There's certainly things I find suspicious about this CEOs actions, I won't deny that. I'm still not going to contact law enforcement about strangers on the Internet.
You're conflating negligence/dereliction of duty and bus-factor-of-one here, while Fosshost suffers from both, they are not the same thing.
Regulators can absolutely solve the former, but not the latter. The volunteers can solve the latter, but only after the former is resolved. I don't see why you assume why a new CEO would resist relinquishing all treasury duties.
I appreciate the distinction, but they're certainly related. We can see that because we can achieve the same result with a bus accident as with dereliction, and that addressing the dereliction without addressing the bus factor will result in a repeat of the problem.
> I don't see why you assume why a new CEO would resist relinquishing all treasury duties.
I don't, that was a thought experiment to illustrate the point that addressing the dereliction does not address the root cause.
In this particular instance, the regulators absolutely can. If the CEO is failing to discharge their duties, they will be disposed of as a company officer, and a new officer will be installed, who can get access to bank accounts and other resources (websites, domains, taxes) backed by the force of law. Not going to regulators is what wil lead to an irrevocable failure in this instance, but it appears the volunteers have already resigned to that fate.
I find rather suspect that the CEO registered a private company with a name similar to the non-profit they already run. I don't have full context, but that alone sets off alarm bells for fraud and/or self-dealing: I'd definitely contact oversight on that basis alone, if I had standing.