I highly doubt it’s illegal for a private entity to withhold reporting a crime until they have enough evidence to be actioned on. They made a claim without providing any sort of source backing it up, and the fact that many companies do it points to it being legal, at least in most places they operate.