The way The Brexit Party collects money from supporters leaves it open “to a high risk of receiving and accepting impermissible donations“, the Electoral Commission has warned.
The watchdog, which visited the party’s headquarters last month, said it had made recommendations to help it meet its “legal responsibilities”.
If it did not comply, the regulator said it could take enforcement action.
Party leader Nigel Farage has insisted all its donations are above board.
Under UK law, donations of £500 or above must be made by a “permissible donor” – someone who is listed on the electoral register or a company registered in the UK.
Amounts below that do not have to be declared, but some critics – among them ex-PM Gordon Brown – have said there is no way of telling whether those smaller amounts come from British or foreign sources, and therefore the system may be being abused.
The Brexit Party topped the polls at last month’s European elections.
During the campaign, it said donations of £25 or less had accounted for 90% of its total funding. It raised more than £2m from small donors, thousands of whom paid £25 each to become registered supporters.
But Mr Brown suggested the party was getting round the declaration rules by accepting multiple “untraceable” donations directly online.
Political parties have 30 days to return donations if they are unsure of their origin.
To date, the Brexit Party has handed back one donation, of £1,000, as the party could not identify whether it was from a permissible source.
The Electoral Commission said it was “legitimate” for any political party to adopt a fundraising strategy focused on raising small sums through online payment systems, including PayPal. Read more