House committee says Webull messages point to China access to U.S. customer data

The Webull Financial LLC application Markets page on a smartphone and logo on a laptop computer arranged in Dobbs Ferry, New York, Jan. 30, 2021.Tiffany Hagler-Geard | Bloomberg | Getty ImagesInternal messages between employees of online investing platform Webull suggest a company employee in China had access to information about a U.S. customer, despite the company having said it bars such sharing, according to an analysis of the messages by the House Select Committee on China. The analysis comes nearly two weeks after CNBC first detailed the bipartisan select committee's report that concluded that Webull, which counts 28 million users, is quietly "tied in structural ways" to China's government, representing a national security threat to American finance.Webull shares slid more than 19% on the heels of that Oct. 7 report.At the time of the report, Webull told CNBC in a statement that "U.S. customer data is stored in the U.S. and access to sensitive customer data is controlled by the U.S." But the newly released internal messages by the House Select Committee on China, which CNBC exclusively obtained, raise questions about whether that has always been the case. The committee has focused on threats posed by China and protecting U.S. industry from Chinese competition.One message thread suggests a Webull employee was in China during a discussion about a U.S. customer account.The thread also indicates the account was previously approved by a China Webull team member and an American counterpart.The messages, dating to 2021, were sent on Microsoft Teams between Brendan Fuller, a manager at Webull's U.S. brokerage, and an employee named Zhenghan Wang, whose nickname is "Rock."The select committee says Wang was likely in China at the time. In one message, Fuller messaged Wang about concerns involving a particular trading account. "We saw these problems ... and approve account," Fuller wrote. Wang replied: "Yes,CIP." CIP is an acronym for Customer Identification Program, a U.S. regulatory requirement that financial institutions verify the identities of individuals and entities opening accounts."I thought so," Fuller responded.Wang asked Fuller: "Who approve the account?" Fuller responded: "One China team member and one US team." Wang then asked: "I want to know in what situation (CIP), can we approve the account open?" Fuller responded: "I think we just approve them all no matter what ..." "And then we pay for vendors. And create report and work," Fuller added.Wang then replied that "CIP=" followed by Mandarin Chinese characters forming a common phrase that translates as "Exists in name only," or "Useless."A spokesperson for the select committee, in a statement to CNBC, said, "All the evidence in these text messages points to Zhenghan Wang, a Webull employee, being located in China with access to U.S. customer data at the time he worked for the company."An analysis by the committee concluded that Wang was in China at the time of the exchange because the messages' time stamps indicated that Wang was working daytime hours in Beijing, and because he set his software to translate the messages into simplified Chinese. A Webull spokesperson did not directly respond to CNBC's questions about Wang's access to U.S. customer data in 2021 and whether that disproved the company's assertion that its U.S. data does not go to China. The Webull spokesperson said, "Protecting customer data is central to Webull's operations.""Webull's U.S. customer data is stored only in the U.S. on AWS servers in Virginia and Oregon, with access to sensitive data restricted to U.S.-based employees," the spokesperson said. "U.S. broker-dealer operations are directed exclusively by U.S.-based personnel, and no individuals based outside the U.S. have ever exercised operational or decision-making authority over Webull's U.S. broker-dealer business." The company spokesperson also criticized the select committee's release of the messages."The Teams messages now being referenced date back to a 2021 routine FINRA matter, which was concluded," the spokesperson said. FINRA, or the Financial Industry Regulatory Authority, is the self-regulatory organization for member broker-dealers.The messages' "recent disclosure, alongside the Select Committee's report relying on preliminary and outdated information, raises legitimate questions about the timing and circumstances surrounding their release," Webull's spokesperson said."Webull rejects irresponsible speculation and stands on our well-documented record: Webull's data protection practices are robust, continuously enhanced, and independently verified."The select committee's Oct. 7 report argued that Webull's corporate structure means the firm's "software development, data pipelines, and core engineering operations" are dependent on infrastructure subject directly to Beijing's laws. Those Chinese laws can compel firms to cooperate with the government in various ways, including mandating data transfers. The select committee on Tuesday issued a press release titled, "The Facts on Webull's Ties to China."The release said that since the committee issued its report, Webull "has ... responded with numerous false statements about its business and its interactions with the Select Committee."The committee listed five claims by Webull, followed by what the committee labeled "The Truth."One section, titled "Webull Claim: 'U.S. customer data is stored in the U.S.,'" was followed by a rebuttal that said, "The Truth: The Select Committee's report does not dispute where the data is stored."Its finding is about who can reach the data and the systems that process it," the committee continued. "The report found that Webull affiliate Webull Technologies Limited previously used Tencent Cloud, a China-based provider, to host certain user data ... Webull has not said what data Tencent hosted or when that ended."Webull said Tuesday that it was partnering with Kalshi, the prediction market platform, to offer so-called perpetual futures to U.S. customers.The first set of perpetual futures, which do not have an expiration date, as traditional futures do, would be for cryptocurrencies, Webull said.