Insurance in a partner's app: what to decide to open the channel with operational and regulatory control

Imagine that the commercial director of a retail chain proposes something simple to its insurer: offer, in the shopping cart, protection for the phone the customer is buying. One click, a premium collected together with the purchase. The insurer says yes. Months go by and the project is still in meetings, and not for lack of will. The quote lives in a system that responds in batches. The policy is issued in another, with a number the partner cannot see. The payment lands in an account different from the merchant's. And the claim notice, if one occurs, comes in through a phone line the customer does not know exists.

That distance between "yes, let's sell it" and "it is now on sale" is the subject of this article. It is for whoever answers for distribution, operations or technology at an insurer, and for whoever, at a bank, a fintech, a retail chain or an online store, is evaluating offering insurance to their customers.

Why partners are the way in

Insurance penetration in Mexico remains low, and the official data say so plainly. In the 2024 National Financial Inclusion Survey (Encuesta Nacional de Inclusión Financiera, ENIF, from INEGI, Mexico's statistics institute, and the CNBV, the banking and securities regulator), 22.9% of the population aged 18 to 70 held some kind of insurance, 1.9 percentage points less than in 2015. By type, 13.9% held life insurance, 11.5% auto and 7.5% medical expenses [1]. On the industry side, the AMIS (Mexican Association of Insurance Institutions) reported (an association figure) that annualized direct premium stood at 2.85% of GDP in the third quarter of 2025, compared with 2.47% in the same quarter of 2020, in an industry approaching 3% of the economy [2].

Growing, then, is not only a matter of more agents or more branches. Part of the opportunity lies in the places where customers already buy, pay and get informed: their bank's app, their fintech's wallet, the store where they buy an appliance, the site where they book a trip. There, insurance is offered at the moment the need is understood, not days later on a phone call.

This article does not use a figure for the volume of premiums placed through this route in Mexico, because we found no verifiable public source to cite, and we will not invent one. What does exist are public cases. Mercado Pago told El Economista, in June 2025, that it offers protections with Assurant, Chubb and Prudential under a mixed scheme: on Mercado Libre the insurers sell directly, and on Mercado Pago the company acts as an agent; the premium is charged automatically from the app, and it said it is incorporating digital agents in claims handling [4]. BBVA, for its part, presented Club Seguro in August 2026, a vehicle insurance scheme for groups of four to ten units, based on the principle of mutuality, contracted online, and allowing claims to be reported from its app [5]. It is a different model from selling an insurer's policy inside an app, but it points to the same fact. They are not examples to copy: they are public signs that market participants are testing the offer and servicing of insurance inside digital channels their customers already use.

What the regulation says about selling through third parties

Whoever asks "is it allowed?" finds that the Ley de Instituciones de Seguros y de Fianzas (LISF, the Insurance and Surety Institutions Law) already provides for distribution through third parties. What follows is a business reading, not legal advice; confirming it for your product and your partner is the job of your legal department. In the text of the Law currently in force [3]:

• Agents. Insurance agents may collect premiums only against the receipt issued by the insurer, and must remit what they receive to the institution within a maximum of ten business days; premiums collected this way are deemed received directly by the insurer (art. 99). The insurer pays agents commissions only on premiums that have actually been remitted (art. 101).
• Legal entities without an agent. For insurance formalized through an adhesion contract, contracting may be done through a legal entity (persona moral), without an agent's involvement, except for pension insurance arising from the social security laws and surety insurance (seguros de caución) (art. 102). It is the arrangement usually thought of for a retailer or a platform.
• Contract registered with the CNSF. To pay or compensate that legal entity for services other than those reserved to agents, the insurer signs a services agreement whose text must be registered beforehand with the Commission (the CNSF, Comisión Nacional de Seguros y Fianzas, the insurance regulator), which has 15 business days to refuse it or order changes (art. 102). The legal entity is subject to the CNSF's inspection and oversight with respect to those operations. The CNSF's Circular Única de Seguros y Fianzas (its single body of insurance and surety rules) specifies that the model of that agreement is registered before it is signed and what it must contain, including the terms on which the insurer receives premiums (provisions 33.1.1 and 33.1.2) [6].
• Training and conflicts of interest. The rules depend on who the partner is (art. 103). If it is a supervised financial intermediary, such as a bank, training is set in the contract with the insurer or, for products with a savings or investment component, in a program the insurer registers with the CNSF. If it is another legal entity, such as a retail chain, the CNSF sets by general provisions when its staff must be trained or must demonstrate their knowledge through an evaluation, and what measures prevent conflicts of interest when it sells products from more than one insurer. For that second case, the Circular Única requires as a rule that employees demonstrate their knowledge through the CNSF's evaluation. Only in limited cases does it accept instead the training given by the insurer (sales exclusively by telephone, microinsurance, and the compulsory vehicle third-party liability insurance of the federal roads law, in its minimum form), and it exempts those who already hold an agent's licence (chapter 33.2) [6].
• The insurer is responsible. It is liable for damages caused to policyholders, contracting parties or beneficiaries by the conduct of those legal entities (art. 104).
• Information to the public. Insurers, agents and those legal entities must disclose information about their operation, in the form the CNSF determines by general provisions (art. 105).

Three clarifications. First, on personal data: when the customer's data originates in the partner's channel, your legal department should define who is responsible for processing it and which privacy notice is shown; we do not analyze that here. Second: the Law refers to the CNSF's general provisions for the details. How consent is documented by electronic means, what is delivered to the contracting party and when are matters for those provisions (in the Circular Única, among others, chapters 4.10, 4.11 and 33.4) [6], which your compliance area will need to review for each product. In an electronic channel, that review includes authentication, receipts, notifications and information security (chapter 4.10), as well as the consent and the evidence the area decides to keep. And when the premium is charged to a bank account or card, the Circular Única requires the contract to provide how the policy is delivered, the alternative means of obtaining it and the mechanism to cancel or not renew, and requires that, at contracting, the policy number, the product details and the insurer's contacts for claims, complaints and its specialized unit be provided (chapter 4.11) [6]. Third: the exact scope of the customer identification and anti-money-laundering obligations between insurer and partner depends on several rules at once, and we do not treat it as settled here.

There is also a risk that is not technical but commercial: the partner, pushed by a sales target, may make one product conditional on another. The Circular Única requires the legal entity to respect the public's freedom to choose the insurer and the product (provision 33.1.4) [6]; and if the partner is a financial entity, such as a bank, a sofom (a non-bank lender) or a fintech institution, or a commercial company that habitually grants credit, the Ley para la Transparencia y Ordenamiento de los Servicios Financieros (the Financial Services Transparency and Ordering Law) prohibits it from making a financial operation or service conditional on contracting another; if it offers the customer a linked product, it needs the customer's express consent and must inform them that they may contract it with an independent third party (art. 23 Bis) [7]. It is a practice worth watching from the design of the channel, making sure customers can choose a product without another being imposed on them, not after the first complaint.

The technical challenge: what the customer never sees

For the customer, buying insurance inside an app is four screens. For whoever operates it, it is four systems that have to say the same thing in the same second.

1. Quote

The partner asks for a price and needs it while the customer is still on the screen. That requires that rates, underwriting rules and agreement discounts come from a system that responds in real time, not from a file that someone updates at month end. And it calls for a controlled way to add a new rate or a partner-specific rule, so that each onboarding does not depend on a separate development: if each new partner is a new development, the commercial advantage is lost in the IT queue. Before committing to a commercial date, the committee should identify which adjustments require technology work, which require actuarial or legal approval, and what evidence will be kept. Any adjustment must go through the actuarial and legal review that applies, and adhesion-contract products offered to the public, with their clauses and endorsements, require prior registration with the CNSF (LISF, arts. 202 to 204 [3]); the competent area must determine whether a change of rate, rule or document makes it necessary to update that registration.

2. Issue

The policy, its number, the cover page and the terms and conditions must originate in the insurer's system and return to the partner without being retyped by hand. Here the first audit trail requirement appears: which product, which version of the rate, which rules were applied and what the customer was shown before accepting. If a complaint arrives six months later, that evidence cannot be reconstructed from memory.

3. Collect

The premium may come in the cart, as a recurring charge or in the partner's wallet. Each variant can change the moment at which the insurer "receives" the premium. The collection design must document when the premium is considered paid, who receives the funds, what receipt is delivered and how the movement is reconciled; depending on the legal structure, the product and the applicable contract, that can affect the policy's effective period, reconciliation and the channel's compensation. With an agent, the Law already says when the premium is considered received and when its commission may be paid (arts. 99 and 101 [3]); with a legal-entity partner, the Circular Única requires the contract to set the terms on which the insurer receives premiums and to state that, if the partner collects them, they are deemed paid to the insurer from the moment the customer hands over the money, even if the partner is late in remitting them (provision 33.1.2) [6]; the timing of the commission depends on the contract, and it is advisable to leave it in writing. On the other side is reconciliation: the collection made by the partner must be matched against the issued policy, against the premium remitted to the insurer and against the commission, each movement with the tax documentation that applies to the collection structure. A one-day gap between systems, multiplied by thousands of small policies, can become manual work.

4. Handle the claim

This is where the customer decides whether to recommend the product. Where the service model allows it, the partner's channel can be an entry point for the notice and the follow-up, because that is where the customer already is, without forcing them to learn another phone number. That does not replace the insurer's own contact details for claims and complaints, which must be given to the contracting party in the cases the Circular Única provides for (chapter 4.11) [6]. All of this requires the partner's app and the claims system to talk to each other, and every step to be recorded: when notice was given, who responded, how quickly.

Scenario (illustrative figures, no client). A mid-sized insurer opens an agreement with an online store chain that sells 3,000 phones a month. If 5% of buyers accept the protection, that is 150 new policies a month, each with its monthly premium. With three such partners, it is 450. If every policy requires a person to review the issuance, reconcile the collection and correct the policy number when it does not match, the team does not grow at the pace of the agreement: it becomes the bottleneck. If, instead, rate, issuance, collection and audit trail are connected, one person's work concentrates on the exceptions.

The piece that makes all of the above possible

The four steps share one need: that product and rate rules live in a place that can be queried, changed and audited, instead of being spread across a quoting system, a conditions document and the memory of two people. The four steps also require controls over changes and enough evidence to answer a clarification request, an audit or a regulatory review. The committee should assess whether it has those capabilities today and where the gaps are.

Five questions for your next committee

1. Under what arrangement will we sell through the partner, agent or legal entity with a registered contract, and who on the legal team has already confirmed it for this product?
2. How long does it take us today to set up a new rate or a new agreement, and who does it? If the answer requires software changes, it is worth quantifying scope, dependencies and owners before committing to the channel.
3. If a customer complains six months later, can we show which product, which rate and what information they saw when they accepted, without searching three systems?
4. Do we know at what point a premium is considered remitted and when a commission is paid, and does our reconciliation reflect it?
5. Can the customer start a claim notice from the partner's channel, where the model allows it, and also reach the insurer's direct claims and complaints channels? Would it be recorded how long we took to respond?

If two or more answers are "I don't know," that is a signal to start with a diagnosis of dependencies, evidence and responsibilities, before choosing a partner or a commercial date.

Where to start this week

You don't need to start with a project. You need a one-page map with a single simple product, for example protection for an item sold online. Draw the steps that occur from the moment the customer sees it until, if one occurs, they report a claim: where the price is calculated, where it is issued, where it is collected, where the commission is invoiced and through where the notice comes in. Mark each point where someone types, exports a file or waits for a batch. Those points show where the costs, risks and dependencies of opening a channel lie. With that map your committee can decide which partner and which product to open first, with owners and decision criteria defined, rather than an undated "pilot."

What Hábil does

Hábil works with insurers and distribution partners who need to evaluate a new channel without losing visibility over product, collection, service and evidence. Depending on the priorities of the case, the conversation can include Pauta, for configurable products and pricing; Cuadre, for collection, receipts and reconciliation; and the page Unify your operations and your channels, for joining your systems and your partners'. The scope, responsibilities, integrations and success criteria are defined with your team for each case.

The first assessment conversation is at no cost: you leave with a first map of your integrations and, depending on what you share with us about your operation, the points where money, time or evidence is probably being lost. Write to us on WhatsApp.