I don’t know how it works in the US but under European law if he knows about these things and isn’t reporting them he’s liable if and when it all comes to light.

If you know that the company you work for is committing crimes, and you do not report it, you are as liable as the company.