Most businesses that sell through WhatsApp treat it like SMS—quick, high-open-rate, done. They miss the hard part: a compliant pipeline that routes conversations to the right rep, holds audit trails for regulators, and actually deposits money without three different tools leaking data between them. In Malaysia and Singapore, PDPA isn't optional, and LHDN (or IRAS) will ask to see your records. A WhatsApp conversation that improves open rates by 80% but breaks your audit trail costs more than it saves. This playbook walks you through building one that doesn't. PDPA opt-in: Templates that pass the 14-point check The first compliance rule is the hardest: you need affirmative opt-in before you send a sales message to anyone. Not a checkbox they scrolled past. Not bundled with terms. A deliberate "yes, contact me on WhatsApp about your quote." Here's what regulators actually enforce: The message must name the purpose. Not "updates" or "news." Say: "sales follow-up about your May quote" or "invoice and payment reminders." PDPA enforcers in Malaysia reject vague language. Opt-in must be separate from any other agreement. If you bundle WhatsApp consent into a terms-of-service checkbox, regulators will argue they didn't opt in—they just ticked a box. Use a dedicated button or SMS code. Store the consent record with a timestamp. LHDN audits will ask: "When did they consent?" A screenshot of a WhatsApp conversation doesn't count. You need a database record with date, time, IP, and the exact message they saw. Provide an easy unsubscribe in every sales message. "Reply STOP to opt out." Regulators check this; if they find one message without it, they'll flag the whole campaign. Here's a template that passes audit: Hi [Name], we have your quote ready. We'll send updates on this quote via WhatsApp—is that OK? Reply YES to continue, or STOP to use email only. That's it. No link. No "agree to terms." Just the purpose and two buttons. When they reply YES, log that timestamp and the message text in your CRM immediately. If LHDN comes asking, you show them a database record—not a screenshot. The second layer: Don't send sales messages outside business hours. Malaysia's PDPA doesn't ban evening messages, but LHDN's guidance is clear—treat them like spam if you send them at 11 PM. Sales messages should land between 9 AM and 6 PM, Monday to Friday. Your CRM's automation engine can enforce this; no rep should be sending quotes at midnight. Message routing that stops fragmentation The moment you have three sales reps, WhatsApp fragments. One customer talks to Rep A on WhatsApp, Rep B on email, and Rep C sees nothing. Your audit trail splits across three apps. Regulators hate this. So does your close rate. The fix: Route WhatsApp conversations into a single unified inbox that locks to a deal in your CRM. When a customer replies to a WhatsApp quote link, that conversation doesn't live in their phone—it lives in your system, assigned to the owner of that deal. Here's the routing logic: Customer replies to a quote or booking link. That link is tagged with the deal ID and customer record in your CRM. The WhatsApp message arrives at your unified inbox. Your system matches the phone number to the customer, then to their deal. The message is routed to the rep who owns that deal. Not a shared team chat. Not a queue. One rep owns the conversation. Every message is logged to the deal's audit trail —not just in WhatsApp, but in your CRM's contact history . LHDN will see the full thread, with timestamps, sender, and decision. This prevents the fragmentation nightmare where Customer X has four conversations live at once. It also means you can see at a glance: "How many WhatsApp replies did we get on this deal?" and "Did we follow up within 24 hours?" Regulators ask these questions in audits. A concrete example: A customer in Kuala Lumpur fills out a quote request on your website at 2:14 PM Tuesday. Your system creates a deal (Quote #4521) and sends a WhatsApp message: "Hi Fatimah, we have your quote ready. Check it here [link]". That link embeds the deal ID. When Fatimah replies "Can you add 5 more licenses?," the system: Receives the message at 2:47 PM Matches the phone number to Fatimah's contact Routes it to Sarah, the rep who owns Quote #4521 Logs "Customer asked to add 5 licenses" to the deal's timeline Sends an internal notification to Sarah in your unified inbox Fatimah sees one conversation. Sarah sees one conversation. Your audit log shows every message. No fragmentation, no missing replies, no compliance gaps. The three-message deposit sequence that banks will clear Once the customer is ready to buy, timing matters. A WhatsApp message at the right moment—with a deposit link and clear next steps—converts better and avoids the "we sent it via email but they didn't see it" excuse. Here's the sequence that works: Message 1: The offer (when deal moves to "Ready to Quote") Hi Fatimah, your final quote is ready: [total amount] due [date]. [5-s