WhatsApp is where most of your UK customers already message. The hard part is not turning it on. It is running an AI agent on the channel that satisfies Meta's policies and UK GDPR at the same time.
AI customer support on WhatsApp is the practice of resolving customer service conversations on the WhatsApp Business Platform using an AI agent that can answer questions, take actions, and escalate to a human, all within WhatsApp's messaging rules. For UK businesses in 2026, doing this well means clearing Meta Business verification, getting consent right under UK GDPR, and understanding the difference between template messages and session messages before you write a single reply.
WhatsApp adoption in the UK is high: Ofcom's Online Nation reporting has consistently shown WhatsApp as one of the most-used messaging apps among UK adults, which is why CX teams keep adding it.
You cannot message a UK customer first without a pre-approved template and a lawful basis for contacting them. Inside a 24-hour customer service window you can reply freely with session messages.
UK GDPR and the Data Protection Act 2018 still govern WhatsApp conversations. Consent, transparency, data minimisation, and a record of processing all apply.
Meta Business verification and a display-name review gate higher messaging limits and the green tick, so start that process early.
For UK financial services, FCA expectations around clear, fair, and not misleading communications and Consumer Duty apply to an AI agent exactly as they apply to a human one.
Last updated: June 2026
WhatsApp is a deceptively simple channel to add and a hard one to run properly. The setup tutorials make it look like a switch you flip. The reality for a UK business is three separate problems stacked on top of each other: Meta's commercial messaging rules, UK data protection law, and, if you are regulated, your sector's conduct rules. An AI agent does not remove any of those obligations. It changes who is accountable for getting them right at scale. This guide walks through each step in the order you actually hit them, from why the channel matters through verification, consent, message types, number migration, conversation design, and where it fits in UK financial services, with a worked example of how the work looks on Lorikeet.
Why WhatsApp Matters for UK Customer Experience
WhatsApp is the default personal messaging app for a large share of UK adults, and that habit carries into how they want to reach businesses. Customers who already live in the app expect to message a company the same way they message a friend: asynchronously, with photos and documents attached, and without sitting in a phone queue. For UK CX teams that means WhatsApp is less a new channel and more a migration of demand that is already happening informally over email and phone.
The channel suits AI resolution unusually well. Conversations are threaded and persistent, so an agent has full context on every message. Customers tolerate a short asynchronous wait, which gives an AI agent room to call an internal system, check an order, or verify an identity before replying. And rich features like buttons, lists, and document upload let an agent collect structured information without a clumsy back-and-forth.
WhatsApp Business Platform: Meta's API-based product (formerly the WhatsApp Business API) for medium and large businesses to message customers programmatically, as distinct from the free WhatsApp Business app aimed at sole traders and very small businesses.
The catch is that WhatsApp is a permissioned channel. You do not own the relationship the way you own your own live chat widget. Meta sets the rules on who you can message, when, and with what content, and it enforces them with quality ratings and messaging limits. That makes the groundwork in the next three sections non-optional.
Step 1: Meta Business Verification and Account Setup
Before an AI agent can send anything, the business behind it has to be set up and, in most cases, verified with Meta. The building blocks are a Meta Business Account (managed in Meta Business Manager), a WhatsApp Business Account inside it, and a phone number registered to that account. You connect to the WhatsApp Business Platform either directly through Meta's Cloud API or through a Business Solution Provider that resells access and handles some of the plumbing.
What Business Verification involves
Meta Business verification confirms your organisation is a real, legally registered entity. For a UK company you will typically provide your registered business name, your Companies House registration details, a business address, and a verifiable phone number or domain. Verification is what unlocks higher messaging limits, additional phone numbers, and eligibility for the official business account display (the green tick), which is reviewed separately and is not guaranteed.
Display name and quality rating
Your display name has to follow Meta's display-name guidelines, which broadly require it to reflect your actual brand. Once you are live, Meta assigns a quality rating to your number based on how customers react to your messages, including blocks and reports. A poor rating throttles your messaging limits, so conversation quality is not just a CX nicety, it directly affects how many customers you can reach. This is one reason an AI agent that consistently sends relevant, wanted, well-timed messages is an asset rather than a risk on this channel.
Start verification early. It can involve document review and back-and-forth with Meta, and you do not want it on the critical path the week you planned to launch.
Step 2: UK GDPR, the Data Protection Act, and Consent
Adding an AI agent on WhatsApp does not change your obligations under UK GDPR and the Data Protection Act 2018. A WhatsApp conversation is personal data processing like any other, and the same principles apply: you need a lawful basis, you must be transparent, you should minimise the data you collect, and you must keep it secure. This section is general guidance, not legal advice, and you should confirm specifics with your own DPO or legal counsel.
Lawful basis and consent
There is an important split. When a customer messages you first to get support, you usually have a clear lawful basis to respond, often legitimate interests or performance of a contract, because they initiated contact for a service reason. When you want to message a customer first, for marketing or proactive outreach, the bar is higher. Under UK GDPR and PECR, unsolicited direct marketing by electronic message generally needs consent, and WhatsApp's own Business Messaging Policy requires that customers have opted in to receive messages from you on the channel. Capture that opt-in explicitly, record when and how you got it, and make it easy to withdraw.
Transparency, data subject rights, and an AI agent
Tell customers they may be talking to an AI agent and how their data is used, typically through your privacy notice linked at the start of the conversation. Honour data subject rights: access, erasure, and objection requests that arrive over WhatsApp count the same as those that arrive by email. Practically, that means your agent needs to recognise a rights request and route it correctly rather than treat it as a generic query.
24-hour customer service window: The period after a customer's last message during which you can send free-form session messages. Outside it, you can only reach the customer with a pre-approved template message.
Data minimisation and retention in practice
Collect only what a query needs. If an AI agent can verify an order with a reference number, it should not be hoovering up unrelated personal details. Set a retention policy for WhatsApp conversation data, redact sensitive fields where you can, and make sure any third party in the chain, including any AI platform you use, processes the data under a data processing agreement with appropriate UK data residency or transfer safeguards.
Step 3: Template Messages vs Session Messages
The single most important technical concept on WhatsApp is the difference between the two message types, because it governs what your AI agent is allowed to say and when. Get this wrong and you either spam customers or fail to reach them.
Session messages
When a customer messages you, a 24-hour customer service window opens. Inside that window you can send free-form session messages: plain text, media, buttons, lists, whatever the conversation needs. This is where an AI agent does most of its work, replying naturally to whatever the customer asks. Every new inbound message from the customer resets the 24-hour clock.
Template messages
Outside the 24-hour window, or to start a conversation, you can only send a template message: a pre-written, Meta-approved message in a defined category (utility, authentication, or marketing). Templates support variables, so a single approved template can be personalised per customer. Utility and authentication templates cover things like order updates and one-time codes; marketing templates cover promotional outreach and require opt-in. Approval can take anywhere from minutes to a day, and templates can be rejected for policy reasons, so build a small library before launch rather than scrambling later.
What this means for AI design
An AI agent should know which mode it is in. Inside the window it converses freely. Outside it, it needs to fall back to an approved template to re-engage, then continue the free-form conversation once the customer replies and reopens the window. Designing your agent around this boundary, rather than fighting it, is what keeps you compliant with WhatsApp's policy and keeps your quality rating healthy.
Step 4: Migrating an Existing Number to WhatsApp
Many UK businesses want to use a phone number customers already recognise, such as a published support line, for WhatsApp. This is possible but needs planning, because a number can only be active on one WhatsApp product at a time.
The two common migration paths
If the number is currently on the free WhatsApp Business app, you migrate it to the WhatsApp Business Platform, which preserves your verified business profile but moves day-to-day messaging to the API. If the number is on personal WhatsApp, you first delete that WhatsApp account on the number before registering it on the platform. Either way, plan for a short window where messaging is interrupted, and tell customers if the number is a live support line.
Practical migration checklist
Confirm the number can receive an SMS or voice verification code during registration.
Decide whether to use the Cloud API directly or go through a Business Solution Provider, and complete that setup before you migrate.
If moving from personal WhatsApp, export anything you need first, because the account on that number is deleted in the process.
Schedule the cutover for a low-volume period and have a human team on standby for the first conversations.
Re-verify the business and re-submit display name and templates as needed on the new setup.
If you do not need the legacy number, registering a fresh dedicated number is simpler and avoids the interruption entirely. Many teams keep their voice line separate and stand up a new WhatsApp number rather than migrating.
Step 5: Conversation Design for an AI Agent on WhatsApp
WhatsApp rewards a different conversational style than a website chat widget. Replies are read on a phone, often glanced at between other things, so the design has to be tight, structured, and honest about what the agent can do.
Principles that work on the channel
Open by identifying the business and noting that an AI agent is helping, with a link to your privacy notice.
Keep messages short. Use WhatsApp's interactive buttons and list messages to offer choices instead of asking the customer to type long answers.
Resolve, do not just deflect. The point of an AI agent is to verify the order, process the change, or answer the question end to end, not to push the customer to a web form.
Make escalation to a human obvious and fast. A customer who asks for a person should get a clean handover with full context carried across, not a loop.
Respect the asynchronous nature of the channel. It is fine for the agent to say it is checking something and follow up, as long as it stays inside the window or uses an approved template.
Designing for actions, not just answers
The conversations worth automating are the ones where the agent does something: checks a delivery, resets a setting, processes a refund, verifies identity. That requires the agent to call your internal systems mid-conversation, handle an error if a system is slow or down, and confirm the outcome to the customer. An agent that can only answer FAQs will frustrate customers who came to WhatsApp expecting their actual problem to get solved.
Where AI on WhatsApp Fits in UK Financial Services
UK financial services is where WhatsApp gets most interesting and most demanding. Banks, lenders, payments firms, and insurers have customers who would happily message them, and conduct rules that mean every message has to be right.
The conduct overlay
FCA principles require communications to be clear, fair, and not misleading, and Consumer Duty raises the bar on delivering good outcomes and supporting customers, including those in vulnerable circumstances. An AI agent on WhatsApp is subject to all of it. That means scripted disclosures where they are required, careful handling of anything that could constitute advice or a regulated activity, and the ability to recognise a vulnerable customer and route them appropriately rather than pushing through a scripted flow.
Record-keeping and supervision
Regulated firms have to keep records of customer communications, and WhatsApp conversations are no exception. You need a durable, retrievable record of what the agent said and did, including the tool calls it made and the reasoning behind a decision, so compliance can review it and reconstruct it if a regulator asks. This is the difference between a chatbot that hands you a transcript and a platform built so your compliance team can sign off before launch and audit after.
Identity and authentication
Because financial workflows touch money and sensitive data, the agent has to authenticate the customer before acting and apply dollar-equivalent thresholds and approval steps for high-risk actions. WhatsApp's authentication templates support one-time passcodes, and a well-designed agent verifies identity before it does anything consequential.
How This Looks on Lorikeet
Lorikeet is an AI customer support platform built for complex and regulated businesses, including UK financial services. It runs AI concierges that resolve issues end to end across chat, email, voice, SMS, and WhatsApp on one workflow engine, so the same agent and the same logic handle a customer whether they start on WhatsApp or call the support line.
For the WhatsApp-specific problems in this guide, three things matter. First, workflows are defined in plain English using natural-language and deterministic structured workflows together, so the conversation design, the actions the agent takes, and the escalation paths live in one place your team owns. Second, the platform is built around defence in depth: pre-launch adversarial simulations to test the bad paths before go-live, inbound message checks, outbound guardrails, and 100% post-facto QA through Coach, Lorikeet's analytics-and-QA agent. That maps directly onto the FCA record-keeping and supervision points above. Third, on compliance posture, Lorikeet is SOC 2 audited, GDPR-aligned, supports PII redaction and role-based access, and offers UK data residency, which supports the UK GDPR obligations a financial services firm carries onto the channel. These features support your compliance obligations rather than discharge them, and your DPO and compliance team should still review your specific deployment.
On pricing, Lorikeet charges per resolution rather than per seat: roughly $0.80–$0.95 per chat, email, or SMS resolution, around $1.20–$1.50 per voice resolution, and about $0.25–$0.30 per ticket for Coach. Escalations to a human are not charged, and the customer defines what counts as a resolution. Against a typical human-handled ticket cost of roughly $1.25 to $4, the per-resolution model is what makes scaling a channel like WhatsApp economic. A regulated fintech running Lorikeet has reached around 85% automation with equal or better CSAT, which is the kind of outcome a well-designed WhatsApp deployment is aiming for.
Lorikeet is not the right fit for every business. If you are a sole trader who needs a simple shared inbox, the free WhatsApp Business app is enough and a platform like this is overkill. Lorikeet earns its place when the conversations are complex, the actions are consequential, and your compliance team is the toughest stakeholder in the room.
Key Takeaways
WhatsApp is a high-adoption UK channel, but it is permissioned: Meta sets the rules on who you message, when, and with what, and enforces them with quality ratings and messaging limits.
Start Meta Business verification early. It gates higher messaging limits, extra numbers, and the green tick, and it can involve document review and delay.
UK GDPR and the Data Protection Act 2018 apply in full. Customer-initiated support has a clear lawful basis; proactive outreach generally needs consent and an opt-in under WhatsApp's policy and PECR.
Master the message-type split: free-form session messages inside the 24-hour window, pre-approved template messages to start or re-open a conversation.
For UK financial services, FCA clear-fair-and-not-misleading expectations, Consumer Duty, record-keeping, and customer authentication all bind the AI agent exactly as they bind a human one.
If you are evaluating AI customer support on WhatsApp for a UK business, book a Lorikeet demo and bring your hardest conversations and your compliance lead.
