The way The Brexit Party collects money from supporters leaves it open “to a high risk of receiving and accepting impermissible donations”, the Electoral Commission has warned.
The watchdog, which visited the party’s headquarters last month, said it had made recommendations to help it meet its “legal responsibilities”.
If it did not comply, the regulator said it could take enforcement action.
Party leader Nigel Farage has insisted all its donations are above board.
Under UK law, donations of £500 or above must be made by a “permissible donor” – someone who is listed on the electoral register or a company registered in the UK.
Amounts below that do not have to be declared, but some critics – among them ex-PM Gordon Brown – have said there is no way of telling whether those smaller amounts come from British or foreign sources, and therefore the system may be being abused.
The Brexit Party topped the polls at last month’s European elections.
The Electoral Commission said it was “legitimate” for any political party to adopt a fundraising strategy focused on raising small sums through online payment systems, including PayPal.
But it said there was a legal duty on parties to check every payment they obtained online to ascertain the source of the donation and “not to accept any that they are not entitled to”.
Parties should request “as much information as possible” to ensure all money was from a permissible source, it said.
In a statement, it said it had concluded that the “fundraising structure adopted by the party leaves it open to a high and ongoing risk of receiving and accepting impermissible donations”.
The watchdog’s director of regulation, Louise Edwards, said it had made “specific recommendations to the party that will support it to meet its legal responsibilities when it comes to receiving funds”.
“Should it fail to meet those responsibilities, this will be considered in line with our enforcement policy,” she added.