CRM for banks and financial services: what WhatsApp allows, what it bans and how to serve customers safely

What is a CRM for banks and financial services, and what does it not replace?

A CRM for banks and financial services is the system that holds the customer relationship: who spoke to whom, what was asked, what was promised, which applications are open and which alerts went out. With WhatsApp, it brings conversation, record and history into one place a manager can audit. Accounts, balances, contracts and credit decisions stay in the core banking system and the institution's own software.

The searches vary: banking CRM, financial services CRM, CRM for fintech, insurance CRM, WhatsApp CRM for banks. The subject here is the customer relationship in banks, lenders, fintechs, credit unions, agents and insurance brokers. If you want a tool for your own company's accounts payable, that is a different product, and this guide does not cover it.

In this sector, the question about the channel comes before the question about the pipeline. What does WhatsApp's policy let you send? How do you confirm it is the customer without asking for sensitive data? Where does the data live? Who answers if something goes wrong? So this guide starts with the rules and gets to tools later.

We checked each rule at its source on 4 November 2026 and marked what is our reading and what we could not confirm. Nothing here is legal advice. CCX Messages is a communications platform, and the final answer for your case comes from your counsel and your compliance team. The law changes by country, and this version covers the United States and the European Union in general terms, plus the Brazilian rules that apply if you serve customers there.

What WhatsApp's policy allows and bans in financial services

WhatsApp's messaging policy, in the 23 September 2026 version, has no chapter for banks. It does not mention banks, insurance, payroll loans, financing or personal loans. Items marked ALLOWED are CCX's interpretation, based on the general rules and on Meta's category examples, and assume the person gave you the number and opted in. Items marked BANNED come from section 4, which prohibits buying, selling, promoting or facilitating the exchange of the listed items, whatever license the business holds.

ALLOWED, in CCX's reading. Transaction alert: purchase approved, transfer received or refund, to someone who is a customer and opted in. Meta gives account and refund notices as utility examples. Do not put an offer in the same message, because that changes the template category.

ALLOWED, in CCX's reading. Account update: card shipped, limit changed on request, document available in the app. One caution: Meta classes as marketing a message that calls someone back to finish a loan application, even when it looks like a notice.

ALLOWED, in CCX's reading. Due-date reminder: before the date, to someone who is already a customer and opted in. Meta cites payment reminders as utility. After the due date, the message moves toward the debt collection row below.

ALLOWED, in CCX's reading. Customer service: when the customer writes in, the 24-hour window opens for free-form replies. Section 2 accepts automation in that window, as long as there is a clear and direct path to a person.

ALLOWED, in CCX's reading. Branch appointment confirmation, for someone who booked the slot, with buttons such as Confirm and Reschedule.

ALLOWED, in CCX's reading. Security alert: new login, device change, a warning about a scam going around. The message asks for nothing. One-time codes only go out in an authentication template, the only category Meta accepts for them.

BANNED by section 4, even with a license. Debt collection. CCX does not offer this service. The policy does not define the term or say whether collecting your own portfolio counts. Our stance is to treat as banned a message about an overdue installment, a settlement offer to someone in arrears and any pressure to pay.

BANNED by section 4, even with a license. The text reads: “Payday loans, paycheck advances, peer-to-peer lending, debt collection, and bail bonds”. A payday loan is a very short-term loan until the next paycheck. Paycheck advances are early access to wages. Peer-to-peer lending is lending between individuals, the model of some fintechs. A bail bond is criminal bail.

BANNED by section 4, even with a license. Currency of any kind, real, virtual or fake, ICOs and binary options included. The policy does not explain how far real currency goes. In our reading, the target is buying, selling or promoting currency as a product, which reaches foreign exchange and crypto. A bank's alert about a customer's account does not look like the target, but that is interpretation.

NO ANSWER IN THE TEXT. Payroll loans, personal loans, financing, insurance and other advances. The policy does not mention them. If your product falls under this item, the next section applies to you, and the case needs a legal opinion before anything goes out.

Can loan offers and payroll lending go out on WhatsApp?

The policy does not answer. Payroll loans, personal loans and financing are not on the list, and paycheck advances means early access to wages. Whether a payroll-deducted product or another kind of advance fits that phrase, the text does not say, and we will not claim either way. A lending offer on WhatsApp needs a legal opinion case by case, product by product.

Even if the product clears that doubt, an offer is marketing: it needs opt-in, an approved template and respect for anyone who asks to stop, as the opt-in guide explains. In the US, the TCPA (47 USC 227) and FCC rules (47 CFR 64.1200) require prior express written consent for autodialed telemarketing to cell phones, and count texts as calls in parts of the rule. Neither text names WhatsApp. We could not confirm how they apply to an internet messaging app, so get counsel and act as if they do.

Those FCC rules also say consent can be revoked by any reasonable method and must be honored within ten business days. We did not confirm the effective date of every part of that paragraph. In the EU, marketing by electronic means follows national rules built on the e-privacy framework, which we could not open at source. In Spain, as one example we did read, the LSSI (art. 21) requires prior authorization, with an exception for similar products sold to existing customers. Lending disclosures have their own rules, which we did not review.

If you lend to consumers in Brazil, the Consumer Code requires full cost, interest and early-repayment information at the moment of the offer, and bans pressuring elderly or vulnerable consumers (arts. 54-B and 54-C, added by Law 14.181/2021). For social security payroll loans, the regulator's rule, IN 138/2022, in the version consolidated to 19 May 2026, bars active marketing by any means, messaging apps included, within 180 days of the benefit decision. Later changes we read did not touch that article. Confirm the current text.

How do you verify a customer without asking for card, account, ID, password or token?

Section 3 of the policy prohibits sharing or asking for full payment card numbers, financial account numbers, personal ID numbers or other sensitive identifiers. It does not mention passwords, tokens or access codes. In our reading, they count as sensitive identifiers, and Febraban, Brazil's banking federation, keeps repeating that banks do not ask for them. In practice, treat all five the same way: none of them gets asked for in the chat.

The first option is the authentication template. Meta's documentation says only this category can send one-time codes. The text is fixed, with an optional security note and expiry, and the button can copy the code or fill it in the app. The CCX panel has this format. The customer types the code inside your app or online banking. Never ask them to send the code back in the chat.

The second option is a deep link to your app. A message with a button opens your app, the customer logs in there with biometrics or a password, and confirms the service request. Your system returns the result through the API, and the record gets a tag or field such as “identity confirmed”. The agent sees the mark and carries on, without ever seeing any data. Since many banks teach customers to distrust links, also offer the choice of opening the app on their own.

The third option is the online banking session. A customer already logged in taps Chat on WhatsApp, and the link carries a one-time reference code, with no personal data, in the first message. Your system recognizes the code and tells you who is writing. This design depends on your technology and fraud teams. CCX delivers the message and keeps the result on the record, and it does not perform identity verification.

Knowledge questions, like date of birth or mother's maiden name, are not on the policy's list, but they are personal data, and a fraudster often has the answers. The last digits of a card are a different case: section 3 speaks of full numbers, and one of Meta's utility examples shows the last four digits of an account in a message sent by the business. In our reading, showing the ending differs from asking for it. Your compliance team decides what applies to your operation.

What if the customer sends the data unprompted, such as a photo of a card or ID? Agree the procedure in advance. The agent does not repeat the data, does not copy it to the record or a note, guides the person and logs what happened without the number. Put this case in your training and retention policy, along with the reply template further down.

WhatsApp bank number: how can a customer check it is real?

Many people searching for a bank's WhatsApp just want their own bank's number, and that is a risky moment. In October 2026, Febraban, Brazil's banking federation, warned about a fake WhatsApp profile using its logo and talking about an urgent matter and a suspicious transaction. In March, it warned about the fake bank manager scam. Names and photos can be copied in minutes.

To check, look for the number in your bank's app, on a website you typed yourself or on your card, never in a message you received. Then look at the profile: a business account with the blue verified check is a good sign, as the badge guide explains. A missing badge does not prove a scam, because Meta decides who gets one. Anyone asking for a password, code, token or payment to fix your account is a scam. Febraban's advice is to stop and go to official channels.

On the institution's side, three things help the customer. Publish the official number in your app, on your website and on statements, and use few numbers. Apply to Meta for the verified badge, knowing the approval is Meta's and carries no guarantee. And repeat in your messages what you never ask for. Section 1 of the policy forbids impersonating another business, and a fake profile with your brand should be reported.

Do-not-call lists: the US registry and Brazil's Não Me Perturbe

In the US, the National Do Not Call Registry covers sales calls. The FTC says calls can take up to 31 days to stop, and that companies you recently did business with, or that have your written permission, can still call until you ask them to stop. The FTC page does not say whether the registry covers text messages. We did not review state rules, which can be stricter.

If you contact people in Brazil, the equivalent is Não Me Perturbe (naomeperturbe.com.br), where people ask participating companies to stop telemarketing calls, with up to 30 days for the block to apply. In financial services, it belongs to the payroll-loan self-regulation run by Febraban with ABBC since 2 January 2020, joined voluntarily by banks. Unwanted calls after the block become complaints handled by the banks' ombudsmen, and Febraban's report on 2023 records that agents are not paid for payroll-loan proposals in the name of a registered consumer.

What about WhatsApp? The Brazilian platform's site only mentions calls, and we found no general rule extending the block to messages for other products. For social security payroll loans, the answer changes. IN 138/2022 describes the service as blocking calls and offer messages (art. 34, III, a) and bans any offer 30 days after registration, except for situations the platform provides for (art. 35, I). In our reading, that includes WhatsApp for that product.

In practice, a do-not-call list and WhatsApp opt-in are two separate checks, and one does not replace the other. If someone opted in and also blocked their number, take the question to counsel before making an offer. CCX does not check any of these lists: that matching has to happen in your own database, before you import contacts or send. And being on a list is no guarantee that fraudsters will stop calling.

Financial privacy and cloud: what GLBA, DORA and GDPR ask of a vendor

In the US, the Gramm-Leach-Bliley Act applies to companies offering consumers financial products or services such as loans, financial advice or insurance. The FTC says they must explain how they share information and safeguard sensitive data. The FTC's Safeguards Rule (16 CFR 314) covers institutions under FTC jurisdiction. Banks answer to their own federal regulators, so check the guidance that applies to you. We did not review state law.

None of these rules mentions WhatsApp. The practical point is that a message passes through Meta's global infrastructure, sits on the contracted platform and appears on the phone's lock screen. Whether a balance, an amount or a product name in a message needs specific consent is a question for counsel. Meanwhile, prudence says write the minimum and keep the detail inside the app, even when Meta accepts the text as utility.

The Safeguards Rule asks institutions to select service providers able to protect the data, require those safeguards by contract and reassess providers periodically (314.4(f)). It also asks for access controls, encryption, multi-factor authentication and logging of user activity (314.4(c)). Use this as the base of your questionnaire. The answers on the CCX side are in the Trust Center, including what we do not have.

In the EU, DORA (Regulation 2022/2554) has applied since 17 January 2025 to banks, insurers, investment firms and other financial entities. Article 30 says the contract must describe the services and any subcontracting, name the regions where services run and data is processed, cover data availability and confidentiality, and allow access and return of data. For critical or important functions, it adds audit rights. In our reading, a messaging platform counts as an ICT provider, and you decide how critical it is.

CCX does not have ISO 27001 certification or a SOC 2 report. If your vendor-risk policy requires either, CCX does not meet that requirement today. Take the DORA or Safeguards list to the contract, item by item, and do not assume a standard agreement covers it. If you are a Brazilian institution, the Portuguese version of this guide lists the Central Bank rules (CMN 4.893/2021 and BCB 85/2021, both amended in 2025).

CCX's production database is in São Paulo, Brazil. The declared exceptions are Meta, AI processing in the US, only when a business uses those features, push providers and Cloudflare. So for a US or European institution, your data leaves your country. Under GDPR, a transfer outside the EU has to meet Chapter V (art. 44), and your data protection officer should confirm the mechanism. Article 28 asks for a processor contract with sufficient guarantees, sub-processor authorization and audit support. The data processing agreement is part of the CCX contract.

PSD2 (Directive 2015/2366) asks payment providers to apply strong customer authentication when the payer accesses an account online, starts an electronic payment or takes a remote action that may imply fraud risk (art. 97). A WhatsApp chat does not replace that, which is another reason to verify inside your app. A replacement is on the way: the final PSR and PSD3 compromise texts came out on 23 April 2026, and we could not confirm their publication in the Official Journal.

Bank customer service: agents, complaints and rules on reaching a person

Rules on how customers reach a person vary by country, and we did not review them all. We did not review US federal or state service rules. In Spain, Ley 10/2025 requires a human option on request (art. 8), applies to financial services only as a supplement to sector rules (art. 2.5), and gives companies until 28 December 2026 to adapt. Brazil has a new decree, covered below. Treat these as examples and ask counsel what applies to you.

If you work through agents or brokers, the policy's section 1 already forbids impersonating another business. In Brazil, CMN Resolution 4.935/2021 makes the institution fully responsible for its correspondents (art. 3), and the contract must bar logos similar to the institution's, including on online communication platforms, and require the agent to present itself as a service provider (art. 14). In our reading, a good rule anywhere is a WhatsApp profile in the agent's own name, without the bank's logo.

Complaints are another point to design up front. In Brazil, the ombudsman under CMN Resolution 4.860/2020, as amended in 2024, handles as a last resort what the primary channel did not solve, with a protocol number, a reply within ten business days and records kept at least five years. It cannot sit under sales, risk, audit or compliance (arts. 3, 4, 6 and 7). On WhatsApp, the agent points the customer to that channel. Check your own country's complaint rules before you go live.

Brazil's Decree 13.135 of 9 October 2026, published on 13 October, revoked Decree 11.034/2022 and takes effect 20 days after publication, which by our count is 2 November 2026. It covers suppliers regulated by the federal executive under their regulator's criteria, and financial, payment or credit services through platforms or digital means under Central Bank regulation or supervision (art. 1). Instant messaging counts as an electronic channel when it allows real-time interaction with a person (art. 3, § 2).

In daily operations, that decree means electronic channels on 24 hours, a live person from 8 a.m. to 8 p.m. every day (art. 12), up to five levels to finish a request (art. 13), no advertising at any stage of service (art. 6, I) and no asking the consumer to repeat the request (art. 6, II). The agent must see the history (art. 18, § 1), replies have up to seven calendar days (art. 21) and messages are kept at least 90 days (art. 19).

Offers and sales fall outside that decree's definition of customer service (art. 3, § 4). In our reading, this favors separate queues: service on one side, sales on the other, with no offer in the middle of a complaint. It is a sensible design anywhere. Check retention too. CCX lets you set it from 30 days to 5 years, with a default of 180 days, and automatic deletion is optional. Thirty days would fall short of the decree, and complaint records may need much longer.

CRM for insurance brokers: renewals, pipeline and regulators

Insurance brokers live on portfolios and dates: policy term, renewal, claim, endorsement. A CRM for insurance brokers has to show each customer with what they hold, what is about to expire and who owes a reply. In CCX, you can build this with custom fields and tags on the record, one pipeline per line of business and the conversation tied to the deal. The platform does not issue policies or quote insurance, and the broker's system remains the source.

WhatsApp's policy does not mention insurance. In our reading, term and claim notices fit utility when they are purely informative. Meta says account messages should not promote, cross-sell or try to secure renewals, so “renew here” goes as marketing, to people who opted in to that kind of message. Section 3 bars requesting health information where the applicable rules prohibit it, so a health declaration for life cover should stay out of the chat, in your own form.

The FTC's description of GLBA includes insurance among financial products. Insurance in the US is also regulated by the states, and we did not review those rules. In the EU, DORA's scope includes insurers, and intermediaries should check where they fit. In Brazil, CNSP Resolution 382/2020 deals with conduct principles for insurers and intermediaries. We read law-firm and trade-press summaries and not the official text, so we could not confirm its current wording. Confirm with Susep, the Brazilian regulator.

Brazil's CNSP Resolution 493 of 17 July 2026, published on 21 July, brings together rules on brokers and self-regulatory bodies, revokes 13 resolutions and takes effect 180 days after publication, in January 2027 by our count. In the text we read, there is no rule on brokers' messages or digital channels, and it does not cite Resolution 382. Wherever you operate, if the broker also offers credit or acts as a bank's agent, the banking rules add to the insurance ones.

How the platform can help: customer service in one place, record and pipeline

It is common to see WhatsApp with one team, Instagram with another and the customer record somewhere else. People looking for a customer service platform or a multichannel service system want to fix that. The CCX inbox puts WhatsApp and Instagram in the same live queue. In financial services, the gain is control: one place to see who replied, what was said and where the history is. The difference between the terms is in the omnichannel guide.

Distribution can use round robin by workload, rules by tag, area code and priority, and teams with their own hours, which helps cover your service window. There is SLA by turn, internal notes, saved replies your compliance team can approve first, and a satisfaction survey at resolution. Fraud and lending can be queues with different people, and agents have no per-person cost. The team inbox guide shows how to set up queues and transfers.

The contact record brings a timeline, conversations, notes and tasks, with custom fields and tags. It is what solves, in practice, the problem of asking customers to repeat themselves. Use the record for what the conversation needs: product, service stage, identity-confirmed mark. Balance, account number and ID stay in the core system. The less sensitive data you copy, the smaller the problem if there is an incident.

The CRM pipeline works for lending and insurance with people who already asked to be contacted: request received, terms sent, under review in your system, decision, signed or lost with a reason. Each stage has a probability and a maximum time, there are total and weighted values, and any conversation can become a deal. Credit review, formalization and document upload happen in your system. The WhatsApp CRM guide explains the setup.

Journeys handle alerts: triggers from an event in your system or the API, waits, conditions on delivery, read, click or reply. A backup SMS exists only for Brazilian mobile numbers, so outside Brazil plan another path, such as email or your app's push, under the same consent. Keep any fallback text even shorter, since it stays on the device screen. For a few messages at a set time, the Schedule screen checks approved template, variables, opt-out and a future time.

One point for compliance to read closely. On CCX, someone who replies SAIR, PARAR, PARE, STOP or CANCELAR is unsubscribed, and campaigns stop on every channel. The automatic block does not reach utility and authentication templates sent through the API, because blocking an access code would lock the customer out of their account. Since section 1 of the policy says to respect every request to stop, define in your system what happens to reminders and notices: the platform reports the request by webhook, and the rule to stop sits on your side.

Roles, phone masking and audit trail

The panel has nine roles. The company assigns seven to people it invites, the owner role stays with whoever created the account and the support role belongs to CCX staff. Two-step verification by authenticator app can be required for everyone, a session lasts 15 minutes and renews with use, and logging out or being removed cuts access at once. API keys have scopes, and webhooks carry an HMAC-SHA256 signature.

Phone numbers and emails appear masked for anyone without the full personal data permission, which by default sits with owner and administrator. We checked this in Contacts, campaign results, messages and Schedule. In the scheduling queue, for example, an operator finds the person without seeing the whole number. Before going live, test with a user in each role, including an open conversation in the inbox, where the agent needs to read what the customer wrote.

The audit trail sits in the panel and records, with author and time, invitations, role changes, exports, API keys, integrations, routing rules, retention and views of sensitive messages. CCX support entering an account requires a reason and shows up there too. It covers administrative actions, so do not treat it as a record of every read of every conversation. How long the trail is kept is not in the Trust Center: ask in writing and compare with what your rules require.

The database is in São Paulo, with three replicas. Backup is daily, encrypted and locked against deletion until the retention period ends (8 days for the daily copy, 36 for the weekly and 370 for the monthly), with the last full restore rehearsed on 5 October 2026. HTTPS, encrypted disks and Argon2id passwords complete the basics. Messages export to CSV for people with permission. There is no end-to-end encryption: the platform reads content to deliver, store and show it in the inbox.

Chatbot for banks: what the AI can do and where it stops

A chatbot for banks usually answers fees, hours, where to go and how to open a ticket. The CCX Messages AI agent answers from the company's knowledge base, says it is AI at first contact and hands off to a person when needed. Topics the company lists go straight to the team. Start with a broad list: disputes, fraud, card blocks, complaints, arrears and any question about a contract.

Outside rules line up with this. WhatsApp's policy requires a clear path to a person when there is automation, and Brazil's decree accepts automated procedures, AI included, for triage as long as the option of a live person is guaranteed. Spain's Ley 10/2025 also says bots must offer the human option. The AI agent guide covers the rest. In our opinion, the first version should not look up balances, statements or contracts, even read-only, without a risk review.

The CCX Messages AI is processed in the US by sub-processors listed in the Trust Center, only when a business uses those features. CCX does not train models on conversations, and the sub-processors' use and retention are in the Privacy Policy. This belongs in your cross-border and third-party review. If your review does not accept it, leave the AI off: inbox, CRM and journeys work without it.

Message templates for alerts, reminders and service

These are starting points for your counsel to review. Meta decides the final category. No template asks for data or carries an offer, and variables come from your system. Avoid link shorteners and avoid balances in the message.

Transaction alert: “Purchase of {{1}} approved on the card ending {{2}}, at {{3}}. Not you? Open the {{4}} app and block the card. We never ask for passwords, codes or card numbers here.”

Reminder before the due date: “Hi {{1}}. Your {{2}} statement is due on {{3}}. Amount and payment options are in the app. If you already paid, ignore this. To stop this reminder, reply STOP.” If you use that line, make sure your system really stops sending.

Branch confirmation: “Hi {{1}}. Your appointment at the {{2}} branch is set for {{3}} at {{4}}. Bring a photo ID and do not send documents in this chat.” Buttons: Confirm and Reschedule. The reply reaches your system through the signed webhook.

Security alert: “Notice from {{1}}: there was a new login to your account on {{2}}. If it was you, there is nothing to do. If not, open the app or call the number on your card. We never ask for passwords, codes or tokens.”

When someone asks for or sends sensitive data: “For your security, please do not send card, account or ID numbers, passwords or codes here. To confirm it is you, open the {{1}} app and tap Confirm request. I will carry on with your case, and you will not need to repeat anything.”

Insurance term notice: “Hi {{1}}. Your {{2}} cover ends on {{3}}. If you would like to talk about it, reply here or contact {{4}} at {{5}}.” Pointing to the complaints channel: “I understand this did not solve it. The {{1}} complaints office is at {{2}}. Please keep protocol {{3}}.”

What CCX does not do, and when it is the wrong choice

CCX is not a core banking system. It does not hold accounts, move the institution's customers' money or run financial market messaging. It does not do credit review, identity verification or fraud prevention. It is not a complaints management system. It has no branch calendar of its own. It does not do debt collection. On these points, it talks to your system through API and webhook, or it stays out.

It is the wrong choice if your policy requires ISO 27001 or SOC 2, which CCX does not have. Or if you need end-to-end encryption between customer and agent. Or if the intended use is debt collection, paycheck advances, peer-to-peer lending, currency exchange or crypto. Or if your contract needs regulatory clauses that have not been negotiated. Or if your data must stay in your own country. CCX also does not publish uptime or incident history, which may weigh in your continuity review.

We do not claim here that any bank uses CCX, and we promise no results. The platform can serve an operation that passes this review and wants relationships, service and alerts in one place. If that is your case, start with a low-risk use, such as general questions and appointment confirmations, and send your company's security questionnaire through the channel shown in the Trust Center.

Checklist for compliance before WhatsApp goes live

Products: list each product and message, and cross-check with section 4. Payroll loans, advances, currency exchange and crypto go to a legal opinion first. Opt-in: record where the person agreed, for which categories and how they leave. Lists: match do-not-call lists in your own database when there is an offer. Content: remove balance and detail from the text whenever you can, and keep offers out of alerts.

Verification: choose between template, deep link and logged-in session, and forbid in writing asking for card, account, ID, password or token. Service: check queue hours, the path to a person and reply times against your country's rules. Complaints: define how the agent refers cases, without mixing them with sales. Agents and brokers: check the name, logo and channels on the profile.

Vendor review: rate how critical the service is, ask what your rule requires you to verify, take the contract list to the agreement and decide on the exceptions outside your country, AI among them. Access: test each role, the masking and the trail, and ask how long the trail is kept. Retention: set the period your rules require. Finally, give this material to your counsel: it does not replace their opinion.