House China Committee Calls Webull a National Security Risk | What It Means for Bot Traders

October 9, 2026, 8:53 a.m. ET | By FullStack Alpha Editorial Team | Reviewed by Jay Rocco, Chief Editor

Quick answer: On October 7, 2026, the House Select Committee on the Chinese Communist Party released a bipartisan report calling Webull’s China ties a national security risk. The report is findings and recommendations, not an order, so Webull accounts, its OpenAPI and its Cloud MCP keep working today. Webull rejects the report. Its stock closed down about 19% that day.

Most traders read this as a stock story. If your bot or AI agent routes orders through Webull, it is a plumbing story.

Key facts

What: A report titled Free Trades, Hidden Ties: Exposing Webull’s China Links, led by Chairman John Moolenaar (R-MI) and Ranking Member Ro Khanna (D-CA).
When: Released October 7, 2026. The inquiry started with a committee letter to Webull on November 25, 2024.
Six findings: data exposure to PRC legal and surveillance risk, misstated employee locations, PRC-linked governance, weaker regulatory controls than promised, PRC government funding for a subsidiary, and clearing and custody concerns.
Scale: The report cites Webull’s FY2025 disclosures of more than 26 million registered users worldwide and $24.6 billion in customer assets.
Market reaction: Webull (BULL) closed at $5.89 on October 7, down from $7.28 the day before, on roughly 81 million shares versus about 6 million the prior session. It closed at $5.95 on October 8.
Webull’s response: The company says the report contains “significant inaccuracies and unsupported conclusions” and that U.S. customer data is stored in the United States.
Legal effect: None yet. No fine, ban or regulatory order came with the report.

What did the House committee actually find?

Four-panel graphic of the House committee's Webull concerns: data routing, workforce, governance and custody

The core claim is a gap between the storefront and the back office.

Webull Financial LLC is a U.S. broker-dealer registered with the SEC and FINRA, with SIPC coverage. The report says the platform customers use to see market data, check accounts and place trades is owned by a Singapore entity, Webull Technologies Pte. Ltd. It says that platform gets development and support help from Hunan Weibu, a subsidiary in Changsha, China.

The report also cites Webull’s own disclosure that it kept a FINRA-registered branch office in mainland China from January 14, 2020, to April 3, 2024. That branch handled customer service and some overnight technical support.

One line deserves a careful read. The committee says Chinese law does not prove that authorities have already accessed Webull customer data. Its argument is about exposure, not a confirmed breach.

Why does this matter if you run a bot on Webull?

The report never mentions APIs, bots or AI agents. That is the point.

Every OpenAPI order, every WebSocket quote stream and every prompt your AI assistant sends through Webull’s Cloud MCP runs on the same platform the committee describes. The report says some backend data traffic routes over infrastructure operated in part by China Mobile. If that claim holds, your bot’s order flow sits inside the same pipes as everyone else’s taps on the app.

Automated traders also carry a risk manual traders feel less: switching cost. A person can move brokers in a week. A bot wired to one broker’s endpoints, auth flow and order types needs to be rebuilt and retested first. If you want the setup details, our Webull API and MCP guide walks through how those connections work.

What changed with customer cash?

This is the finding with real dollars attached.

Until October 2025, Apex Clearing carried Webull customers’ cash and securities on its own books. Under an omnibus arrangement completed that month, Apex still clears and holds securities, but Webull itself now accepts and carries customer cash. The committee argues this puts more weight on Webull’s internal controls.

It ties that to history. In November 2024, the SEC fined Webull $125,000 over deficient suspicious activity reports. In April 2026, FINRA approved Webull’s application for self and correspondent clearing, which the committee says heightens its concerns.

For bot operators, the takeaway is plain. Idle cash parked between trades sits on Webull’s ledger, not a third party’s.

What did Webull say in response?

Webull refuted the report. In a statement to Crowdfund Insider, the company said its U.S. business runs from its global headquarters in St. Petersburg, Florida, and an office in New York City. It said U.S. customer data stays in the United States and access to sensitive data is controlled from the U.S.

Webull also said the committee never asked it for clarification and went more than 20 months without contact before publishing. It said it is ready to be transparent with the SEC, FINRA and other regulators.

How did the market and rivals react?

Fast. Siebert Financial suspended its Buy rating and price target on Webull, saying the regulatory and operational effects were too uncertain to model.

Rivals moved within hours. Robinhood and Public both rolled out 3% transfer bonuses for accounts moved from Webull, according to Doctor of Credit. Robinhood’s runs October 7 to October 16 and requires a five-year hold. Public’s runs to October 26, caps the bonus at $1 million and pays it over 72 months.

Read those terms twice. A bonus paid over six years is a retention contract with a marketing budget.

What should investors watch next?

October 16, 2026: Robinhood’s Webull transfer bonus window closes.
October 26, 2026: Public’s Webull transfer bonus window closes.
Any SEC or FINRA statement: The report asks regulators to act, but none had announced a review as of this writing. A formal review would be the first signal with teeth.
Congress: The five recommendations, including bringing foreign-controlled broker-dealers under CFIUS review and new rules on brokerage data, need legislation or agency action. Watch for a bill number.
Webull’s next quarterly report: Look for account outflow data and any disclosure about the report.

Our take

Here is the uncomfortable truth. Most bot builders pick a broker for the API docs and never read the 20-F.

This report changes nothing about your account today. It does show that broker risk goes well past uptime and fills. Ownership, custody and data routing are part of your stack too, and they can make headlines in a single morning.

The fix is boring, which is why it works. Keep your strategy logic separate from broker code, so switching is a config change and not a rewrite. Keep only the cash your bot needs at any one broker. Use read-only keys for anything that does not place orders. Our guide to broker APIs for trading bots compares the main alternatives, and our post on AI trading agent risks covers the kill switch every live bot should have.

Your next step: write down how long it would take to move your bot to a second broker. If the answer is longer than a weekend, that is the project.

Is your bot one broker headline away from a rebuild?

FullStack Alpha has tested more than 200 AI stock tools since 2022, broker connections included.

Compare tested tools and brokers

This article is for education and information only. It is not financial, investment or legal advice. Do your own research and consider a licensed professional before making decisions.

Sources

Your market edge starts with the right tool. Stay alpha.