House committee says Webull messages point to China access to U.S. customer data

The committee's analysis suggests that a Webull employee located in China could access information about a U.S. customer account. That matters because Webull has said sensitive U.S. customer data is controlled by U.S.-based employees, not shared with China-based staff.

In a 2021 Microsoft Teams exchange, U.S. brokerage manager Brendan Fuller discussed an account with Zhenghan Wang, whose nickname was Rock. The committee concluded Wang was likely in China because of message times and his simplified-Chinese translation settings. The messages also said China and U.S. team members approved the account.

Webull did not directly answer questions about Wang's access in 2021. It repeated that U.S. data is stored on servers in Virginia and Oregon and that sensitive access is restricted to U.S.-based employees. The dispute could intensify scrutiny of Webull's controls and corporate ties.

Webull is an online investing platform that provides brokerage services to customers. The article identifies it as a major platform with 28 million users, giving its data practices wide reach.

The company operates a U.S. brokerage business, and its employees handle account-opening and regulatory matters. In the messages reviewed by the House Select Committee on China, a U.S. manager discussed a customer account with an employee the committee believed was working from China.

Webull says U.S. customer data is stored only in the United States, on AWS servers in Virginia and Oregon. It also says U.S. broker-dealer operations are directed exclusively by U.S.-based personnel. The committee's findings challenge whether those protections always matched actual employee access, putting the company's structure and safeguards under closer scrutiny.

A Customer Identification Program, or CIP, is a process financial institutions use to verify the identities of people and entities opening accounts. It helps brokerages meet U.S. regulatory requirements and establish that account applicants are properly identified.

In the Teams exchange, Brendan Fuller wrote that account concerns had been seen but the account was approved. Zhenghan Wang replied, “Yes,CIP,” then asked who approved it and under what CIP circumstances the account could be opened. Fuller said one China team member and one U.S. team member approved it.

Wang later described CIP with Mandarin characters meaning “Exists in name only,” or “Useless.” The exchange raises questions about how seriously the process was applied in that case. Webull said the matter involved a routine 2021 FINRA issue that was concluded.

If access concerns involved Webull's roughly 28 million users, the affected population could be very large. Sensitive brokerage information can include account details and trading-related data, so questions about who can reach it could affect customer confidence and regulatory oversight.

The article does not establish that all users' data was accessed or misused. It describes one 2021 exchange involving a U.S. customer account and an employee the committee believed was in China. That example matters because it tests whether stated access controls worked in practice.

A wider financial-system impact would depend on the scale and nature of any access, which the article does not determine. Still, the findings could prompt closer reviews of China-linked financial companies, cross-border staffing, data controls, and infrastructure dependencies in U.S. finance.

If employees outside the United States can access sensitive brokerage data, customers may worry about privacy, account security, and who controls information about their financial activity. The article does not report misuse, but access alone can create trust and compliance concerns.

Webull could face investigations, reputational damage, and pressure to prove that its controls match its public statements. The House committee has already questioned the company's structure and released internal messages. Webull maintains that sensitive data access is restricted to U.S.-based employees and that its protections are robust.

For U.S. policy, the issue could support closer scrutiny of China-linked financial companies and their technology arrangements. The committee's report described Webull's ties to China as a national-security concern. Any policy response would depend on evidence about access, data handling, and corporate control.

Storing data in the United States identifies the location of the servers, but it does not by itself prove that every person or system with access is also in the United States. Access depends on permissions, employee roles, software connections, and company procedures.

The article illustrates this distinction through a 2021 Teams discussion. The committee believed Zhenghan Wang was in China while discussing a U.S. customer account with U.S. manager Brendan Fuller. That does not prove all data moved to China, but it raises a question about who could view or handle information.

Webull says its U.S. data is stored on AWS servers in Virginia and Oregon and that sensitive access is limited to U.S.-based employees. The committee's analysis suggests location-based storage and real-world access controls should be examined separately.

Corporate structure can connect a U.S.-facing platform to technology, employees, and systems governed or influenced from China. The committee said Webull's software development, data pipelines, and core engineering operations depend on infrastructure subject directly to Beijing's laws.

That dependence can matter even when customer data is stored on U.S. servers. Shared software, administration tools, engineering access, or data pipelines may create routes for people or systems outside the United States to interact with information. The article specifically says Chinese laws can compel firms to cooperate with the government in various ways, including mandating data transfers.

The committee presented these ties as a national-security concern. Webull says its U.S. broker-dealer operations are directed exclusively by U.S.-based personnel and that its data-protection practices are robust and independently verified. The competing claims remain central to the dispute.