Brexit campaign group Vote Leave has been fined £61,000 and referred to the police after an Electoral Commission probe said it broke electoral law.
The watchdog said it exceeded its £7m spending limit by funnelling £675,315 through pro-Brexit youth group BeLeave.
The founder of BeLeave, Darren Grimes, has been fined £20,000 and referred to the police, along with Vote Leave official David Halsall.
Vote Leave said the "wholly inaccurate" report was politically motivated.
The Vote Leave campaign, which was fronted by Boris Johnson and Michael Gove, won the contest to be the official Leave campaign in the 2016 referendum on whether Britain should stay in the European Union.
The result of the referendum was 51.9% for Leave and 48.1% for Remain. The UK is due to officially leave the European Union at 23:00 GMT on 29 March, 2019.
The referendum was not legally binding, merely "advisory," according to a Supreme Court judgement in December 2016, so it can't be ordered to be re-run by a court - any decision to have a fresh referendum would have to be made by the government and Parliament would have to pass a referendum act.
The Electoral Commission has referred Mr Grimes and Mr Halsall to the Metropolitan Police in relation to false declarations of campaign spending, and handed over files "in relation to whether any persons have committed related offences" that fall outside the watchdog's remit.
Vote Leave and the official Remain campaign Britain Stronger in Europe were allowed to spend £7m each on campaigning in the run up to the referendum.
Vote Leave spent nearly £2.7m of its £7m budget on the services of a Canadian digital marketing firm, Aggregate IQ.
A further £675,315 was sent to Aggregate IQ by BeLeave, a group set up by Mr Grimes, then a fashion student at Brighton university.
The money came from Vote Leave which has said in the past it was told by the Electoral Commission it was allowed to do this because BeLeave was a separate campaign group.
But the Electoral Commission - which is the watchdog overseeing elections in the UK and ensuring that UK laws on spending by political parties are followed - has ruled that the two groups were working together and Mr Grimes had "wrongly" reported the spending as his own.
This meant that, including this amount, the Electoral Commission says Vote Leave spent £7,449,079, breaching its £7m spending limit.
Darren Grimes is also said to have exceeded the £10,000 he was allowed to spend as a non-registered campaigner, the watchdog said.
Bob Posner, from the Electoral Commission, said: "We found substantial evidence that the two groups worked to a common plan, did not declare their joint working and did not adhere to the legal spending limits. These are serious breaches of the laws put in place by Parliament to ensure fairness and transparency at elections and referendums."
He added: "Vote Leave has resisted our investigation from the start, including contesting our right as the statutory regulator to open the investigation. It has refused to cooperate, refused our requests to put forward a representative for interview, and forced us to use our legal powers to compel it to provide evidence.
"Nevertheless, the evidence we have found is clear and substantial, and can now be seen in our report."
It is impossible to say how overspending by the Vote Leave campaign affected the referendum result. It all went to one marketing firm, which developed highly-targeted Facebook advertising.
In a quote since removed from the Aggregate IQ website, Vote Leave campaign director Dominic Cummings said: "We couldn't have done it without them."
Former Vote Leave activist Shahmir Sanni, who went public with allegations about overspending earlier this year, told BBC Radio 4's The World at One the extra cash spent by BeLeave had affected the referendum outcome - saying such a sum "can make all the difference".
Anti-Brexit Labour peer Lord Adonis said Vote Leave's overspending "could have been decisive" in the 2016 referendum because it was a close result but he did not want to re-run that campaign.
Instead, he said "all of those responsible for this breach of the law" should be "barred" from playing any part in any future referendum, such as the one he is calling for on the final Brexit deal.
Labour is calling for Tory ministers who were key figures in Vote Leave to be referred to the cabinet secretary to determine whether they had broken the ministerial code.
In a statement on Twitter, Mr Grimes said it was "incredible" that he had been fined £20,000 "on the basis of the wrong box being ticked on an application form".
He said he had been interviewed by the Electoral Commission during two previous investigations and had never been "provided with particulars" of the allegation that he had worked on a "common plan" with Vote Leave so that he could "make representations about it".
"Politicians say they want young people to engage with politics. I was 22 when I got involved in a referendum I felt passionately about. I did nothing wrong," he added.
"I have been persecuted for over two years by powerful people for nothing more than engaging in the democratic process and having the temerity to be on the winning side. It has been appalling for my family."
I’m shocked and disappointed by the Electoral Commission and their behaviour. They have put me and my family of very ordinary means through hell for two years and seek to justify this by saying that I failed a box ticking exercise — why has this taken them three investigations?— Darren Grimes (@darrengrimes_) July 17, 2018
The Electoral Commission cleared Vote Leave of breaking spending limits in March last year but re-opened its investigation in October, saying new evidence had come to light from its own investigations, media reports, academics and whistleblowers.
Another pro-Brexit group, Veterans for Britain, was also found to have inaccurately reported a donation it received from Vote Leave and has been fined £250.
Vote Leave also returned an "incomplete and inaccurate spending report", with almost £234,501 reported incorrectly, and invoices missing for £12,849.99 of spending, the watchdog said.
A Vote Leave spokesman said: "The Electoral Commission's report contains a number of false accusations and incorrect assertions that are wholly inaccurate and do not stand up to scrutiny.
"It is astonishing that nobody from Vote Leave has been interviewed by the commission in the production of this report, nor indeed at any point in the past two years. Yet the commission has interviewed the so-called 'whistleblowers' who have no knowledge of how Vote Leave operated and whose credibility has been seriously called into question.
"Vote Leave has provided evidence to the Electoral Commission proving there was no wrongdoing. And yet despite clear evidence of wrongdoing by the Remain campaign, the commission has chosen to ignore this and refused to launch an investigation.
"All this suggests that the supposedly impartial commission is motivated by a political agenda rather than uncovering the facts.
"The commission has failed to follow due process, and in doing so has based its conclusions on unfounded claims and conspiracy theories.
"We will consider the options available to us, but are confident that these findings will be overturned."
The Electoral Commission hit back at allegations of political bias, saying: "We open investigations where the evidence justifies it, irrespective of the political views of the party or campaigner concerned."
It also insisted it had followed "due process" and had spent three months and made five attempts to interview Vote Leave representatives.
Months into the investigation, "certain Vote Leave staff members came to us separately and offered to be interviewed", an Electoral Commission source said, but by that point it had gathered enough evidence to conclude that an offence had occurred.
Asked whether it believed the referendum result was still valid, No 10 said the public delivered a "clear verdict" which the government was in the process of implementing.
But speaking in the Commons, former Tory home secretary Amber Rudd said ministers should not use this to "obfuscate" from its duty to protect the electoral system from abuses.
And Tory MP Sarah Wollaston, who voted to remain, called for the referendum to be re-run.
A separate Brexit campaign, Leave.EU, was fined £70,000 in March for failing to declare "at least" £77,380 it spent on referendum campaigning.
Leave.EU chief executive Liz Bilney was referred to the police following the commission's investigation. Leave.EU co-founder Arron Banks called it a "politically motivated attack" and said he would take the watchdog to court.
Leave.EU, which was fronted by then-UKIP leader Nigel Farage, was only allowed to spend £700,000 in the run up to the referendum, after losing out to Vote Leave in the battle to designated the official Leave campaign.
The official Remain campaign Britain Stronger in Europe, was fined £1,250 in December last year for not providing invoices and for declaring some spending in aggregate rather than individual payments.