The EU Commission has told EU states to tighten checks on non-EU nationals who acquire citizenship - so-called "golden passports" - through investments.
The Commission plans closer monitoring of those schemes and of "golden visas" granting residence in exchange for big investments. It says they can be abused for tax evasion and money-laundering.
EU citizenship gives an individual free movement in most of the EU, easy access to the single market and other rights.
Twenty EU countries have such schemes.
Cyprus, Malta and Bulgaria give passports to non-EU nationals who make sufficient investments in their countries. Rich foreigners can buy passports there for between €1m (£870,000; $1.1m) and €2m.
They and 17 other EU member states, including the UK, also grant residence rights to investors. That right puts an individual on the path to citizenship.
The scale of investment required to obtain residence ranges from about €13,500 in Croatia to more than €5m in Luxembourg and Slovakia.
In a new report the Commission says there is not enough information about how the schemes work. It is setting up a special team to monitor the schemes and boost information-sharing.
The report says applicants can acquire citizenship of Bulgaria, Cyprus or Malta, and hence EU citizenship, "without ever having resided in practice in the member state".
The anti-corruption campaign group Global Witness said the EU had raised the alarm but not offered solutions, the BBC's Adam Fleming reports from Brussels.
In a report last October another anti-corruption group, Transparency International, said Spain, Hungary, Latvia, Portugal and the UK had granted the most golden visas to investors and their families, ahead of Greece, Cyprus and Malta.
"Such programmes are big business. Around €25bn in foreign direct investment has flowed into the EU through these schemes over the past 10 years," it said.
The Commission says the schemes often advertise the benefits of EU citizenship, such as free movement rights, in order to attract rich investors.
EU Justice Commissioner Vera Jourova argued that people obtaining an EU nationality "must have a genuine connection to the member state concerned".
"We want more transparency on how nationality is granted and more co-operation between member states. There should be no weak link in the EU, where people could shop around for the most lenient scheme."
List of concerns
The Commission says it has several areas of concern:
- Security: checks run on applicants are not sufficiently robust and the EU's own centralised information systems, such as the Schengen Information System (SIS), are not being used systematically enough
- Money-laundering: extra checks - called "due diligence" - are necessary to ensure that EU rules against money-laundering are not avoided
- Tax evasion: monitoring and reporting is necessary to make sure that individuals do not exploit these schemes in order to gain tax advantages
- Transparency and information: there is a lack of clear information on how the schemes are run, including on the number of applications received, granted or rejected and the origins of the applicants; EU states are failing to inform each other about applicants
"Under none of the three investor citizenship schemes is comprehensive information available about the identity of people who successfully obtain citizenship on the basis of investment, and their countries of origin," the Commission report says.
It also voices concern about similar schemes run by countries with ambitions to join the EU. Moldova, close to EU member Romania, is among them - its citizens enjoy visa-free travel to the EU for short stays.
A non-EU national who acquires Moldovan citizenship can use it to bypass EU visa rules, the report points out.