House Committee Says Internal Webull Messages Show China-Based Employee Accessed U.S. Customer Data

The House Select Committee on China has released internal Webull messages it says indicate a company employee located in China had access to U.S. customer account data, directly contradicting the online investing platform's repeated assurances that such access is restricted to U.S.-based personnel.

The messages, which CNBC exclusively obtained from the committee, date to 2021 and were exchanged on Microsoft Teams between Brendan Fuller, a manager at Webull's U.S. brokerage, and an employee named Zhenghan Wang, whose nickname is "Rock."

The select committee concluded that Wang was likely in China at the time of the exchange, citing two pieces of evidence: the messages' time stamps indicated Wang was working daytime hours in Beijing, and his software was set to translate messages into simplified Chinese.

In the thread, Fuller raised concerns about a particular trading account. "We saw these problems ... and approve account," Fuller wrote. Wang replied: "Yes, CIP" — a reference to Customer Identification Program, a U.S. regulatory requirement that financial institutions verify the identities of individuals and entities opening accounts.

The exchange continued with Fuller stating that the account had been approved by "one China team member and one US team." Wang subsequently asked under what circumstances a CIP account could be approved for opening, to which Fuller replied: "I think we just approve them all no matter what."

Wang's final response used "CIP=" followed by Mandarin Chinese characters forming a phrase that translates as "Exists in name only," or "Useless," according to the committee's analysis.

"All the evidence in these text messages points to Zhenghan Wang, a Webull employee, being located in China with access to U.S. customer data at the time he worked for the company," a spokesperson for the select committee said in a statement.

Webull, which counts 28 million users, did not directly respond to questions about Wang's access to U.S. customer data or whether that access contradicted the company's stated data policies. A company spokesperson said, "Webull's U.S. customer data is stored only in the U.S. on AWS servers in Virginia and Oregon, with access to sensitive data restricted to U.S.-based employees."

The spokesperson added: "U.S. broker-dealer operations are directed exclusively by U.S.-based personnel, and no individuals based outside the U.S. have ever exercised operational or decision-making authority over Webull's U.S. broker-dealer business."

Webull also pushed back on the timing of the disclosure. "The Teams messages now being referenced date back to a 2021 routine FINRA matter, which was concluded," the spokesperson said, adding that the release alongside the committee's report "raises legitimate questions about the timing and circumstances surrounding their release."

The new message analysis comes nearly two weeks after the bipartisan select committee issued an Oct. 7 report concluding that Webull is quietly "tied in structural ways" to China's government — a characterization the company has disputed. Webull shares fell more than 19% following that report.

The committee's Oct. 7 report argued that Webull's corporate structure makes its "software development, data pipelines, and core engineering operations" dependent on infrastructure subject to Beijing's laws, which can compel firms to cooperate with the government and mandate data transfers.

On Tuesday, the committee issued a press release titled "The Facts on Webull's Ties to China," accusing Webull of responding to its report with "numerous false statements about its business and its interactions with the Select Committee."

With the November midterms approaching and scrutiny of Chinese-linked technology firms intensifying on Capitol Hill, Webull now faces mounting pressure to provide a detailed accounting of its data-handling practices — particularly around the period covered by the 2021 messages the committee has made public.

Disclaimer