The Nairobi Broker Nobody Sees: What Actually Runs Under IRA

Case 1 — Wanjiku: independent solo broker Nairobi CBD, motor-heavy book of 380 policies

Wanjiku got her IRA broker license in 2014. She'd worked five years as a placing officer at a mid-size broker house on Kimathi Street before going independent with two dozen policies from clients who trusted her personally. Eleven years later she operates from a small two-desk office in the same corridor — herself, her administrative assistant Grace, and a WhatsApp Business account that Grace runs from her personal phone (the tension of this arrangement is a story of its own).

Wanjiku's book is 380 policies, 78% motor (Kenya's Third-Party Only or Comprehensive policies), 12% property (SME businesses and personal home content), 6% medical (individual and family HMO), 4% miscellaneous (marine cargo for one repeat client, professional indemnity for a friend's law practice). Revenue is commission-based — motor policies pay her house typically 15-20% of premium depending on insurer, medical 10-15%, property 15-25%. Annual gross commission revenue supports her practice with modest surplus for reinvestment.

The operational cycle is annual for most policies, with rolling monthly renewal calendar. On any given week Wanjiku is: sending renewal quotes for the 30-40 policies expiring in the next 45 days; comparing quotes across insurers (Jubilee, Britam, ICEA Lion, Old Mutual Kenya, Sanlam Kenya, Madison, AAR, GA Insurance, APA, CIC, Heritage — the working shortlist of insurers she's placed with over the years); coordinating claims for the 3-5 clients with active issues (motor accident with garage assessment, medical pre-authorization with hospital, property claim after burst pipe); handling new business inquiries from Instagram DM and WhatsApp; filing IRA quarterly returns with commission and premium data; reconciling monthly commission statements from insurers.

The technology surface Wanjiku actually uses. IntelliBroker (Kenya-native broker management system) as the core placing system — quote generation across insurers, policy binding, endorsements, renewal alerts. Excel spreadsheets for commission tracking (a mildly embarrassing legacy she keeps meaning to migrate). Personal WhatsApp Business App on Grace's phone for client conversations — the problem being that Grace's personal WhatsApp mixes personal and professional messages, Grace occasionally uses her account after hours, and data protection compliance around this is genuinely weak. Email via Google Workspace for legal-notice communications and policy documents. M-Pesa Buy Goods on Wanjiku's registered broker firm Till Number for premium collection from clients. Wingubox for accounting with KRA e-TIMS integration mandatory since 2024 rollout. Personal LinkedIn for corporate networking.

What Wanjiku's stack does well. IntelliBroker handles the placing workflow appropriately. Wingubox generates e-TIMS invoices correctly to clients. M-Pesa Buy Goods keeps premium collection frictionless for retail clients.

What's broken. WhatsApp on Grace's personal phone is a compliance issue — personal data of clients (identity documents, vehicle information, medical history for HMO clients) flows through an unmanaged channel. When Grace was sick for two weeks in April, Wanjiku had no visibility into pending client conversations. Renewal reminders happen manually — Grace runs a spreadsheet of upcoming renewals and calls or messages clients one by one, and 12-18% of policies still lapse without renewal because Grace or Wanjiku missed the follow-up window. Commission reconciliation with insurer statements is manual, and Wanjiku suspects there's leakage of 2-4% in unreconciled commissions annually.

The path forward for Wanjiku. WhatsApp Business Platform via Africa's Talking (Nairobi-headquartered, understands Kenya insurance context) or via a specialized broker communication platform — moves conversations off Grace's personal phone into an audit-trailed team inbox. Automated renewal reminder sequence at 45, 30, 14, 7 days before expiry with policy details and quote link. Automated commission reconciliation module in IntelliBroker or migration to a system with better reconciliation. Documented Data Processing Agreement with WhatsApp BSP referencing DPA 2019 requirements. Explicit client consent updates for automated communications. Investment: perhaps KES 40,000-80,000/month additional tooling. Payback: recapturing the 12-18% of policies lapsing plus the 2-4% commission leakage plus reduced compliance exposure. Concrete, defensible, financially rational.

Case 2 — Daniel and Faith: boutique broker house Kilimani, 5 staff, mixed 1,800-policy book

Daniel and Faith launched their broker house in 2019 after both spending a decade at larger firms. They started with 400 policies migrated with their departure and grew to 1,800 by mid-2025 with a Kilimani office (three-desk open plan plus a small meeting room), five professional staff (Daniel and Faith plus two placing officers plus one operations coordinator), and growing corporate mid-market accounts.

Their book composition differs from Wanjiku's. Motor is still the largest single category at 40% but medical/health is growing fast at 30% (individual family HMOs plus small corporate group covers), property at 15% (SMEs and residential), life and pension products at 10%, and specialty (marine cargo, professional indemnity, cyber) at 5%. Commission revenue is materially higher than Wanjiku's solo practice, supporting five full-time salaries plus office overhead and reinvestment.

The operational rhythm is different too. Any given week the team is handling: 40-60 policies in renewal cycle at various stages; 15-25 active claims across all product lines; 20-30 new business inquiries with quote comparison across insurers; 3-5 corporate account reviews (annual comprehensive review of small-business client portfolios); one or two IRA regulatory filings (quarterly returns, license renewal, compliance updates); commission reconciliation with 15+ insurers and 3 reinsurers; monthly management review with financial tracking against targets.

The technology surface is more layered. NEXUS Broker or IntelliBroker as the core placing system — richer functionality than a solo practice needs, with team access controls, policy segmentation by client, and integration with major insurer APIs for real-time quotes on motor and medical products. HubSpot Professional as the CRM and marketing engine — automated nurture sequences for prospects, corporate account tracking, integration with placing system for policy history. Xero via a Kenya-authorized accounting partner for full accounting with e-TIMS invoicing and multi-user financial visibility. Africa's Talking bulk messaging for policy renewal reminder SMS (basic phones still exist in some client segments). Respond.io for team WhatsApp inbox unified across the five staff — critical for continuity when someone is out and for supervisor visibility. Zoom for corporate account reviews. Google Workspace for email, document collaboration, meeting scheduling. Docusign or a similar e-signature tool for policy binding documents.

What this stack does well. Team continuity — no client conversation is trapped on one staff member's phone. Policy renewal automation via NEXUS + Africa's Talking + WhatsApp templates — renewal rate improved from ~62% pre-automation to ~78% after. Corporate account visibility for Daniel and Faith who can see the full portfolio at a glance. e-TIMS compliance handled cleanly. Team can hire more junior placing staff without proportionally scaling operational overhead.

What's harder at this scale. Data protection compliance is genuinely complex — 1,800 policies means 1,800+ data subjects with rights under DPA 2019, and building a scalable process for handling access/deletion/correction requests within 30-day statutory windows requires more than "we'll respond when someone asks." ODPC data controller registration is essential given the scale and sensitivity (health data in medical policies, financial data throughout). Cross-border transfer analysis for HubSpot and Xero (US and NZ-parent respectively) requires documented consent from clients or Standard Contractual Clauses equivalents. POCAMLA compliance requires screening business clients against sanctions lists and identifying beneficial ownership — the operations coordinator's role includes running these checks on new corporate accounts.

What Daniel and Faith are working on next. Adding a client portal (via a Kenya-native broker platform or via a portal add-on to NEXUS) so clients can view their policy documents and renewal quotes directly without emailing the office. Integrating premium collection with Pesapal or Flutterwave Kenya for card acceptance on higher-value premiums (M-Pesa Buy Goods works but has per-transaction friction on premiums above KES 70,000). Structured DPA 2019 program with documented consent capture, access request workflow, and quarterly audit. Investment: substantive but scaled to firm size and revenue.

Daniel and Faith's story shows the middle-market pattern: enough scale to justify professional tooling, complex enough to have real compliance obligations, small enough to still be personal in client relationships. The stack has to support this hybrid.

Case 3 — Kimani: corporate-focused broker firm Waiyaki Way, 27 staff, multinational complex-risk book

Kimani's firm was founded in 1997, went through generational transitions, and today Kimani leads it as managing director with 27 professional staff. The office is on Waiyaki Way with a full floor of a mid-rise building, dedicated meeting rooms for corporate client reviews, and back-office staff supporting operations and finance.

The client base is fundamentally different from Cases 1 and 2. Roughly 60% of revenue comes from 20-30 large corporate accounts: multinational offices in Nairobi (Safaricom, Deloitte Kenya, Standard Chartered Kenya, Unilever, various embassies and international NGOs), Kenyan banks (KCB, Equity, Cooperative), government tenders through the Public Procurement Regulatory Authority process, larger Kenyan corporations. The remaining 40% comes from small commercial and high-net-worth individual clients — but this segment is being deprioritized as the firm focuses on high-margin corporate work.

The product mix reflects this. Complex property covers on multinational manufacturing facilities in Athi River and industrial zones. Marine cargo for Mombasa-based exporters and importers. Professional indemnity for large law firms, accounting firms, engineering firms. Group medical for corporate clients with 100-2,000 employees. Directors and Officers (D&O) liability. Cyber insurance (rapidly growing segment). Specialty risks placed with international reinsurers (Munich Re, Swiss Re, Lloyd's syndicates via London brokers). Political risk covers for organizations operating across East Africa.

The operational surface is enterprise-scale. Placing a complex property risk for a multinational manufacturing client might involve: gathering risk information via a corporate client questionnaire; site inspection with the insurer's engineering surveyor; drafting placing slip with technical specifications; approaching six to twelve insurers with negotiated terms; structuring reinsurance layers for the portion exceeding local insurer capacity; drafting the policy wording with insurer legal teams; annual renewal with updated valuations and loss history.

The technology stack is enterprise. Salesforce Financial Services Cloud as the core CRM — configured for insurance broker workflows, integrated with placing systems, contract lifecycle management, corporate client portals. Bespoke or NEXUS-Enterprise placing system with insurer API integrations, complex quote workflow, reinsurance placement modules. Microsoft 365 E5 with security controls demanded by corporate procurement (Advanced Threat Protection, information rights management, retention policies aligned with insurance regulations). SharePoint for document management with granular access controls. HubSpot for marketing to prospective corporate clients (top-of-funnel content, event marketing, conference sponsorships). Zoom Enterprise with security features for corporate client meetings. Docusign Enterprise for high-volume policy execution. Dedicated finance software (Sage Intacct or NetSuite depending on firm's technology heritage) with full IFRS-compliant reporting.

Messaging architecture is different too. WhatsApp Business Platform via a global BSP (Twilio, Sinch, or Infobip enterprise tier) integrated into the CRM — every client conversation is logged, indexed, retrievable. Email dominant for legal-quality communications. Voice calls recorded for compliance and claims coordination. Portal-based document exchange for policy documents and claims files (not WhatsApp — enterprise clients demand controlled document sharing).

The compliance surface is heavier at this scale. Full DPA 2019 program with dedicated data protection officer function (may be part-time role for firms this size or fully outsourced to a legal firm), data controller registration with ODPC updated regularly, comprehensive processing records, data protection impact assessments (DPIAs) for new tools or major workflow changes. POCAMLA compliance with sanctions screening automated via specialized tools (LexisNexis Bridger, Refinitiv World-Check, Dow Jones RiskCenter) as part of onboarding new corporate clients. Regulatory reporting to IRA including specific returns for complex risks and reinsurance placement. Insurance Act compliance including capital adequacy tests (broker minimum capital increased incrementally under recent regulations — verify current levels via IRA). Audit and financial reporting under Kenyan corporate requirements plus multinational client disclosure obligations.

Security posture. Corporate procurement typically requires evidence of information security controls (SOC 2 Type II is aspirational for firms this size, but ISO 27001 or NIST cybersecurity framework alignment is increasingly demanded). Endpoint security across all devices, MFA for all system access, incident response plan documented and tested, third-party risk management program for vendors like SaaS platforms.

What's harder at this scale. Recruiting and retaining professional staff — the market for experienced Kenya insurance brokers is competitive with international firms opening East Africa offices. Balancing firm-level standardization with client-specific customization for large multinational accounts. Managing insurer relationships across 20+ carriers with formal service level expectations. Building successor pipeline as founding-generation partners approach transition.

What's easier. Revenue per client is materially higher. Payment collection is via bank transfer or PesaLink from corporate finance departments — no M-Pesa retail friction. Sophisticated clients have realistic expectations and appreciate professional service delivery.

What all three archetypes share — the Kenya insurance regulatory + fiscal baseline

Regardless of scale, all three broker archetypes operate under a common regulatory frame that sets the operational floor.

Insurance Regulatory Authority (IRA, ira.go.ke). The primary insurance regulator, established under the Insurance Act (Cap 487). Licensing broker firms and individual brokers, supervising insurers and reinsurers, regulating conduct of business, protecting policyholders. Annual broker license renewal is standard, with fees per broker category and continuing professional development (CPD) requirements. Broker firms must maintain minimum paid-up capital per current IRA regulations, appoint a principal officer, carry professional indemnity insurance covering their broker activities, and maintain records for the retention periods specified.

Insurance Act (Cap 487) and Insurance Regulations. The foundational legislation. Successive amendments have modernized broker conduct requirements, capital adequacy, and consumer protection. The Insurance (Broker) Regulations govern broker-client relationships, commission disclosure, complaint handling, and record-keeping. Compliance with IRA Guidelines issued periodically is mandatory.

Consumer Protection. Insurance clients are protected under both the Insurance Act consumer provisions and the Consumer Protection Act 2012 (Act No. 46 of 2012). Disclosure obligations at point of sale (policy exclusions, waiting periods, claim procedures), fair contract terms, right to complain to Kenya Consumer Federation (COFEK) or IRA.

Data Protection Act 2019 (DPA 2019, Act No. 24 of 2019). Office of the Data Protection Commissioner (ODPC, odpc.go.ke) as regulator. Insurance data is particularly sensitive — identity documents, financial history, medical history for health policies, biometric data in some workflows, beneficiary information, claim details. Obligations that broker firms must address: data controller registration with ODPC at the applicable category (mandatory given scale of insurance data processing); lawful basis for each processing activity (consent, contract, legal obligation for anti-money laundering, legitimate interest); privacy notice at collection point; data subject rights (access, rectification, erasure, portability, restriction of processing) with 30-day response window; special category data protection for health information in medical policies; cross-border data transfer basis for US or non-adequate jurisdiction hosted platforms (HubSpot US, Salesforce US, Xero NZ, Twilio US, WATI Hong Kong, Respond.io Malaysia); breach notification within statutory windows.

Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) 2009. Financial Reporting Centre (FRC) as coordinating agency. Insurance brokers are reporting institutions under POCAMLA. Obligations: customer due diligence (CDD) at onboarding and enhanced due diligence for higher-risk clients; identification of beneficial ownership of corporate clients; screening against UN Security Council sanctions lists, Kenyan lists, and international watchlists; ongoing monitoring of business relationships; Suspicious Transaction Reports (STRs) to FRC when triggered; record-keeping for the mandated retention period; internal AML program with designated Money Laundering Reporting Officer (MLRO). Non-compliance triggers regulatory penalties and reputational damage.

Kenya Revenue Authority (KRA). Fiscal frame:

• Corporate Income Tax at 30% for registered companies (most established broker firms). Personal Income Tax for sole proprietors on progressive rates.
• Turnover Tax (ToT) at 1.5% of gross turnover as alternative for smaller operators under the KES 25M threshold — verify current threshold.
• VAT at standard 16% on commission income for VAT-registered brokers (above KES 5M threshold — verify current). Mandatory VAT registration and mandatory KRA e-TIMS electronic invoicing rolled out during 2024.
• PAYE for employed staff, monthly filing.
• NSSF, NHIF/SHA transition per health financing reforms — employer and employee contributions.
• Withholding tax on certain payments to non-resident service providers and independent contractors.

Business Registration Service (BRS) at the Attorney General's office — company incorporation and annual returns.

Kenya Information and Communications Act (KICA) 2013. CAK (Communications Authority of Kenya) governs telecommunications and messaging. Bulk SMS and WhatsApp Business marketing to clients require consent under KICA anti-spam provisions.

Association of Kenya Insurers (AKI) and Association of Insurance Brokers of Kenya (AIBK) — industry associations providing training, market intelligence, member services, and advocacy on regulatory matters. Membership is typical for established broker firms.

The Kenya broker technology stack — real vendor landscape 2026

The technology options that Wanjiku, Daniel/Faith, and Kimani choose from:

Broker management systems (placing, policy binding, renewals):

• IntelliBroker — Kenya-native broker management system with local support and knowledge of Kenya insurer integrations. Suitable for solo brokers through medium broker houses.
• NEXUS Broker — Kenya broker software with modules for team access, insurer API integrations, and reporting.
• Broker specific modules of general platforms — Salesforce Financial Services Cloud (configured for insurance broker workflows) for larger firms with corporate books; HubSpot for broker CRM with less insurance-specific placement functionality; Zoho CRM with insurance-industry configurations.
• International broker platforms — Marsh Sunrise, Aon Zenith, Willis Towers Watson platforms for firms affiliated with international broker networks.
• Kenya-specialized insuretech platforms — Bimastore for retail insurance marketplace with broker features, Turaco for insuretech partnerships, MTEK for digital insurance workflows.

Accounting with KRA e-TIMS integration:

• Wingubox — Kenya-native cloud accounting with strong M-Pesa reconciliation and e-TIMS integration. Suitable for solo through medium.
• Xero Kenya — via authorized Kenya accounting partners with e-TIMS.
• Sage Pastel Kenya — established for larger operators.
• QuickBooks Online — via Kenya authorized partners with e-TIMS.
• NetSuite (Oracle) — enterprise for large broker firms.
• Sage Intacct — enterprise for larger firms with corporate reporting needs.
• KRA eTIMS Lite — KRA's own free tool for smaller taxpayers.

WhatsApp Business Platform BSPs:

• Africa's Talking — Nairobi-headquartered, deepest local integration, understands Kenya context, SMS + USSD + Voice + WhatsApp Business Platform. Preferred for cross-border DPA 2019 minimization.
• Twilio — US-based, developer-first, enterprise-suitable for large broker firms with internal engineering.
• WATI — Hong Kong, WhatsApp-focused inbox with team management.
• Respond.io — Malaysia, multi-channel including WhatsApp + Instagram + Facebook Messenger + email in unified inbox.
• Sleekflow — Singapore/Hong Kong, multi-channel.
• Sinch — Sweden with US operations, enterprise-suitable.
• Infobip — Croatia with US operations, enterprise-suitable.
• Kommo — US/UK with WhatsApp integration and sales funnel orientation.
• Meta Cloud API — direct integration for technical broker firms.
• BossBot — starter tier US$19/month with 7-day trial no credit card.

Payment infrastructure:

• M-Pesa Buy Goods / Paybill for retail premium collection.
• Safaricom Daraja API for STK Push integration with broker management systems.
• Pesapal — Nairobi-headquartered payment gateway with cards, PesaLink, M-Pesa, Airtel Money.
• DPO Group (Network International) — pan-African payment gateway.
• Flutterwave Kenya — pan-African payment infrastructure.
• iPay Africa — Kenya-native gateway.
• JamboPay — Kenya-native payment platform.
• Interswitch East Africa — enterprise pan-African.
• Cellulant — enterprise Kenya-native.
• PesaLink — interbank instant transfer for corporate settlement.
• Traditional bank rails — Kenya Commercial Bank (KCB), Equity Bank, Cooperative Bank, Absa Kenya, NCBA Bank, Standard Chartered Kenya, I&M Bank, Family Bank, DTB, Prime Bank, HFC.

AML compliance tools:

• LexisNexis Bridger — sanctions screening.
• Refinitiv World-Check — sanctions and PEP screening.
• Dow Jones Risk Center — sanctions and adverse media screening.
• Local specialists — Kenya-based AML compliance service providers.

Document management and e-signature:

• Docusign — global leader, enterprise-suitable.
• HelloSign / Dropbox Sign — alternative.
• PandaDoc — proposals + contracts + e-sign.

Meta WhatsApp Business Platform Kenya 2026 pricing (business.whatsapp.com/products/business-platform/pricing — verify current) — Kenya sits in a specific per-conversation rate band across marketing, utility, authentication, and service conversation categories.

Illustrative monthly stack cost.

• Wanjiku's solo practice: IntelliBroker + Wingubox + Africa's Talking + M-Pesa Buy Goods + Google Workspace — typically KES 30,000-60,000/month.
• Daniel and Faith's boutique house: NEXUS Broker or IntelliBroker Team + HubSpot Professional + Xero via Kenya partner + Africa's Talking + Respond.io + Google Workspace + Pesapal for card acceptance + KES 150,000-350,000/month.
• Kimani's corporate firm: Salesforce Financial Services Cloud + specialized placing system + Microsoft 365 E5 + SharePoint + HubSpot Enterprise + Zoom Enterprise + Sage Intacct or NetSuite + Twilio Enterprise + Interswitch + AML screening tools + Docusign Enterprise + ISO 27001 aligned security tooling — KES 1,500,000-4,000,000+/month.

Ranges vary significantly with feature depth, seat count, and negotiation. The point is calibration to firm scale — Wanjiku overspending on Salesforce Enterprise is as counterproductive as Kimani's firm operating on IntelliBroker solo tier.

What NOT to automate + honest KES ROI math per broker archetype

Insurance broker automation has categories that resist automation regardless of scale:

Never automate in any broker archetype.

• Claims coordination for complex or contested claims. A client's motor accident with disputed liability, a medical pre-authorization for expensive treatment, a property claim with insurer's engineering assessment — all require human broker judgment coordinating between client, insurer, and third parties (garage, hospital, adjuster). Template responses damage client relationship at the moment they most need broker advocacy.
• Complaint escalation to IRA or ODPC. Regulatory complaints must be handled personally with documented response. Automated acknowledgment is acceptable; substantive response is not.
• Risk-adverse decisions like declining a client or terminating a policy. Requires senior broker judgment considering commercial and regulatory factors.
• First contact with high-value corporate prospect. Enterprise sales cycle in insurance broking is relationship-driven; template first-touch destroys conversion.
• Sanctions screening final determination. Automated tools flag; humans decide with documented rationale.
• Advice on policy suitability for a specific client situation. This is professional broker advice regulated under Insurance Act; template recommendations create liability and IRA disciplinary risk.

Automate with review.

• Quote generation across insurers for standard products. Auto-generate comparison; broker reviews before sending to client.
• Policy renewal terms. Auto-generate proposed renewal; broker reviews for pricing changes and coverage adjustments.
• Corporate account monthly reports. Auto-generate; account manager reviews before send.

Automate with confidence.

• Renewal reminders at 60, 45, 30, 14, 7 days before policy expiry. Reduces policy lapse rate substantially.
• Confirmation of policy binding and delivery of policy documents.
• Payment confirmations and premium receipts.
• Claims status updates from the broker system to the client during standard workflow stages.
• Regulatory reminder for the broker firm itself (IRA license renewal deadlines, quarterly return deadlines, DPA 2019 registration renewal).
• Marketing content distribution to opted-in prospects — nurture sequences, industry updates, product education.

Honest KES ROI math per archetype.

Wanjiku's solo practice (380 policies): stack investment of KES 30,000-60,000/month against baseline manual operation. Payback from three effects — reduced policy lapse (from 12-18% to 4-7%), reduced commission leakage (from 2-4% to <1%), reduced administrative time for Grace (30-40% reduction in manual renewal chasing). Concrete effect: recovering even 10 additional policies from lapse at average KES 30,000 premium × 17% commission = KES 51,000 additional annual commission per policy, times 10 policies = KES 510,000/year — pays the stack multiple times over. Payback typically within one renewal cycle.

Daniel and Faith's boutique house (1,800 policies, 5 staff): stack investment of KES 150,000-350,000/month. Payback from — team continuity (no policies lost when staff on leave), scalable renewal automation (renewal rate lift from 65% to 78% is worth mid-seven-figure KES annual commission uplift), corporate account discipline (visibility of full portfolio for account manager review), reduced compliance exposure (structured DPA 2019 program vs ad hoc), reduced errors in commission reconciliation across 15+ insurers. Payback typically 60-90 days.

Kimani's corporate firm (large enterprise): stack investment of KES 1.5-4M/month. Payback less about admin efficiency (already lean) and more about — winning corporate procurement RFPs that require demonstrated technology and security capabilities, retaining large clients who demand professional service delivery, reducing security incident risk exposure, enabling scale without proportional headcount growth. Payback measured over 12-24 month strategic horizon rather than short-term tactical.

The theme across archetypes: automation ROI is not primarily about admin time saved. It is about (1) capturing revenue that leaks through operational gaps (policy lapses, commission leakage, missed renewal opportunities), (2) reducing exposure to compliance and regulatory failures, and (3) enabling firm-appropriate scale. Sizing the stack to the archetype matters — an over-scaled stack for Wanjiku destroys her economics; an under-scaled stack for Kimani costs him corporate accounts.