According to an analysis by the House of Representatives Select Committee on China Issues of internal communications, internal messages among employees of the online investment platform Webull indicate that although the company has stated such sharing is prohibited, one employee based in China appears to have been able to access information regarding a U.S. client.

It has been nearly two weeks since CNBC first disclosed the report of this bipartisan special committee on October 7th. The report stated that Webull, which has 28 million users, has a "structural connection" with the Chinese government and poses a national security threat to the U.S. finance.

After the release of that report, the stock price of Webull fell by more than 19% at one point.

At the time of the report release, Webull made a statement to CNBC stating: 'American customer data is stored in the United States, and access to sensitive customer data is controlled by American authorities.'

However, internal information exclusively obtained by CNBC and recently released by the House of Representatives' Select Committee on China has raised doubts about whether this claim has always been valid.

The committee has been paying attention to the threats posed by China and working to protect American industry from the impact of Chinese competition.

One set of messages shows that when discussing an American customer's account, an employee identified as Webull may have been in China at that time.

This set of messages also shows that the account had previously received approval from a member of the Chinese Webull team and a colleague from the United States.

These messages date back to 2021 and were exchanged between Brendan Fuller, the US brokerage business manager at Webull, and an employee named Zhenghan Wang with the nickname “Rock” on Microsoft Teams.

The special committee stated that Wang was most likely in China at that time.

In a message, Fuller sends a message to Wang regarding concerns about a certain trading account.

"We saw these issues... and approved the account," wrote Fuller.

Wang replied: "Yes, CIP."

CIP is an abbreviation of Customer Identification Program. It is a regulatory requirement in the United States that financial institutions must verify the identities of individuals and entities opening accounts.

“I knew it,” Fuller replied.

Wang asked Fuller: "Who approved this account?"

Fuller replied: "One member from the Chinese team and one member from the American team."

Subsequently, Wang asked, "I would like to know under what circumstances ( CIP ) we can approve account opening?"

Fuller replied: 'I think we should approve everything, regardless of the circumstances...'

“Then we pay the suppliers, and then we proceed with the reports and work,” Fuller added.

Subsequently, Wang replied that " CIP =" is followed by Chinese characters, which forms a common phrase meaning "nominal" or "useless".

A spokesperson for the special committee stated in a statement to CNBC: "All evidence in these text messages points to Zhenghan Wang – an employee of Webull – who was in China while working for the company and had access to American customer data."

The committee's analysis concluded that Wang was in China at that time because the message timestamp indicated he worked during daylight hours in Beijing time, and he had set his software to translate messages into Simplified Chinese.

The spokesperson did not directly respond to CNBC's question regarding whether Wang would be able to access American customer data in 2021, and whether this would overturn the company's statement that American data would not flow to China.

Webull A spokesperson stated, "Protecting customer data is at the core of Webull's operations."

"The US customer data of Webull is stored only on AWS servers in Virginia and Oregon, USA, and access to sensitive data is limited to employees located in the United States," said the spokesperson.

"The business of US brokerage traders is entirely managed by personnel located in the United States; no one outside of the United States has ever exercised operational or decision-making authority over the US brokerage trader business of Webull."

The company's spokesperson also criticized the special committee for releasing this information.

"The Teams message mentioned today can be traced back to a regular FINRA matter in 2021, which has since been concluded," said the spokesperson. The FINRA, namely the Financial Services Regulatory Authority, is a self-regulatory organization for member brokerage traders."

Webull A spokesperson stated, "These messages have only recently been disclosed, and coupled with the fact that the report of the special committee relies on preliminary and outdated information, it raises legitimate questions about the timing and context of their release."

“Webull rejects such irresponsible speculation and insists on our verifiable records: the data protection practices of Webull are robust, continuously improving, and have been independently verified.”

The report of the Special Committee on October 7th concluded that the corporate structure of Webull implies that the company's "software development, data pipelines, and core engineering operations" rely on infrastructure that is directly subject to Beijing's laws. These Chinese laws can compel companies to cooperate with the government under various circumstances, including requiring the transfer of data.

The Special Committee released a press release titled “Facts about Webull and China Relations” on Tuesday.

According to the press release, since the committee issued its report, Webull "has made many false statements regarding its business and its interactions with the special committee."

The committee listed five statements from Webull, and attached the content that the committee labeled as “the truth” after each one.

One of the sections is titled “The claim of Webull: ‘American customer data is stored in the United States’”, followed by a rebuttal that states: “The truth is: The report of the special committee does not question where the data is stored.”

"The findings concern who has access to this data and the systems that process it," the committee continued to write. "The report reveals that Webull's affiliated company, Webull Technologies Limited, previously used Tencent Cloud, which is headquartered in China, to host some user data... Webull has not yet clarified what data was hosted by Tencent Cloud or when this arrangement came to an end."

Webull stated on Tuesday that the company is collaborating with the predictive market platform Kalshi to offer what are known as sustainable futures to American customers.

Webull indicates that the first batch of perpetual futures has no expiration date, which is different from traditional futures, as they will be based on cryptocurrencies.