A whistleblower who worked for the official Vote Leave campaign has broken cover to raise concerns that the masterminds behind the 2016 vote – including key figures now working for Theresa May in Downing Street – may have flouted referendum spending rules and then attempted to destroy evidence.

The allegations, from former volunteer Shahmir Sanni, are detailed in an interview in the Observer and supported by a mass of documents and files that he has passed to the Electoral Commission and the police.

Sanni’s central claim concerns a donation of £625,000 that Vote Leave ostensibly made to an independent referendum campaign organisation called BeLeave. He claims the money, channelled to a digital services firm linked to the controversial Cambridge Analytica firm, violated election rules because it was not a genuine donation.

The money was registered by BeLeave with election authorities as a donation from Vote Leave to an independent youth operation. Sanni says BeLeave shared offices with Vote Leave – fronted by Boris Johnson and Michael Gove – which in practice offered advice and assistance to the group and helped them to decide where their cash would be spent.

British electoral law prohibits co-ordination between different campaign organisations, which must all comply with spending limits. If they plan tactics or co-ordinate together, they must have a shared cap on spending. Vote Leave strongly denies any such co-ordination.

Sanni says that after the commission opened an investigation last March, an account in the name of Victoria Woodcock, the operations director for Vote Leave, deleted Woodcock, campaign director Dominic Cummings and Vote Leave’s digital director, Henry de Zoete, from dozens of files on the drive Vote Leave shared with BeLeave, apparently to hide the fact of co-ordination.

On a blog post on Friday, Cummings said this was “factually wrong and libellous”. Vote Leave say staff acted “ethically, responsibly and legally in deleting any data”. Woodcock told the Observer that any suggestion that she was involved in “knowingly and deliberately” deleting evidence “which would be relevant to an investigation” was “untrue and completely unsupported by the evidence.”

Woodcock added in June 2018, three months after she was originally contacted for comment, that she had nothing to do with the deletions. She explained that the administrator account which made the deletions bore her name because she had originally set up the shared drive. She clarified, however, that she had handed over control to Vote Leave on 17 March 2017 (and no longer had access to the drive) before the deletions took place later on the same day. Vote Leave said, in a statement to the electoral commission in April 2018, that it restricted access to the documents as part of a routine data protection exercise.

Most of the £625,000 donation went to a Canadian data company called AggregateIQ, which has links to Cambridge Analytica, the firm that used harvested Facebook data to build a political targeting system in the US. Christopher Wylie, the former CA employee turned whistleblower, said that at the time of the referendum, the Canadian firm was operating “almost as an internal department of Cambridge Analytica”.

AIQ would eventually soak up about a third of all Vote Leave’s official spending, receiving £2.7m from the group in addition to the money that came via BeLeave. The firm also received £100,000 from Veterans for Britain and £32,750 from the DUP. After the referendum, Cummings stated on AIQ’s website: “Without a doubt, the Vote Leave campaign owes a great deal of its success to the work of Aggregate IQ. We couldn’t have done it without them.”

Other senior figures in Vote Leave included Stephen Parkinson, now Theresa May’s chief adviser. Parkinson said in a statement: “I am clear that I did not direct the activities of any separate campaign groups. I had no responsibility for digital campaigning or donations during the referendum and am confident that Vote Leave acted entirely within the law and strict spending rules at all times.”

Sanni, who was treasurer and secretary of BeLeave at 22, is still a committed Eurosceptic and works at the TaxPayers’ Alliance campaign group. He says he decided to go public because he did not want Brexit to be tainted by possibly illegal activities.

He was also alarmed by the fact that his friend, Darren Grimes, the former head of the BeLeave youth group, is a focus of an Electoral Commission investigation into breaches of spending limits.

Sanni said Vote Leave “didn’t really give us that money. They just pretended to. We had no control over it”.

He believes Vote Leave’s senior officials may have taken advantage of the group’s youth and the political inexperience of Grimes to ramp up their own spending. He emphasises BeLeave was a small Brexit-supporting outreach group run by twentysomethings with no real experience or background in campaigning or finance.

He says that it was helped by Vote Leave staff to set up its own constitution and bank account so that it could accept donations of its own. Vote Leave’s lawyers did the legal documentation, he said.

“We were advised every step of the way by Vote Leave’s lawyers. They told us what to do and where to sign.”

The payment to AIQ was ostensibly made by BeLeave as the referendum campaign drew to a close. But Sanni claims BeLeave didn’t have any choice about where the cash would be spent, didn’t sign a contract with AIQ, and did not direct what the data firm did with the funds. The money never even passed through the group’s own bank account.

“There was no contract in front of me, as treasurer and secretary,” Sanni said. “I didn’t see any contract.” This process was repeated with a further £50,000, from an outside donor.

Vote Leave said: “It was Darren’s decision to hire AIQ, agreed with and confirmed by Shahmir Sanni.”

Venner Shipley, Vote Leave’s lawyers, said: “We have never been instructed by, nor have we ever provided advice to BeLeave.”

Sanni has shared emails with the Observer and the authorities which appear to show the young campaigners seeking advice from top Vote Leave figures, an invoice to VoteLeave covering work on the BeLeave campaign and messages from Vote Leave lawyers and accountants about the practicalities of establishing it as an independent group.

Sanni explained that Vote Leave also set up and managed a shared BeLeave computer drive with the youth campaign’s messaging, information and other documents.

The emails reveal other senior figures were in regular contact with BeLeave. Cleo Watson, who was head of outreach for Vote Leave and is now a political adviser alongside Parkinson in Downing Street, was in touch with the organisation and was a member of a closed Facebook group for BeLeave contributors. In a statement to the Observer, Watson said: “I absolutely deny the claims being levelled against me.”

This weekend Parkinson was at the centre of a political storm after revealing in a statement delivered without Sanni’s consent that they dated each other for a year and a half, including the period when Parkinson was at Vote Leave and Sanni worked as a volunteer.

Parkinson said he only gave Sanni advice and guidance in the context of that relationship. In a statement released on Friday night, lawyers for Sanni said: “We believe this is the first time a Downing Street official statement has been used to out someone. My client is now having to come out to his mother and family ... and members of his family are being forced to take urgent protective measures to ensure their safety.”

In one email to Vote Leave’s lawyer, Watson acknowledged that BeLeave did not have the experience needed to handle the funds that would be spent in their name, stating: “Darren and the rest of the group (all between 18 & 22) don’t feel comfortable handling the money side of things, having no experience beyond their student loans.”

In a statement to the Observer, Watson said: “To imply that being supportive of their work was to have any kind of control over their activities is absolutely untrue.”

Woodcock, the operations director for Vote Leave, has been described by Cummings as “the most indispensable person in the campaign”. The documents provided by Sanni suggest that after the Information Commissioner’s Office last year announced an inquiry into how the campaigns used personal data, key Vote Leave names, including her own, were deleted from access to dozens of files on the shared BeLeave drive by an administrator’s account under Woodcock’s name.

Woodcock told the Observer that any suggestion that she was involved in ”knowingly and deliberately” deleting evidence “which would be relevant to an investigation” was “untrue and completely unsupported by the evidence.”

Woodcock explained in June 2018, three months after she was originally contacted for comment, that while an administrator account in her name had made the access deletions, she had lost access to the drive before the deletions took place. Vote Leave said in a statement to the Electoral Commission in April 2018, that it restricted access to the documents as part of a routine data protection exercise.

Cummings said: “The allegations about illegal donations to BeLeave are false and are part of a campaign to cancel the referendum result.”

Further evidence of contact between senior figures at Vote Leave and BeLeave during the referendum came in a witness statement from Matthew Elliott, the campaign chief, which was submitted to the High Court on March 13, 2018 as part of a judicial review.

“I can confirm distinct campaigns were run,” Elliott says, who added that he was including some examples of BeLeave publicity work to help clarify details. “I thought it may assist the Court in having examples of the campaign material used by the different campaigns and I attach those.”

A photograph attached shows a group of young people – including Grimes – beneath the BeLeave logo. But emails detail how on 18 March 2016, it was Cleo Watson who organised that photoshoot. In another email from 22 March, it was Stephen Parkinson who signed off on the logo.

In February 2016, a leaked email from prominent Brexit supporter, Steve Baker, now a junior minister in the Department for Exiting the European Union, floated the idea of creating “separate legal entities each of which could spend £700,000”.

Sanni believes this is exactly what happened with BeLeave. “Throughout this whole process Darren and I were victims to very intelligent people trying to find ways to overspend.” Sanni said. He described Grimes as a ‘fall guy’.

Grimes denied to the Observer that there was any collaboration with Vote Leave on campaign material or spending, and threatened legal action.

• 13 July 2018: After we received notification from Victoria Woodcock, we clarified this article to make clear what Ms Woodcock had told us, namely that although her name appeared as the administrator for a shared Google drive, her permissions had been removed and she was not the individual responsible for the removal of permissions for herself and others from the shared Google drive. We accept that these removals were made by someone else, using an account bearing Ms Woodcock’s name. We accept that Ms Woodcock did not try to destroy evidence and that allegations of trying to thwart official investigations or pervert the course of justice do not fairly arise against her from this reporting. We regret any distress caused.

• Addendum, 29 March 2018: we are happy to clarify that we did not intend to suggest that AggregateIQ is a direct part and/or the Canadian branch of Cambridge Analytica or that it has been involved in the exploitation of Facebook data or otherwise in any of the alleged wrongdoing made against Cambridge Analytica. Further we did not intend to suggest that AIQ secretly and unethically coordinated with Cambridge Analytica on the EU Referendum. We are happy to make clear that AggregateIQ is and has always been 100% Canadian owned and operated.