WhatsApp for immigration consultants: a compliant client-messaging playbook

For many immigration clients, WhatsApp is the first channel they try and the one they answer fastest. That makes it valuable for a consultancy — and risky. Conversations sit on personal phones, files arrive with no label, promises are made in voice notes, and when a counsellor leaves, the history leaves with them. This playbook sets out how to run WhatsApp as a firm rather than as a collection of individuals, without breaking WhatsApp’s rules or your own professional obligations.

Why WhatsApp needs a written policy

Email has decades of office habits around it: shared mailboxes, signatures, retention. WhatsApp usually has none. Before choosing tools, write down answers to five questions:

1. Which number do clients message, and who owns it — the firm or a staff member?
2. Who is allowed to reply, and who is responsible for each conversation?
3. What may and may not be discussed or sent on WhatsApp?
4. How do documents and decisions get from the chat into the client file?
5. What happens to conversations when someone leaves the firm?

If the honest answer to the first question is “each counsellor’s own phone”, the rest of the policy is hard to enforce. That is why the product choice below matters.

WhatsApp Business app vs the Business Platform (Cloud API)

Meta offers two broad ways for a business to use WhatsApp. They suit different stages of a practice.

A sole practitioner who personally answers every message can work well with the Business app. Once two or more people reply to clients, or you want WhatsApp history attached to the client file, the Business Platform is usually the better fit. Avoid unofficial tools that automate WhatsApp Web or a personal account: they break WhatsApp’s terms, can get the number banned, and give you no reliable record. Check Meta’s current documentation for pricing and eligibility, as both change.

Move from personal phones to a shared inbox

A shared inbox means one firm-owned number, with every conversation visible to the people who need it. To make it work:

• Claim before replying. One person takes a conversation so two colleagues do not answer the same client with different information.
• Link every conversation to a lead or case. A chat with no client record attached will be forgotten.
• Use one business profile. Firm name, logo, website and office hours — not a staff member’s photo.
• Retire personal numbers for client work. Give clients the firm number on business cards, retainers and email signatures, and redirect anyone who messages a personal phone.

The 24-hour customer service window

On the Business Platform, when a client messages you, a customer service window opens for 24 hours from their last message. Inside that window you can reply freely with text, images and documents. Once it closes, you can only start a conversation with an approved message template, and the client must reply before free-form messages are possible again.

In practice this changes how teams work:

• Answer new messages the same day. A reply sent after the window closes needs a template, which is slower and more formal.
• When a client goes quiet, use a short utility template — for example “We have an update on your file. Reply to this message to continue.” — rather than trying to send the update itself.
• Do not use templates to work around the window for chat-style back-and-forth. That is what the window is for.

Message templates that get approved

Templates are reviewed by Meta before you can use them, and they are categorised (for example marketing or utility). A few habits make approval smoother and keep your messages useful:

• Write one template per purpose: appointment reminder, document request, payment reminder, “please contact us”.
• Keep variables obvious and few — client first name, appointment date, firm name.
• Identify the firm clearly and avoid anything that reads like a guarantee (“your visa is approved”, “100% success”). That is a professional-conduct issue as much as a WhatsApp one.
• Do not label a promotional message as a utility message. Mis-categorised templates can be rejected or re-categorised.
• Keep a register of approved templates with who wrote them and when they were last reviewed.

Opt-in, consent and broadcasts

WhatsApp’s business policies require that people opt in before a business messages them on WhatsApp, and Canada’s anti-spam legislation (CASL) generally requires consent for commercial electronic messages, along with identification and an easy way to unsubscribe. The two overlap but are not identical, so treat them separately.

Collecting opt-in

• Ask at intake with a clear, unticked checkbox: “I agree to receive updates about my enquiry and related services from [Firm] on WhatsApp.”
• Record when and where consent was given, and by whom — the form, the date, the wording.
• Separate service messages about an active file from marketing messages. Consent to one is not automatically consent to the other.

Running broadcasts responsibly

• Send only to contacts with a recorded opt-in. Never upload a purchased or scraped list.
• Make each broadcast relevant to the audience — a program change that affects study permit holders goes to study permit holders, not everyone.
• Send in batches and watch for blocks and reports. Numbers that are frequently reported can have their messaging limits reduced.
• Honour “stop” requests immediately and record them.

Consent rules have exceptions and detail that matter. Check with a lawyer or your regulator before running marketing campaigns.

What not to send over WhatsApp

WhatsApp is encrypted in transit, but messages also live on the client’s phone, may be backed up to their cloud, and may be seen by family members who share the device. Set firm-wide limits:

• No full identity documents from staff to client. Send passports, completed forms and application copies through a secure portal or encrypted email instead.
• No account credentials. Never ask for or send government portal passwords or security answers.
• No substantive advice in voice notes. If advice matters, put it in writing in the file, then summarise on WhatsApp.
• No fee agreements by chat. Fees and scope belong in the signed retainer, not a message thread.
• No outcome predictions. “Looks good” in a chat can be read later as a promise.
• Care with third parties. Confirm you are speaking with the client, or with someone the client has authorised, before discussing their file.

Getting documents out of the chat and into the file

Clients will send passport photos and bank statements on WhatsApp whatever your policy says. Plan for it:

1. Save every document received to the client’s file the same day, named against the checklist item it satisfies.
2. Reply to confirm receipt and say what is still missing.
3. For anything sensitive or large, point the client to your secure upload link next time.
4. Do not leave files only in phone galleries or download folders — remove local copies once filed, according to your retention policy.

Our guide to immigration client document checklists covers how to structure the checklist those files belong to.

Team rules worth writing down

• Office hours and an automatic away message stating when you will reply.
• A target first-reply time during office hours, measured weekly.
• Who may send templates and broadcasts (usually fewer people than who may reply).
• A sign-off convention so clients know who they are speaking with.
• Escalation: which questions must go to a licensed consultant or lawyer rather than front-desk staff.
• Tone: professional, plain language, no emoji-only replies to serious questions.

Record keeping and staff changes

Your regulator expects you to keep adequate client records, and a WhatsApp thread can contain instructions, admissions and advice. Decide how long conversations are retained and who can export them. When a team member leaves, their access to the shared inbox should end the same day and their open conversations should be reassigned — something only possible if the number belongs to the firm. Check record-keeping requirements with your regulator.

A rollout checklist

1. Move client messaging to one firm-owned number on the Business Platform.
2. Write the policy: who replies, what not to send, escalation.
3. Add WhatsApp opt-in wording to every intake form.
4. Draft and submit your core templates.
5. Train staff, then retire personal numbers for client work.
6. Review response times, templates and consent records every quarter.

How ImmiPractice handles this

ImmiPractice connects a WhatsApp Business number through Meta’s official Cloud API using Embedded Signup. Conversations appear in a shared inbox linked to leads and cases, where staff claim a conversation and reply with text, images or documents inside the 24-hour window. Templates can be created and their Meta approval status checked from the CRM, and broadcasts go only to contacts who have opted in, in batches, with consent recorded per contact. Documents received on WhatsApp can be saved to the case, and only the Business Admin can connect or disconnect the number. It requires a WhatsApp Business Platform number and Meta approval; Meta’s Cloud API does not support posting Status updates. See WhatsApp inbox & broadcasts and team permissions.

This guide describes practice workflow and is not legal advice. Immigration rules change; confirm current requirements with official government sources and your regulator.