Internal messages released by the House Select Committee on China indicate that a Webull employee in China had access to information regarding a U.S. customer, contradicting the company's assertion that such data is strictly controlled by U.S. personnel. The committee's analysis of the correspondence challenges Webull's previous claims about its data security protocols.
The findings emerged nearly two weeks after the bipartisan committee published a report concluding that Webull, which serves 28 million users, maintains structural ties to the Chinese government that pose a national security threat. Following that Oct. 7 report, Webull shares dropped more than 19 percent. At the time, the company stated that U.S. customer data is stored in the U.S. and that access to sensitive information is controlled by U.S. employees.
The newly disclosed messages were exchanged in 2021 on Microsoft Teams between Brendan Fuller, a manager at Webull's U.S. brokerage, and Zhenghan Wang, an employee nicknamed "Rock." The committee determined that Wang was likely located in China during the exchange, citing time stamps that aligned with daytime hours in Beijing and Wang's use of software to translate messages into simplified Chinese.
In one thread, Fuller discussed concerns involving a specific trading account. Fuller wrote, "We saw these problems ... and approve account." Wang replied, "Yes, CIP," referring to the Customer Identification Program, a U.S. regulatory requirement for verifying customer identities. When Wang asked who approved the account, Fuller responded that it was one China team member and one U.S. team member. Fuller added that the team would "just approve them all no matter what" and then pay for vendors and create reports.
Wang subsequently replied with "CIP=" followed by Mandarin characters translating to "Exists in name only" or "Useless." A spokesperson for the select committee stated that the evidence points to Wang being in China with access to U.S. customer data while employed by the firm.
A Webull spokesperson did not directly answer questions about Wang's 2021 access but reiterated that protecting customer data is central to the company's operations. The spokesperson confirmed that U.S. customer data is stored only in the U.S. on AWS servers in Virginia and Oregon, with access restricted to U.S.-based employees. The company also stated that no individuals based outside the U.S. have exercised operational authority over its broker-dealer business.
Webull criticized the timing of the committee's release, describing the messages as part of a routine 2021 FINRA matter that had already been concluded. The company argued that the release relied on preliminary and outdated information and rejected what it called irresponsible speculation.
In a Tuesday press release titled "The Facts on Webull's Ties to China," the committee accused Webull of making false statements about its business interactions with the select body. The committee clarified that its report does not dispute where data is stored, but rather who can reach it and the systems processing it. It noted that Webull's affiliate, Webull Technologies Limited, previously used Tencent Cloud, a China-based provider, to host certain user data, a fact Webull has not fully addressed regarding the specific data or when that arrangement ended.
Separately from the security dispute, Webull announced on Tuesday that it is partnering with Kalshi, a prediction market platform, to offer perpetual futures to U.S. customers. These financial instruments do not have an expiration date, unlike traditional futures, and the initial offerings will be for cryptocurrencies.