Schemes of some EU states to sell passports and visas to wealthy foreigners could help organised crime groups infiltrate the bloc and raise the risk of money laundering, corruption and tax evasion.
The warning is contained in an EU Commission report on the multi-billion-euro industry of so-called "investment migration".
Although legal, these programmes are often run in an opaque way, Brussels warns.
Dimitris Avramopoulos, EU Home Affairs Commissioner: "There is a lack of available information on the practical implementation as well as discretion in the way member states approach security concerns.
On top of that the total number of residence permits granted by member states is unknown due to lack of transparency and specific oversight of these schemes.
We are not here either to name or blame. We are sending a very clear and strong warn alarm."
Malta, Cyprus and Bulgaria are the only EU countries which sell their citizenship, issuing "golden passports" to, for instance, rich Russians.
The Commission's report said Malta and Cyprus did not sufficiently check the origins of wealth of individuals who bought citizenship and did not allow for their easy identification.
In reaction to the EU report, Cypriot President Nicos Anastasiadis accused Brussels of "double standards".
He said Cyprus was being unfairly targeted and that it applied the "strictest criteria" for such schemes in the EU.
Brussels said a group of experts would recommend by the end of 2019 a common set of security checks for passport-for-sale programmes.