A sales lead is currently working with one of our competitors, and said they'd happily switch over, so long as we we could make the changes to handle things in the same way as our competitor is.
However, there is no absolutely no way to do that, and follow our industry's security standards. The data the customer wants to see (and currently can see), is just not allowed to be sent to them. Doing so would put both us and our customer in danger of huge fines.
How do we explain this situation to our lead?
Do we report our competitor?
Fundamentally, the fact that a competitor is not following industry standards is not your problem.
Personally, I would decline doing the change, explain the problem, and cite the relevant rules and penalties. Don't even reference the competitor, just explain why you won't do it.. because odds are the customer will forward that email directly to their sales/support reps at the competitor and/or their own attorney and ask for an explanation.
That's why you need to keep this about your choices and policies, not the competitor's.
The answer to that is based on the next two questions: