Cross-Border Due Diligence: What the Webull Inquiry Shows About Ownership and Data Risk

Cross-border due diligence increasingly requires companies and investors to look beyond where a business is incorporated.

A company may be incorporated in one jurisdiction, regulated in another, employ key technical personnel somewhere else, rely on infrastructure operated from another country and process customer information across several legal environments.

That complexity sits at the centre of a dispute surrounding online brokerage Webull.

On 7 October 2026, a bipartisan investigation by the U.S. House Select Committee on China raised concerns about Webull’s corporate ownership, governance, technology workforce, infrastructure, financing and cross-border data practices. The committee alleged that those connections created potential risks for American investor information and assets.

Webull strongly disputes key conclusions.

In a formal statement filed with the U.S. Securities and Exchange Commission on 9 October, Webull said the committee reached broad conclusions from an incomplete record and got important facts wrong. The company said U.S. customer data is stored on Amazon Web Services infrastructure in the continental United States, that sensitive U.S. data is controlled by U.S.-based supervisors, and that employees in China cannot access it. Webull also said U.S. customer assets remain at regulated U.S. financial institutions and are not held in China.

No regulator has, on the basis of the committee report itself, determined that Webull breached a law concerning these allegations, and the congressional findings did not impose a penalty or prohibit the company from operating.

That disagreement makes the case particularly useful from a due-diligence perspective.

The question is not simply:

“Is Webull an American company or a Chinese company?”

That framing is too simplistic.

A better investigative question is:

Which jurisdiction controls each important layer of the business?

Country of Incorporation Is Only One Layer

Traditional due diligence frequently begins with the corporate registry.

Investigators establish where the company is incorporated, who its directors are and which shareholders appear on record.

That remains essential.

But for multinational technology and financial-services businesses, it may be only the beginning.

A sophisticated cross-border due diligence review should distinguish between:

legal incorporation, beneficial ownership, executive control, technology development, infrastructure, data access, financing and regulatory supervision.

Those functions can sit in completely different countries.

For example, Webull’s U.S. operations are regulated in the United States, while the congressional committee has focused heavily on the company’s China-based technology operations and relationships. Webull responds that these international operations and its China technology team have already been disclosed publicly and to regulators.

That disagreement illustrates why a registry search alone cannot resolve operational-control questions.

For transactions involving complex international companies, Compliancia’s company due diligence work goes beyond basic corporate registration by examining ownership, management, operational presence and less-visible business relationships.

Cross-Border Due Diligence Question 1: Who Ultimately Controls the Company?

The first layer is ownership.

But investigators should avoid treating ownership as a single percentage on a corporate chart.

The relevant questions may include:

Who holds voting rights?

Who appoints directors?

Does one founder or investor exercise disproportionate influence?

Are shares held through holding companies?

Are nominee shareholders involved?

Are shareholders connected through other businesses?

The House Select Committee alleged that Webull’s governance remained dominated by China-linked control. Webull counters that its corporate structure, ownership and governance are disclosed in its public SEC filings.

Both claims can be investigated through documents.

That is precisely what enhanced due diligence should do: distinguish legal ownership from effective control.

A corporate chart should be treated as the starting hypothesis, not necessarily the final answer.

Compliancia’s enhanced due diligence services include beneficial-ownership analysis, corporate mapping and source enquiries where conventional corporate records do not provide the full picture.

Question 2: Where Is the Real Workforce?

A company may have its headquarters in one country while significant parts of its operations remain somewhere else.

For technology businesses, this can matter considerably.

Software engineers may maintain source code.

Infrastructure personnel may manage production systems.

Compliance teams may supervise transactions.

Customer-service personnel may access personal information.

The House committee highlighted Webull’s technology workforce in mainland China and alleged that the company’s operational dependence on China was greater than its public positioning suggested.

Webull responds that its international operations and China-based technology team are publicly disclosed and that China-based personnel do not have access to sensitive U.S. customer data.

The due-diligence lesson is broader than the dispute itself.

Do not ask only:

“Where is headquarters?”

Ask:

“Where are the people who actually build, maintain and administer the critical systems?”

Question 3: Where Is Customer Data Actually Stored?

Companies often describe data security by referring to the physical location of servers.

That matters.

But it does not answer every question.

Webull says U.S. customer information is stored on AWS infrastructure located in the continental United States. The company also says sensitive-data access is controlled in the U.S. and independently tested.

The House committee nevertheless raised concerns about broader data practices and potential exposure created by Webull’s technical relationships and cross-border operations.

These positions highlight an important distinction:

Data location and data access are different due-diligence questions.

A database may physically sit in Virginia.

Investigators may still need to establish:

Who administers it?

Who can query it?

Who can modify access controls?

Where are system logs reviewed?

Which contractors can reach supporting infrastructure?

Where is source code maintained?

Which third-party platforms interact with the data?

A statement that data is “stored locally” is therefore useful, but it may not be sufficient by itself.

Question 4: Which Company Actually Provides the Technology?

Cross-border corporate structures can separate the regulated business from the company supplying its technology.

This is particularly relevant in fintech.

Webull Thailand’s own website states that its market data, website and application development and operations are provided by Webull Technologies Pte. Ltd., while financial products and services in Thailand are offered by Webull Securities (Thailand) Co., Ltd. The site states that the entities are separate but under common ownership.

That does not itself indicate any problem.

But it illustrates exactly why investigators should distinguish between the entity holding a licence and the entity operating important technology.

For any regulated platform, due diligence should ask:

Who is the regulated entity?

Who owns the application?

Who operates the infrastructure?

Who employs the engineers?

Which entities receive customer information?

Which vendors or affiliates have privileged system access?

The answers may cross several jurisdictions.

Question 5: What Government Relationships Exist?

Government support is another area that requires careful interpretation.

The House committee said its investigation identified subsidies or cash rewards received by a China-based subsidiary and highlighted earlier government funding arrangements involving entities associated with Webull’s technology operations.

The existence of a government grant does not automatically imply government control or improper conduct.

Governments around the world provide:

tax incentives, technology grants, investment subsidies, employment incentives and regional-development support.

The due-diligence question should therefore not be:

“Did the company receive government money?”

It should be:

“What was the programme, what conditions applied, which entity received it and did the relationship create obligations relevant to the transaction?”

Context matters.

Question 6: What Does the Company’s Response Actually Resolve?

Good investigative due diligence should not collect only adverse information.

When a subject provides an explanation, investigators should test it.

Webull’s SEC-filed response provides several specific assertions.

The company says sensitive U.S. customer data remains in the United States, China-based employees cannot access that information, independent U.S. auditors test the controls, customer cash and securities remain with regulated U.S. institutions, and nobody based in China has authority or system access to move U.S. customer funds.

These are testable propositions.

A robust due-diligence review might therefore examine architecture documents, access controls, audit reports, contractual arrangements, corporate filings and technology-provider relationships.

This is an important investigative principle:

Do not merely repeat the allegation. Test the response against independent evidence.

Why This Matters in Thailand

The issue has regional relevance because Webull has expanded significantly in Thailand.

Webull Thailand states that it is licensed and regulated by Thailand’s Securities and Exchange Commission. Its website also says Webull Corporation owns the platform and that Webull Thailand is a subsidiary.

In 2026, Webull also substantially expanded its Thai securities footprint.

The company announced that transactions completed on 31 August resulted in the Webull group acquiring approximately 99.36% of Pi Securities, with a combined transaction value of roughly US$100 million.

That expansion does not establish any problem with the Thai business.

It does make the broader corporate-structure question commercially relevant for investors, partners and counterparties operating in Southeast Asia.

When a financial or technology group operates simultaneously across the United States, China, Hong Kong, Singapore, Japan and Thailand, due diligence increasingly needs to consider the entire operating network rather than one local subsidiary.

The Seven-Layer Cross-Border Due Diligence Test

A practical investigation should map seven layers:

1. Legal ownership: shareholders, holding companies, voting rights and beneficial owners.
2. Operational control: executives, reporting lines and real decision-making authority.
3. Workforce location: where critical engineering, compliance and operational personnel sit.
4. Technology infrastructure: systems, cloud services, software ownership and third-party providers.
5. Data flows: where information is stored, accessed, processed and backed up.
6. Financing and government relationships: investors, loans, subsidies, grants and strategic dependencies.
7. Regulatory perimeter: which regulator supervises which entity and which activities fall outside that regulator’s direct reach.

A company can give satisfactory answers at all seven layers.

The point of due diligence is not to presume that complexity indicates wrongdoing.

It is to understand the complexity before making a commercial decision.

Why Source Enquiries Can Add Value

Public filings can explain formal ownership.

Technical documentation can explain system architecture.

But neither always explains how the organisation works in practice.

Discreet source enquiries may help test questions such as:

Who actually makes important decisions?

How independent is a local subsidiary?

Where are key functions really performed?

How closely do related companies work together?

Do former employees describe the same operating model as the official documentation?

Source intelligence should never be treated as automatically reliable.

It should be evaluated, cross-checked and corroborated.

But where significant commercial exposure exists, credible human intelligence can add context that formal documents may not capture.

Compliancia’s corporate investigation capabilities combine corporate intelligence, UBO and nominee research, source enquiries and investigative verification across Southeast Asia.

Cross-Border Due Diligence Is Becoming a Technology Question

Traditional corporate due diligence focused heavily on ownership, litigation and financial statements.

Those remain fundamental.

But technology companies increasingly require another layer.

An investor acquiring a platform may need to know:

Who owns the source code?

Where is it developed?

Who has privileged access?

Which company owns the intellectual property?

Which cloud provider hosts the systems?

Where are customer records processed?

Which affiliates can access them?

A business can be financially healthy and legally incorporated in a low-risk jurisdiction while still having material operational dependencies elsewhere.

Those dependencies may not be problematic.

But they should be understood.

Corporate Structure Should Explain Reality

The central lesson from the Webull dispute is therefore not whether one side’s description will ultimately prevail.

The congressional committee has made serious allegations about the company’s links to China and the potential risks those links create.

Webull has publicly disputed those conclusions and supplied specific responses concerning data storage, access controls, asset custody and regulatory supervision.

The public material reviewed does not establish that Chinese authorities accessed U.S. customer data, nor does the committee report itself constitute a regulatory enforcement determination.

For due diligence professionals, however, the disagreement provides an instructive case study.

Corporate identity cannot always be reduced to a flag beside the company’s name.

Investigators need to understand:

ownership, people, systems, data, money and decision-making authority.

Only then does the structure become meaningful.

How Compliancia Supports Cross-Border Due Diligence

Compliancia supports companies, investors, law firms and their counsel with corporate intelligence and investigative due diligence across Thailand and the wider Asian region.

Our work can include corporate ownership mapping, beneficial-owner identification, executive background investigations, source enquiries, corporate-link analysis, adverse-information research, operational verification, asset research, litigation checks and cross-border investigative enquiries.

Explore Compliancia’s company due diligence services

Learn about Compliancia’s enhanced due diligence capabilities

For complex international businesses, the objective is not simply to answer:

“Where is this company registered?”

The more useful questions are:

Who ultimately controls it?
Where do its critical people work?
Who owns and operates its technology?
Where does sensitive information actually flow?
What dependencies exist across jurisdictions?
And do the company’s public explanations match the underlying evidence?

That is what effective cross-border due diligence should establish.

Editorial Note

This article discusses findings published on 7 October 2026 by the bipartisan U.S. House Select Committee on the Strategic Competition Between the United States and the Chinese Communist Party.

The committee alleged that Webull had not been sufficiently transparent about its links to China and raised concerns involving corporate control, technology personnel, infrastructure, data practices, financing and government support.

Webull disputes significant portions of the report.

In a statement filed with the SEC on 9 October 2026, the company said the report relied on an incomplete record and contained important factual errors. Webull stated that sensitive U.S. customer data is stored and controlled in the United States, China-based employees do not have access to that sensitive information, and U.S. customer assets are held at regulated U.S. institutions.

The congressional report is not a court judgment or regulatory enforcement decision. The public material reviewed for this article does not establish that Chinese authorities accessed U.S. customer information or that Webull breached a specific law as a result of the issues raised in the committee report.

Primary external sources: U.S. House Select Committee investigation and Webull’s formal response filed with the SEC.

For the Thailand context, see Webull Thailand’s public platform and regulatory disclosures and its announcement concerning the Pi Securities investment.