AI agent training for risk managers in insurance in Kenya

Kenyan insurance risk managers need to understand an agent well enough to set its limits and test them. Training should cover depth and held actions, especially for claims paid to mobile money wallets, the provenance of medical and motor claim documents, and the Data Protection Act 2019. Risk appetite, fraud conclusions and reports to the Insurance Regulatory Authority stay with people.

What is the risk manager's world in Kenyan insurance?

Kenyan insurers run a wide book: motor, medical, life, microinsurance sold through mobile channels, and bancassurance through partner banks. Medical schemes for employers bring high claim volumes and a steady flow of invoice fraud, from inflated hospital bills to services never rendered. Motor brings staged accidents and disputed assessments.

The risk function maintains the register, runs control self-assessments, monitors claims leakage and fraud indicators, reviews intermediaries and outsourced service providers, and reports to the board risk committee and the regulator. Premiums arrive and claims leave through mobile money as often as through banks, which makes payments fast, convenient and very hard to reverse.

Where do agents make a difference?

1. Medical claims screening, depth 2 to 3. The agent checks each claim against the scheme rules, the member's cover and the provider's tariff, and settles routine outpatient claims within bounds. Claims with mismatched dates, duplicate invoices or unusual provider patterns are held.
2. Fraud indicator reporting, depth 1. The agent reads claims data across schemes and summarises patterns by provider and region for the fraud and risk teams.
3. Intermediary oversight, depth 2. The agent compiles agent and broker performance, complaints and premium remittance timeliness, and drafts the quarterly intermediary review.
4. Risk register maintenance, depth 2. Incidents from claims, IT and finance drafted into the register with a proposed rating, confirmed by an analyst.

Paying a claim to a mobile money wallet is depth 4: the money is gone in seconds. A risk manager should insist those payments are held above a modest threshold, and that a wallet number taken from a message or an emailed form, which is external evidence, can never authorise a payout on its own. The wallet must match a sealed or signed record held by the insurer.

What should risk managers learn, and what stays with them?

Risk managers need to read an agent's record as fluently as a claims file. Each verdict names the bound that decided it: role scope, certificate, sources, the insurer's own limits or the platform guardrails. Knowing which one fired tells you whether the problem is the agent, the data or your own policy. Our guide to how risk managers review an agent's decisions sets out the routine.

They also need to understand provenance. A hospital invoice uploaded by a member is external. A tariff loaded from the insurer's provider contract is signed. A member's cover from the policy administration system is sealed. An agent that confuses these will pay what it should hold.

The approval structure needs to be written down: who may release which held actions, up to what amount. An approver authority matrix for the risk team gives a format.

What stays with people:

• the conclusion that a claim or a provider is fraudulent;
• any decision to decline a medical claim on clinical grounds;
• risk appetite and the decision to accept a known weakness;
• what is reported to the board and the regulator.

What do Kenyan rules ask of the people overseeing agents?

The Insurance Regulatory Authority supervises insurers and intermediaries and expects sound governance, risk management and fair treatment of policyholders. An agent that settles claims is part of the insurer's control environment, and the risk function should be able to show who oversees it and how they are qualified.

The Data Protection Act 2019 governs policyholder and member data, and the Office of the Data Protection Commissioner enforces it. Health data is sensitive personal data under the Act and needs stronger safeguards. The Act also gives individuals rights in relation to decisions based solely on automated processing, so a member whose claim is declined by an agent should have a route to a person. Staff who approve agent decisions need training in what the Act allows, which is covered in more depth in our piece on the Kenya Data Protection Act and training staff who use agents.

Insurers in bancassurance arrangements will also meet the Central Bank of Kenya's expectations through their bank partners. For the AML side of life business, the FATF Recommendations set the international standard on customer due diligence and suspicious transaction reporting.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

A 90-day plan for a Kenyan insurer

First month. The risk team, claims managers and the fraud unit learn the vocabulary: depth, the four verdicts, provenance classes. Inventory each agent and its certificate. Replay three months of medical claims through the claims agent at depth 1 and compare its outcomes with what was paid.

Second month. Write the insurer's own limits for each agent, including the mobile money payout hold and wallet-matching rule. Build the approver matrix. Approvers sit the operator exam; the Operator track of Pryme Intelligence Academy sets its module tests in insurance and in the learner's role.

Third month. Two weeks of logged review decisions on live claims, then a calibration session on twenty held medical claims. Report to the board risk committee which agents act, at what depth, and when their certificates lapse. The broader role map is in AI agent skills by role.