODPC.

See ORIS in action

Shared WhatsApp inbox, client records, follow-ups and opportunities for the whole brokerage. 15-minute demo.

Book a demo
Book a demo