In reverse order: 1. Inform the relevant regulator. 2. Get legal advice before you do this. 3. To avoid being identified for reprisal, do not post on random

In reverse order: 1. Inform the relevant regulator. 2. Get legal advice before you do this. 3. To avoid being identified for reprisal, do not post on random forums before you perform the steps above. I know from personal experience that whistle-blowers get royally shafted.