Internal messages between employees of an online investment platform Webull A message analysis by the House Select Committee on China suggests that Chinese company employees were accessing information about U.S. customers, even though the company said it prohibited such sharing.
The analysis comes nearly two weeks after CNBC first detailed a bipartisan select committee report that concluded Webull, which counts 28 million users, is covertly “structurally tied” to the Chinese government and represents a national security threat to U.S. finance.
Webull stock fell more than 19% following the Oct. 7 report.
“U.S. customer data is stored in the United States, and access to sensitive customer data is controlled by the United States,” Webull told CNBC in a statement at the time of the report.
But newly released internal messages from the House Select Committee on China, obtained exclusively by CNBC, raise questions about whether that was always the case.
The committee has focused on protecting U.S. industry from the threat posed by China and from Chinese competition.
One message thread suggests that Webull employees were in China during discussions about US customer accounts.
The thread also indicates that this account was previously endorsed by a Chinese Webull team member and an American team member.
The messages date back to 2021 and were sent on Microsoft Teams between Brendan Fuller, a manager at U.S. securities firm Webull, and an employee named Zhenhan Wang, whose nickname is “Rock.”
The selection committee said it was highly likely that Wang was in China at the time.
In one message, Mr. Fuller messaged Mr. Wang about his concerns regarding a particular trading account.
“We are aware of these issues and have approved the account,” Fuller wrote.
Mr. Wang replied, “Yes, CIP.”
CIP is an acronym for Customer Identification Program, a U.S. regulatory requirement for financial institutions to verify the identity of individuals and entities opening accounts.
“I thought so too,” Mr. Fuller replied.
Mr. Wang asked Mr. Fuller, “Who approves the account?”
Fuller responded, “One member from the Chinese team and one member from the American team.”
Mr. Wang then asked, “I would like to know under what circumstances (CIP) can I approve opening an account?”
Mr. Fuller replied, “I think we just approve everything no matter what…”
“Then we pay the vendors, and we write the reports and do the work,” Fuller added.
Mr. Wang then replied that “CIP=” is followed by Chinese characters, forming a common phrase that can be translated as “exists only in name” or “useless.”
“All of the evidence in these text messages indicates that Webull employee Wang Zhenghan was in China accessing U.S. customer data at the time he worked for the company,” a spokesperson for the select committee said in a statement to CNBC.
The commission’s analysis concluded that Wang was in China at the time of the exchange because timestamps on the messages showed he was working in Beijing during the day, and because he had configured the software to translate the messages into simplified Chinese.
A Webull spokesperson did not directly respond to CNBC’s questions about Wang’s access to U.S. customer data in 2021 and whether that disproves the company’s claims that no U.S. data was leaked to China.
A Webull spokesperson said: “Protecting customer data is at the heart of Webull’s operations.”
“Webull’s US customer data is stored exclusively in the US on AWS servers in Virginia and Oregon, and access to sensitive data is limited to US-based employees,” the spokesperson said.
“The U.S. broker-dealer operations are directed solely by U.S.-based personnel, and no individuals based outside the U.S. have exercised operational or decision-making authority with respect to Webull’s U.S. broker-dealer operations.”
A company spokesperson also criticized the selection committee’s publication of the message.
“The team messages currently referenced date back to the concluded 2021 Regular FINRA Matters,” the spokesperson said. FINRA (Financial Industry Regulatory Authority) is a self-regulatory organization for member broker-dealers.
A spokeswoman for Mr Wable said the message’s “recent release, along with the Select Committee’s report, which relied on preliminary and outdated information, raises legitimate questions about the timing and circumstances of the release”.
“Webull rejects irresponsible speculation and is based on a well-documented record, which means Webull’s data protection practices are robust, continually strengthened, and independently verified.”
The select committee’s Oct. 7 report argued that Webull’s corporate structure means its “software development, data pipelines and core engineering operations” rely on infrastructure that is directly subject to Chinese government law. These Chinese laws could force companies to cooperate with the government in a variety of ways, including by requiring data transfers.
The selection committee issued a press release on Tuesday entitled “Facts about Webull’s relationship with China.”
Since the committee released its report, Webull has “made numerous false statements about its operations and interactions with the task force,” the statement said.
The committee listed five of Mr. Webre’s claims, followed by what the committee labeled “the truth.”
A section titled “Webull’s Claim: ‘U.S. Customer Data is Stored in the United States'” was followed by a rebuttal that read, “The Truth: The Task Force’s Report Doesn’t Dispute Where the Data is Stored.”
“The findings concern who has access to the data and the systems that process it,” the committee continued. “The report found that Webull Technologies Limited, an affiliate of Webull, previously used Tencent Cloud, a China-based provider, to host certain user data. Webull did not disclose what data Tencent hosted or when it hosted that data.”
Webull announced Tuesday that it has partnered with prediction market platform Karsi to offer so-called perpetual futures to U.S. customers.
The first perpetual futures, which do not have an expiration date like traditional futures, will be for cryptocurrencies, Webull said.
