Compliance departments are generally designed to protect the interest of the company or organization in which you are blowing the whistle. Reporting your concerns to compliance or to an internal hotline will almost certainly result in retaliation and cover up attempts.
You should not make any disclosures to your supervisor or company compliance officer until after you consult a whistleblower attorney. Cease using company-provided devices and networks immediately to avoid discovery when communicating with your attorney.