BIC / SWIFT Validator

BIC / SWIFT codes: ISO 9362 and the global wire network

A Business Identifier Code (BIC), colloquially called a SWIFT code, is the standardized identifier defined by ISO 9362 for banks and financial institutions worldwide. Whenever you initiate a cross-border wire transfer — a USD remittance from New York to a Brazilian account at Itau, for example — the BIC tells the correspondent network exactly which institution and which branch should receive the funds.

The code is assigned and maintained by SWIFT (Society for Worldwide Interbank Financial Telecommunication), a Belgian cooperative founded in 1973 and headquartered in La Hulpe. The SWIFT network connects more than 11,000 institutions across 200+ countries and carries the bulk of the world's interbank messaging, including the classic MT103 customer credit transfer.

Anatomy of a BIC: 8 or 11 characters

A BIC has either 8 or 11 alphanumeric characters, decomposed in four fields:

• Positions 1-4 — Bank code: four letters identifying the institution (e.g. ITAU for Itau Unibanco, BRAD for Bradesco, CHAS for JPMorgan Chase).
• Positions 5-6 — Country code: ISO 3166-1 alpha-2 code (BR, US, DE).
• Positions 7-8 — Location code: two alphanumeric characters for the city or operational center. By convention, when position 8 is the digit 0, the BIC is a test code; 1 means passive participant; letters denote live, connected members.
• Positions 9-11 — Branch code (optional): three alphanumerics identifying a specific branch. XXX conventionally denotes the head office.

Real-world examples: ITAUBRSPXXX (Itau, Brazil, Sao Paulo head office), BRADBRSPRJO (Bradesco, Brazil, branch in Rio de Janeiro), CHASUS33XXX (JPMorgan Chase, USA, New York head office), DEUTDEFFXXX (Deutsche Bank, Germany, Frankfurt head office).

Validation rules and the regex shortcut

Syntactic validation can be done with a single regular expression: ^[A-Z]{6}[A-Z0-9]{2}([A-Z0-9]{3})?$. This enforces four uppercase letters for the bank, two for the country, two alphanumerics for the location and an optional three-character branch suffix. Additional semantic checks that any robust validator should layer on top:

• The country code (positions 5-6) must be a real ISO 3166-1 alpha-2 value — XX or ZZ would parse but cannot route.
• Position 8 should not be O unless the BIC is genuinely a test/training code; production BICs almost always end with a letter or 1/2 indicating connectivity status.
• The eight-character form is implicitly equivalent to the eleven-character form ending in XXX; many payment systems accept either.

The SWIFT network, sanctions and the 2022 disconnection

Despite being a private cooperative, SWIFT became a geopolitical instrument. In March 2022, following the invasion of Ukraine, the EU, US and UK ordered SWIFT to disconnect seven Russian banks (including VTB, Bank Otkritie and Sovcombank); Sberbank followed in June 2022. The episode accelerated existing alternative networks: SPFS (Sistema for the Transfer of Financial Messages, Russia), CIPS (Cross-border Interbank Payment System, China), INSTEX (EU-Iran, mostly dormant) and domestic instant-payment rails such as Pix in Brazil, UPI in India and FedNow in the US.

SWIFT itself is in the middle of a large modernization push: the migration from the legacy MT message format to ISO 20022 MX, scheduled to complete by November 2025. ISO 20022 carries structured XML data — full creditor and ultimate-debtor information — enabling better sanctions screening and richer end-to-end payment context.

Brazilian banks, costs and modern alternatives

Most Brazilian banks publish their BIC openly: ITAUBRSP (Itau), BRADBRSP (Bradesco), BCBRBRDF (Banco do Brasil), CEFXBRSP (Caixa), SANBBRSP (Santander Brazil), BNRIBRRJ (BNDES). A traditional SWIFT remittance into Brazil typically costs USD 15 to 50 in flat fees plus correspondent-bank charges, an FX spread of 1-4% and a settlement window of 1-3 business days. For consumer-scale transfers, services like Wise (formerly TransferWise), Remitly, Revolut and the new Pix Internacional initiatives bypass the correspondent chain by using local-rail settlement on both ends, often delivering cheaper FX and same-day arrival.

How to look up a BIC reliably

• SWIFT BIC Directory — the authoritative source, but a paid subscription product from SWIFT itself.
• SWIFT BIC Search (free) — www.swift.com/bsl provides a limited free lookup.
• Bank-code.net, theswiftcodes.com, iban.com — public mirrors useful for casual lookup; verify against the bank's own website before initiating large transfers.
• The receiving bank itself: every bank publishes its BIC on the corporate "international transfers" page. This is the safest source.

FAQ

Should I use an 8-character or 11-character BIC?

If the destination is the institution's head office, the 8-character form is enough — it is implicitly equivalent to the same code padded with XXX. Use the 11-character form when the bank instructs you to route to a specific branch.

Does the BIC contain the country?

Yes. Positions 5 and 6 carry the ISO 3166-1 alpha-2 country code. In ITAUBRSPXXX, BR = Brazil; in DEUTDEFFXXX, DE = Germany.

What is the difference between BIC, SWIFT code, IBAN and ABA?

BIC and SWIFT code are the same thing — BIC is the formal ISO 9362 name, "SWIFT code" is the colloquial name. IBAN (ISO 13616) identifies a specific account inside a country, mostly in Europe. ABA / routing number is the US domestic equivalent. International wires usually require BIC + IBAN (Europe) or BIC + account number (Americas, Asia).

Is there a domestic alternative to SWIFT in Brazil?

For domestic transfers, Pix (launched by the Banco Central in 2020) replaced TED/DOC for almost all retail use cases and settles instantly, 24/7, free for individuals. For cross-border retail, Wise, Remitly and Banco Central's emerging Pix Internacional initiatives are typically cheaper and faster than the SWIFT correspondent chain.

Why was Russia disconnected from SWIFT?

Following the 2022 invasion of Ukraine, the EU, US and UK ordered SWIFT — a Belgian cooperative — to disconnect seven Russian banks as part of the financial sanctions package. The disconnection is bank-specific, not country-wide, and Russia continues to use its domestic SPFS system internally.