Institutions told to trace who is really financing their work or risk falling foul of national security law