XML 69 R41.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Risk Management and Strategy

We have implemented comprehensive procedures to ensure effectiveness in cybersecurity management, strategy and governance and reporting cybersecurity risks. We have also integrated cybersecurity risk management into our overall risk management system. The Webull board is dedicated to guiding the organization in a direction that minimizes the impact of cybersecurity risks on Webull’s operations and facilitate the secure sharing of information in the Cyberspace (as defined below).

The Webull board has, among others, approved a Cybersecurity Policy (the “Cybersecurity Policy”) to establish the appropriate guidance and processes for assessing, reviewing, implementing, and optimizing Webull’s cybersecurity standards and to ensure a safe environment for its information technology (“IT”) network. The information that exists within the IT network and infrastructure (the “Cyberspace”) constitutes a valuable asset for Webull, warranting its protection and preservation. The Webull board believes that a robust information security management system is essential for assessing, identifying, and managing material risks from cybersecurity threats. The Cybersecurity Policy is to be implemented as an integrated component of Webull’s overall risk management system and aligned with Webull’s overall business and development strategy.

As of the date of this Report, we have not experienced any material cybersecurity incidents or identified any material cybersecurity threats that have affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition.

Cybersecurity Risk Management Processes Integrated [Text Block] We have also integrated cybersecurity risk management into our overall risk management system.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block]

As of the date of this Report, we have not experienced any material cybersecurity incidents or identified any material cybersecurity threats that have affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition.

Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]

Governance

Our board of directors is responsible for overseeing risks related to cybersecurity. Our board of directors shall (i) maintain oversight of the disclosure related to cybersecurity matters in reports or periodic reports of our company, (ii) review updates to the status of any material cybersecurity incidents or material risks from cybersecurity threats to our company, and the disclosure issues, if any, presented by our management on a quarterly basis, and (iii) review disclosure concerning cybersecurity matters in our Annual Report on Form 20-F presented by our management.

The risk management committee of the Board (the “Risk Committee”) is responsible for overseeing the implementation of the Cybersecurity Policy. The Risk Committee has reviewed and approved Webull’s cybersecurity-related disclosures presented in our Annual Reports on Form 20-F. The Risk Committee will routinely provide updates to the Board on the matters outlined in the Cybersecurity Policy. Additionally, the Risk Committee will review and evaluate the sufficiency of the Cybersecurity Policy, proposing any necessary changes to the Board for approval.

At the management level, primary responsibility for establishing, implementing and managing the Cybersecurity Policy rests with Webull’s Chief Information Security Officer (the “Policy Admin”), who, in conjunction with Webull’s management, assesses and manages cybersecurity risks and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Certain tasks may be delegated to Webull’s IT staff or external service providers (“IT Resources”), but are reviewed by the Policy Admin. Policy Admin refers collectively to the role-holder and delegates. The Policy Admin reports to Webull’s Chief Executive Officer and provides timely and routine updates to the Risk Committee on material risks arising from cybersecurity threats or any material cybersecurity incidents.

Upon the identification of a cybersecurity incident, the Policy Admin will create an incident response team (“Response Team”) to deal with that incident. The Response Team is responsible for coordinating with internal and external IT personnel and advisors, and internal and external counsel, as appropriate, to minimize the damage resulting from a cybersecurity incident. The Response Team, in consultation with its advisors (as applicable), will work promptly to determine the scope and impact of the incident (including the extent of systems and data affected), notify any persons potentially affected by such breach, contain the incident, identify the cause of the incident, mitigate potentially harmful effects of the incident, and recover from the incident. The Response Team will develop a plan promptly for identifying and implementing appropriate steps to preserve evidence related to the incident, consistent with the need to restore availability and Webull’s legal obligations. The response team shall also determine whether any disciplinary measures are appropriate in connection with the incident.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]

Our board of directors is responsible for overseeing risks related to cybersecurity. Our board of directors shall (i) maintain oversight of the disclosure related to cybersecurity matters in reports or periodic reports of our company, (ii) review updates to the status of any material cybersecurity incidents or material risks from cybersecurity threats to our company, and the disclosure issues, if any, presented by our management on a quarterly basis, and (iii) review disclosure concerning cybersecurity matters in our Annual Report on Form 20-F presented by our management.

The risk management committee of the Board (the “Risk Committee”) is responsible for overseeing the implementation of the Cybersecurity Policy. The Risk Committee has reviewed and approved Webull’s cybersecurity-related disclosures presented in our Annual Reports on Form 20-F. The Risk Committee will routinely provide updates to the Board on the matters outlined in the Cybersecurity Policy. Additionally, the Risk Committee will review and evaluate the sufficiency of the Cybersecurity Policy, proposing any necessary changes to the Board for approval.

At the management level, primary responsibility for establishing, implementing and managing the Cybersecurity Policy rests with Webull’s Chief Information Security Officer (the “Policy Admin”), who, in conjunction with Webull’s management, assesses and manages cybersecurity risks and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Certain tasks may be delegated to Webull’s IT staff or external service providers (“IT Resources”), but are reviewed by the Policy Admin. Policy Admin refers collectively to the role-holder and delegates. The Policy Admin reports to Webull’s Chief Executive Officer and provides timely and routine updates to the Risk Committee on material risks arising from cybersecurity threats or any material cybersecurity incidents.

Cybersecurity Risk Role of Management [Text Block] The risk management committee of the Board (the “Risk Committee”) is responsible for overseeing the implementation of the Cybersecurity Policy.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] At the management level, primary responsibility for establishing, implementing and managing the Cybersecurity Policy rests with Webull’s Chief Information Security Officer (the “Policy Admin”), who, in conjunction with Webull’s management, assesses and manages cybersecurity risks and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true