Campaign group Leave.EU has been fined £70,000 for breaches of election law in the 2016 EU referendum.
The Electoral Commission said the group - which was separate from the official pro-Brexit group Vote Leave - failed to report "at least" £77,380 it spent.
It has also referred Leave.EU chief executive Liz Bilney to the police following its investigation into what it calls "serious offences".
Leave.EU co-founder Arron Banks called it a "politically motivated attack".
Responding to the Electoral Commission's findings, he said: "What a shambles, we will see them in court."
The investigation also looked into whether Leave.EU had received any services from Cambridge Analytica which should have been declared on its spending return but found no evidence that the group received donations or paid for services from the political consultancy.
Leave.EU's relationship with the controversial firm "did not develop beyond initial scoping work", according to the Commission.
The UK voted by 52% to 48% to leave the European Union in a referendum in June 2016. All groups had to ensure they met campaign spending rules and filed accurate returns under the Political Parties, Elections and Referendums Act 2000.
Who are Leave.EU?
- Founded by UKIP donor and businessman Arron Banks and backed by UKIP's Nigel Farage
- Self-styled "bad boys of Brexit" - the title of Banks's book on the campaign
- Lost out to Vote Leave in the battle to become the official "out" campaign during the EU Referendum
- Relations between Vote Leave and Leave.EU soured during the campaign - Leave.EU argued it had a wider reach outside the "Westminster bubble" and focused its message more on immigration
The Electoral Commission said Leave.EU had exceeded the spending limit for "non-party registered campaigners" by at least 10% by failing to include at least £77,380 in its spending return - the fee paid to campaign organiser Better for the Country Ltd - and added the overspend "may well have been considerably higher than that".
Its spending return also did not include services Leave.EU had received from a US campaign strategy firm, Goddard Gunster, and the group "inaccurately reported" three loans totalling £6m from Mr Banks - including who had provided them - and did not provide invoices or receipts for 97 separate payments, totalling £80,224.
The Commission has referred Leave.EU chief executive Liz Bilney to the police, saying it had reasonable grounds to suspect she had committed criminal offences over campaign spending.
Bob Posner, the Commission's director of political finance and regulation, said spending rules were in place to ensure public confidence in democracy and it was "disappointing that Leave.EU, a key player in the EU referendum, was unable to abide by these rules".
"These are serious offences. The level of fine we have imposed has been constrained by the cap on the Commission's fines," he added.
But Mr Banks told the BBC's Daily Politics that Leave.EU had responded to the Commission with a 20-page report from an independent accountant which, he said, the watchdog had "ignored completely".
He described the disputed amount as "an internal management charge which our lawyers have told us wasn't reportable" and claimed the Commission was staffed by pro-Remainers and the ruling was politically motivated.
"Effectively what they have done is, they started off their investigation with a remit of investigating Cambridge Analytica and dark Russian money - they have found no evidence of any of those things and they have fined us on a technical accounting issue which is heavily in dispute."
Mr Banks said they intended to challenge the finding in court.
Electoral Commission chief executive Claire Bassett denied claims of bias made by Mr Banks.
She told BBC Radio 4's Today programme: "The decisions were made by directors of the Electoral Commission, they were made based on robust evidence we had gathered, and indeed you can see that in the 30-page report that we published."
Leave.EU is not the only group to fall foul of spending rules in the EU Referendum campaign. The Lib Dems were fined £18,000 and the official Remain campaign was fined £1,250 by the Commission last year.
The official Vote Leave group - that was backed by cabinet ministers Boris Johnson and Michael Gove - is still under investigation. The pro-EU European Movement UK and UKIP have also been fined over their referendum spending.
The maximum fine is £20,000 per offence - Leave.EU was fined for four separate offences.