House committee messages suggest China-based Webull employee had access to U.S. customer data

The messages, obtained exclusively by CNBC, were sent on Microsoft Teams in 2021 between Brendan Fuller, a manager at Webull's U.S. brokerage, and Zhenghan Wang, an employee nicknamed "Rock." The committee says Wang was likely in China at the time. In one exchange, Fuller wrote about concerns involving a particular trading account: "We saw these problems ... and approve account." Wang replied, "Yes,CIP." CIP refers to Customer Identification Program, a U.S. regulatory requirement that financial institutions verify the identities of people and entities opening accounts.

Fuller then wrote that the account had been approved by "One China team member and one US team." Wang asked in what situation under CIP an account could be approved, and Fuller responded: "I think we just approve them all no matter what ..." and added that the firm pays vendors and creates reports. Wang replied with "CIP=" followed by Chinese characters that the committee translated as "Exists in name only" or "Useless."

The committee concluded Wang was in China during the exchange because the messages' timestamps indicated he was working daytime hours in Beijing and because he set his software to translate messages into simplified Chinese. A committee spokesperson told CNBC: "All the evidence in these text messages points to Zhenghan Wang, a Webull employee, being located in China with access to U.S. customer data at the time he worked for the company."

The release comes nearly two weeks after the bipartisan select committee's Oct. 7 report concluded that Webull, which has 28 million users, is "tied in structural ways" to China's government and represents a national security threat to American finance. Webull shares fell more than 19% after that report.

At the time, Webull told CNBC that "U.S. customer data is stored in the U.S. and access to sensitive customer data is controlled by the U.S." Asked about the 2021 messages, a Webull spokesperson did not directly respond to CNBC's questions about whether Wang had access to U.S. customer data or whether that contradicted the company's assertion. The spokesperson said, "Protecting customer data is central to Webull's operations," and that U.S. customer data is stored only in the U.S. on AWS servers in Virginia and Oregon, with access to sensitive data restricted to U.S.-based employees. The spokesperson also said U.S. broker-dealer operations are directed exclusively by U.S.-based personnel and that no individuals based outside the U.S. have ever exercised operational or decision-making authority over Webull's U.S. broker-dealer business.

Webull criticized the committee's release. The spokesperson said the Teams messages date to a 2021 routine FINRA matter that was concluded; FINRA is the Financial Industry Regulatory Authority. The messages' "recent disclosure, alongside the Select Committee's report relying on preliminary and outdated information, raises legitimate questions about the timing and circumstances surrounding their release," the spokesperson said. Webull "rejects irresponsible speculation" and said its data protection practices are robust, continuously enhanced and independently verified, according to the spokesperson.

The select committee's Oct. 7 report argued that Webull's corporate structure means its "software development, data pipelines, and core engineering operations" depend on infrastructure subject directly to Beijing's laws. Those laws can compel firms to cooperate with the Chinese government in various ways, including mandating data transfers, the report said. The committee also issued a press release titled "The Facts on Webull's Ties to China."