My coworker confided in me that hes been working remotely from another country for 6 months without telling HR and now theres an audit

My coworker, we're pretty close, told me back in October that he had quietly moved to Portugal and was just logging on like normal without telling anyone. He made me promise not to say anything and I kept that.

Fast forward to this week, I'm sitting at my desk playing on my phone and HR sends out a companywide email saying they're doing a compliance review on remote work locations because of tax and legal stuff. Apparently its a bigger deal than I realized, like companies can get in serious trouble if an employee is working from a different country without proper registration or whatever.

He texted me freaking out asking if I knew anything about the audit and I said no. But now I'm in this weird spot where I don't know if I should stay completely out of it or give him a heads up that this is more serious than just HR being nosy.

I didn't do anything wrong but I knew for months and said nothing. Does that make me responsible in any way or do I just let him figure it out on his own