IBAN Validator: Verify International Bank Account Numbers

What Is an IBAN?

An IBAN (International Bank Account Number) is a standardized, internationally recognized format for identifying bank accounts across national borders. Introduced by the European Committee for Banking Standards in the 1990s and formalized as ISO 13616, the IBAN system was designed to reduce errors and delays in cross-border payments.

Before IBANs, sending money internationally was error-prone. Different countries used different formats for account numbers, and a single transposed digit could misroute a payment for weeks. The IBAN solves this by encoding all the necessary routing information — country code, bank identifier, and account number — into a single string with a built-in checksum for validation.

Today, IBANs are used in over 80 countries, primarily in Europe, the Middle East, and parts of Africa and the Caribbean. The RiseTop IBAN validator lets you instantly verify any IBAN format and checksum.

Understanding the IBAN Structure

Every IBAN follows the same general structure, regardless of the country:

IBAN Format: [Country Code][Check Digits][BBAN]
Example:     GB29 NWBK 6016 1331 9268 19

- Country Code (2 chars): ISO 3166-1 alpha-2 (e.g., GB, DE, FR)
- Check Digits (2 chars): ISO 7064 mod-97 checksum
- BBAN (variable length): Basic Bank Account Number,
  country-specific format containing bank code,
  branch code, and account number

The country code immediately tells you which country the account belongs to. The check digits catch most transcription errors — if someone misreads or mistypes even a single character, the checksum will fail. The BBAN (Basic Bank Account Number) is the country-specific portion that contains the actual bank and account identification.

Here are IBAN examples from several countries:

• Germany (DE): DE89 3704 0044 0532 0130 00 (22 characters)
• France (FR): FR76 3000 6000 0112 3456 7890 189 (27 characters)
• United Kingdom (GB): GB29 NWBK 6016 1331 9268 19 (22 characters)
• Spain (ES): ES91 2100 0418 4502 0005 1332 (24 characters)
• United Arab Emirates (AE): AE07 0331 2345 6789 0123 456 (23 characters)
• Saudi Arabia (SA): SA03 8000 0000 6080 1016 7519 (24 characters)

How the IBAN Checksum Works

The IBAN checksum uses the ISO 7064 mod-97 algorithm, which is specifically designed for error detection in numeric strings. Here is how it works:

Step-by-Step Checksum Validation

1. Rearrange: Move the first four characters (country code + check digits) to the end of the IBAN
2. Convert letters to numbers: Replace each letter with its position in the alphabet + 9 (A=10, B=11, ..., Z=35)
3. Calculate mod-97: Divide the resulting number by 97
4. Verify: If the remainder is exactly 1, the IBAN is structurally valid

Let us walk through an example with the German IBAN DE89 3704 0044 0532 0130 00:

Original: DE89 3704 0044 0532 0130 00
Step 1 (rearrange): 370400440532013000DE89
Step 2 (convert):   370400440532013000131489
Step 3 (mod 97):    370400440532013000131489 mod 97 = 1
Result: VALID

This algorithm catches all single substitution errors (typing one wrong character), all single transposition errors (swapping two adjacent characters), and most other common transcription mistakes.

Common IBAN Validation Errors

Incorrect Length

Each country has a fixed IBAN length. A German IBAN is always 22 characters, a French one always 27. If the length does not match the expected value for the country code, the IBAN is immediately invalid — no checksum calculation needed.

Invalid Characters

IBANs contain only uppercase letters (A-Z) and digits (0-9). Spaces are allowed for readability but should be stripped before validation. Any lowercase letters should be converted to uppercase, and any other characters make the IBAN invalid.

Checksum Mismatch

If the mod-97 calculation does not yield 1, the IBAN has been corrupted. This could mean a digit was mistyped, a letter was confused with a number (like O and 0, or I and 1), or the IBAN was fabricated entirely.

Nonexistent Country Code

The IBAN must start with a valid two-letter ISO country code. While some countries have adopted the IBAN system, others (like the United States, Canada, and Australia) have not. An IBAN starting with "US" or "CA" is structurally invalid.

IBAN vs Other Payment Identification Systems

IBAN vs SWIFT/BIC

While IBAN identifies a specific account, SWIFT/BIC (Bank Identifier Code) identifies the financial institution. A BIC is 8 or 11 characters and looks like NWBKGB2L or DEUTDEFF500. International transfers often require both the BIC (to route to the bank) and the IBAN (to identify the account within that bank).

IBAN vs ABA Routing Number

In the United States, domestic transfers use ABA routing numbers (9 digits) combined with account numbers. The US has not adopted the IBAN system, so sending money to a US bank requires the routing number and account number separately.

IBAN vs IFSC Code

India uses IFSC (Indian Financial System Code), an 11-character alphanumeric code that identifies specific bank branches. Like the US, India does not use IBANs. International transfers to India require the SWIFT code, IFSC code, and account number.

How to Validate IBANs Programmatically

For developers working with international payments, IBAN validation should be implemented at the point of data entry. Here is a Python example:

def validate_iban(iban):
    iban = iban.replace(' ', '').upper()
    
    if len(iban) < 15 or len(iban) > 34:
        return False
    if not iban[:2].isalpha():
        return False
    if not iban[2:4].isdigit():
        return False
    
    rearranged = iban[4:] + iban[:4]
    numeric = ''
    for char in rearranged:
        if char.isdigit():
            numeric += char
        else:
            numeric += str(ord(char) - 55)
    
    return int(numeric) % 97 == 1

This function performs the complete validation pipeline: length check, character validation, rearrangement, letter conversion, and mod-97 calculation. For production use, also add country-specific length validation to catch length mismatches early.

SEPA and the Importance of IBAN Validation

The Single Euro Payments Area (SEPA) is a European Union initiative that standardizes euro-denominated payments across 36 countries. Within SEPA, IBANs are mandatory for all credit transfers and direct debits. The SEPA Credit Transfer (SCT) scheme requires that both the sending and receiving IBANs be valid and that the payment reaches the recipient within one business day.

For businesses operating in or with Europe, IBAN validation is not optional — it is a regulatory requirement. Incorrect IBANs can result in rejected payments, fees, and compliance issues. Validating IBANs before submitting payments can save significant time and money.

IBAN Validation in JavaScript

Frontend validation is just as important as backend validation. Here is how to validate an IBAN in JavaScript before it reaches your server:

function validateIBAN(iban) {
    iban = iban.replace(/\s/g, '').toUpperCase();
    
    if (iban.length < 15 || iban.length > 34) return false;
    if (!/^[A-Z]{2}\d{2}/.test(iban)) return false;
    
    const rearranged = iban.slice(4) + iban.slice(0, 4);
    let numeric = '';
    for (const char of rearranged) {
        numeric += char.match(/\d/) 
            ? char 
            : (char.charCodeAt(0) - 55).toString();
    }
    
    let remainder = '';
    for (const digit of numeric) {
        remainder = (remainder + digit) % 97;
    }
    return remainder === 1;
}

This implementation uses modular arithmetic with string processing to handle the potentially very large numbers that IBAN conversion produces, avoiding JavaScript number precision issues.

Best Practices for Working with IBANs

• Validate early: Check IBANs at the point of entry (form submission, API call) to catch errors immediately
• Strip spaces: Always remove spaces before validation, as users commonly include them for readability
• Accept lowercase: Convert input to uppercase before validation
• Show formatted output: Display IBANs in groups of 4 characters for readability after validation
• Validate on both client and server: Client-side validation improves UX; server-side validation ensures security
• Log validation failures: Track failed validations to identify systematic data entry issues

The RiseTop IBAN validator implements all of these best practices in a free, easy-to-use online tool. Simply paste any IBAN and get instant feedback on its validity, country of origin, and structure breakdown.

IBAN Country Length Reference

Here is a quick reference for IBAN lengths across major countries:

• Andorra (AD): 24 characters
• Austria (AT): 20 characters
• Belgium (BE): 16 characters
• Croatia (HR): 21 characters
• Cyprus (CY): 28 characters
• Czech Republic (CZ): 24 characters
• Denmark (DK): 18 characters
• Estonia (EE): 20 characters
• Finland (FI): 18 characters
• France (FR): 27 characters
• Germany (DE): 22 characters
• Greece (GR): 27 characters
• Hungary (HU): 28 characters
• Ireland (IE): 22 characters
• Italy (IT): 27 characters
• Netherlands (NL): 18 characters
• Norway (NO): 15 characters
• Poland (PL): 28 characters
• Portugal (PT): 25 characters
• Spain (ES): 24 characters
• Sweden (SE): 24 characters
• Switzerland (CH): 21 characters
• United Arab Emirates (AE): 23 characters
• United Kingdom (GB): 22 characters

Validating IBANs correctly is essential for anyone dealing with international payments. Whether you are a developer building a payment system, a business processing cross-border transactions, or an individual sending money abroad, understanding how IBAN validation works helps prevent costly errors and ensures your payments arrive at the right destination.

Related Articles