Country Bank Account Validator

Bank account number formats across countries: a developer's reference

There is no global standard for bank account numbering. IBAN (ISO 13616) was designed in 1997 as a Pan-European harmonization layer, but adoption stops at the EU/EFTA border plus a few South American and Middle Eastern countries. The rest of the world — including Brazil, the United States, the United Kingdom (domestically), Canada and Japan — keeps its own legacy account formats. A robust multi-country validator must branch on country first, then apply the rules below.

Country-by-country format cheat sheet

• Brazil: agencia 4 digits + optional 1-digit DV; conta 4-10 digits + 1-digit DV. Bank-specific check-digit algorithms (no national standard) — see validador-conta-bancaria.
• United States: 9-digit ABA routing number with a modified mod-10 checksum; account number 4-17 digits with no national check digit.
• United Kingdom: 6-digit sort code formatted XX-XX-XX + 8-digit account. Sort code routes to the branch; account has no embedded check digit. Confirmation of Payee (CoP), live since 2020, validates the holder's name against the account.
• Germany: IBAN-only since 2014 (DE + 20 chars). The legacy BLZ + Kontonummer is gone from end-user-facing forms.
• France: RIB (Relevé d'Identité Bancaire), 23 characters: 5 bank + 5 branch + 11 account + 2 RIB key (mod 97). RIB is encapsulated inside the French IBAN.
• Japan: 4-digit bank code + 3-digit branch code + 7-digit account, no embedded check digit.
• China: 16-19 digit numbers in UnionPay format; check digit via Luhn.
• India: 11-character IFSC (4 letters + 0 + 6 alphanumeric) + 9-18 digit account.

ABA Routing Number (US): the mod-10 algorithm

The 9-digit ABA Routing Transit Number (RTN) carries a weighted mod-10 checksum. Given digits d1..d9, the sum 3*(d1+d4+d7) + 7*(d2+d5+d8) + (d3+d6+d9) must be divisible by 10. The first two digits encode the Federal Reserve district. RTNs are printed on the bottom-left of paper checks in the MICR line (E-13B font) for machine-readable processing.

function validateABA(rtn) {
  if (!/^\d{9}$/.test(rtn)) return false
  const d = rtn.split('').map(Number)
  const sum = 3*(d[0]+d[3]+d[6]) + 7*(d[1]+d[4]+d[7]) + (d[2]+d[5]+d[8])
  return sum % 10 === 0
}

UK sort code and account number: the modulus check tables

The UK uses 6-digit sort codes (3 pairs separated by hyphens) plus 8-digit accounts. The validity check is governed by Vocalink's "Modulus Checking" document, a publicly released PDF mapping each sort-code range to one of three algorithms: modulus 10, modulus 11 or DBLAL (double-alternating). Some sort-code ranges require running two algorithms back-to-back, and a handful skip validation entirely. For real-world apps, use the Confirmation of Payee API rather than re-implementing the table.

Cross-border payment rails and the role of SWIFT

For international transfers, the universal pair is BIC (SWIFT code) + IBAN (or local account number where IBAN does not exist). SWIFT routes the message between banks; IBAN identifies the destination account. Modern alternatives that bypass SWIFT for domestic instant payments:

• Brazil: Pix (BCB, 2020) — instant 24/7, keyed by CPF/CNPJ/email/phone/random UUID.
• United States: FedNow (Federal Reserve, 2023) and RTP (The Clearing House, 2017).
• United Kingdom: Faster Payments Service (FPS), since 2008.
• European Union: SEPA Instant Credit Transfer (SCT Inst), since 2017.
• India: UPI (NPCI, 2016), keyed by virtual payment address.

Brazilian fintech, cross-border and the dLocal/EBANX rails

Brazilian fintech expansion (Wise, Nubank, Stripe Connect BR) shows the convergence pattern: a local rail for receiving (Pix, TED) plus SWIFT/IBAN for sending abroad. Multi-country e-commerce processors Mercado Pago, dLocal, EBANX hide all of this behind a single API: you POST a customer record with their local document and they pick the right rail per country. For developers building multi-country forms, libraries like iban (npm), schwifty (Python) and BankAccountValidator (.NET) cover the IBAN family; brittle local checks (Brazil, UK, US) tend to need country-specific packages.

PCI DSS and storage of account data

Bank account numbers are not "cardholder data" under PCI DSS (which covers PAN, CVV, expiry), but they are regulated personal data under LGPD, GDPR and equivalent laws. Never store full account numbers in client-side storage (localStorage, IndexedDB) and never log them in plain text. Encrypt at rest with envelope encryption (AWS KMS, GCP KMS), mask all but the last 4 in UIs, and rotate access tokens regularly.

FAQ

Does Brazil use IBAN?

Only for international transfers. Domestic Brazilian accounts use the agency + account + DV pattern; IBAN is generated on demand for SWIFT messages.

Is the US ABA routing number really 9 digits?

Yes — exactly 9 digits with a weighted mod-10 checksum. Account numbers in the US vary 4-17 digits and have no embedded check.

Is there one library that covers all countries?

No fully comprehensive one exists. iban npm covers ISO 13616 countries; you still need country-specific packages for Brazil, US ABA, UK Vocalink and India IFSC.

What is Confirmation of Payee?

A UK service (mandatory since 2020 for large banks) that cross-checks the holder name against the account number before allowing a transfer. It blocks authorized-push-payment fraud and is being adopted by other countries.

Can I validate any account just by format checking?

No. Format checks tell you the string is well-formed; they cannot confirm the account exists or belongs to the named person. For that you need bank APIs, CoP-style services, or pre-notes (small test debits/credits).