How IBAN Validation Works: A Complete Guide

International Bank Account Numbers, commonly known as IBANs, are the backbone of cross-border payments across Europe and much of the world. Originally introduced to streamline international wire transfers within the Single Euro Payments Area (SEPA), the IBAN system has since been adopted by over 80 countries. Understanding how IBAN validation works is essential for anyone involved in international payments, whether you are a finance professional, a software developer building payment systems, or simply someone sending money abroad.

What Is an IBAN?

An IBAN is a standardized international numbering system developed by the International Organization for Standardization (ISO) under the ISO 13616 standard. Its primary purpose is to uniquely identify a bank account across national borders, reducing the risk of transcription errors and failed transfers.

Every IBAN consists of four key components:

• Country code: Two uppercase letters identifying the country where the account is held (e.g., FR for France, DE for Germany, GB for the United Kingdom, ES for Spain).
• Check digits: Two numeric digits immediately following the country code. These are computed using the mod-97 algorithm and serve as the primary error-detection mechanism.
• Bank identifier: A code identifying the specific financial institution. The length and format vary by country.
• Account number: The domestic account number, which may include branch codes and national check digits. Again, the length varies by country.

For example, a French IBAN looks like this: FR76 3000 6000 0112 3456 7890 189. Here, FR is the country code, 76 are the check digits, 30006 is the bank code (Societe Generale), 00001 is the branch code, 12345678901 is the account number, and 89 is the national check digit (cle RIB).

The Mod-97 Checksum Algorithm

The heart of IBAN validation lies in the mod-97 algorithm, defined by ISO 7064. This algorithm was specifically chosen because it catches over 99% of single-character errors and virtually all transposition errors (when two adjacent characters are swapped).

The validation process works as follows:

1. Rearrange the IBAN: Move the first four characters (country code and check digits) to the end of the string.
2. Convert letters to numbers: Replace each letter with a two-digit number where A = 10, B = 11, ..., Z = 35.
3. Compute the remainder: Calculate the remainder when the resulting large number is divided by 97.
4. Verify: If the remainder is exactly 1, the IBAN is valid. Any other result indicates an error.

For instance, to validate GB29 NWBK 6016 1331 9268 19:

1. Rearrange: NWBK 6016 1331 9268 19 GB29
2. Convert: N=23, W=32, B=11, K=20 becomes 2332112060161331926819161129
3. Compute: 2332112060161331926819161129 mod 97 = 1
4. Result: Valid.

When generating check digits for a new IBAN, the process is reversed. The check digits are initially set to 00, the mod-97 remainder is computed, and the check digits are set to 98 - remainder.

Country-Specific IBAN Formats

One of the complexities of IBAN validation is that each country defines its own IBAN length and internal structure. The ISO 13616 registry, maintained by SWIFT on behalf of ISO, lists the exact format for each participating country.

Here are some common examples:

| Country | Code | Total Length | Format | |---------|------|-------------|--------| | France | FR | 27 | FR + 2 check digits + 10 digits (bank/branch) + 11 digits (account) + 2 digits (national key) | | Germany | DE | 22 | DE + 2 check digits + 8 digits (bank code) + 10 digits (account) | | United Kingdom | GB | 22 | GB + 2 check digits + 4 letters (bank) + 6 digits (sort code) + 8 digits (account) | | Spain | ES | 24 | ES + 2 check digits + 4 digits (bank) + 4 digits (branch) + 2 digits (national check) + 10 digits (account) | | Netherlands | NL | 18 | NL + 2 check digits + 4 letters (bank) + 10 digits (account) | | Belgium | BE | 16 | BE + 2 check digits + 3 digits (bank) + 7 digits (account) + 2 digits (national check) |

A valid French IBAN has exactly 27 characters, while a German IBAN has 22. Submitting an IBAN with the wrong length for its country is one of the most common errors.

Common Validation Errors

In our experience processing thousands of IBANs through BankValidor, the most frequently encountered errors include:

1. Incorrect length: The IBAN does not match the expected length for the declared country. For instance, a French IBAN with 26 characters instead of 27.
2. Invalid check digits: The mod-97 computation does not return 1, indicating a transcription error somewhere in the IBAN. This is the error that the checksum algorithm is specifically designed to catch.
3. Invalid country code: The first two characters do not correspond to a valid ISO 3166-1 alpha-2 country code, or the country does not participate in the IBAN system (e.g., the United States does not use IBANs for domestic transfers).
4. Forbidden characters: The IBAN contains lowercase letters, special characters, or unexpected spaces in the wrong positions. IBANs should only contain uppercase letters (A-Z) and digits (0-9).
5. Invalid bank code: The bank identifier portion of the IBAN does not correspond to any known financial institution in the country's banking registry. This may indicate a closed bank, a typo in the bank code, or a fictitious IBAN.

How BankValidor Checks IBANs

BankValidor performs a comprehensive three-layer validation process for every IBAN submitted:

Layer 1 -- Syntax validation: We verify that the IBAN conforms to the ISO 13616 format for the declared country. This includes checking the total length, the character set (alphanumeric only), the validity of the ISO 3166-1 country code, and the internal structure (position and format of bank code, branch code, and account number).

Layer 2 -- Checksum verification: We apply the mod-97 algorithm as defined in ISO 7064 to verify the check digits. This mathematical verification catches single-character transcription errors and transposition mistakes with over 99% reliability.

Layer 3 -- Registry lookup: We cross-reference the bank identifier extracted from the IBAN against official databases. For SEPA countries, we consult the SEPA Participants Registry maintained by the European Payments Council (EPC), the SWIFT BIC Directory, and the ECB TARGET2 directory. This step confirms not only that the bank code is valid, but also retrieves the institution name, BIC/SWIFT code, address, and supported payment schemes (SCT, SDD, INST).

The combination of these three layers provides a high degree of confidence that the IBAN is structurally correct and corresponds to a real financial institution. However, it is important to understand that IBAN validation cannot confirm that the account is active, that funds are available, or that the beneficiary name matches the account holder. These limitations are inherent to any format-based validation system.

Beyond Validation: Best Practices

When working with IBANs in a professional context, we recommend the following practices:

• Always validate the IBAN format before submitting a payment order to your bank or payment service provider.
• Verify the beneficiary name through a separate channel, especially for first-time payments. Many SEPA banks now support Confirmation of Payee services.
• For high-value transfers, consider sending a small test payment first to confirm the IBAN is correct and the account is reachable.
• If you are building a payment system, integrate IBAN validation into your beneficiary onboarding flow to catch errors at the point of data entry, before any payment file is generated.

Understanding IBAN validation is the first step toward building reliable, error-free international payment workflows. BankValidor is designed to make this process as straightforward and trustworthy as possible.