IBAN Validator

How does IBAN validation work?

The IBAN (International Bank Account Number) follows the ISO 13616 standard. It opens with a two-letter country code, then two check digits and, last, the domestic bank account number (BBAN). Each country sets a fixed length (Germany 22, France 27, Brazil 29, United Kingdom 22) and its own BBAN structure.

Validation relies on the mod-97 algorithm from ISO 7064. The first four characters move to the end, letters become numbers (A=10, B=11, …, Z=35) and the resulting number is divided by 97. A remainder of 1 means the IBAN is structurally valid.

What validation guarantees is that the check digits match the BBAN. It does not tell you whether the account exists or is active, since only the bank can confirm that. The whole check happens in your browser, and the IBAN never reaches any server.

IBAN under ISO 13616: the global bank account format

The International Bank Account Number (IBAN) is defined by ISO 13616, first published in 1997 and revised in 2007 and 2020. It exists to make cross-border payments routable without ambiguity: every IBAN encodes the country, the bank identifier, the branch (when applicable) and the local account number into one string that fits a SWIFT MT103 message or an ISO 20022 pacs.008 payload.

An IBAN is composed of a 2-letter country code (ISO 3166-1 alpha-2), 2 check digits, and a country-specific BBAN (Basic Bank Account Number). Total length is fixed per country and ranges from 15 (Norway) to 34 characters. The registry is maintained by SWIFT as the official ISO 13616 registration authority.

The mod-97-10 check digit algorithm (ISO 7064)

IBAN check digits use the ISO 7064 mod 97-10 scheme, the same family that protects EU VAT IDs and ICCID SIM numbers. To validate:

• Move the first 4 characters (country + check digits) to the end of the string.
• Replace every letter with two digits: A=10, B=11, ..., Z=35.
• Interpret the resulting decimal string as a large integer.
• The IBAN is valid if integer mod 97 == 1.

iban = "DE89370400440532013000"
move = "370400440532013000DE89"
sub  = "370400440532013000131489"
       (D=13, E=14)
n mod 97 = 1  -> valid

To generate the check digits, set them to 00, run the same transformation, take 98 - (n mod 97) and pad to two digits. This guarantees the final mod-97 = 1 invariant.

Length by country

• BR Brazil: 29 — BR97 0036 0305 0000 1000 9795 493P 1
• PT Portugal: 25; DE Germany: 22; GB UK: 22
• FR France: 27; ES Spain: 24; IT Italy: 27
• NL Netherlands: 18; CH Switzerland: 21; BE Belgium: 16

A robust validator must check both the length against the country registry and the mod-97 result. Many payment APIs (Wise, Adyen, Stripe Treasury) reject IBANs that match arithmetically but have the wrong length for the declared country — a strong signal of typo or copy/paste corruption.

SEPA, TARGET2 and SEPA Instant

IBAN is the entry point for the SEPA (Single Euro Payments Area) rails operated by the European Central Bank. SEPA covers 36 countries (EU + EEA + UK + Switzerland + Monaco + microstates). Within SEPA:

• SEPA Credit Transfer (SCT): settles within 1 business day.
• SEPA Instant (SCT Inst): 10-second settlement, 24/7, up to EUR 100,000 per transfer.
• TARGET2: ECB's real-time gross settlement system for high-value transfers.
• SEPA Direct Debit (SDD): pull payments using IBAN + mandate.

Brazil is not a SEPA member; Brazilian IBANs exist on the registry but are virtually never used domestically — Pix (key, QR or copia-e-cola) has crowded out IBAN-style identifiers inside the country. The Brazilian IBAN appears mostly in remessa internacional wires where the counterparty bank requires ISO 13616 routing.

Libraries, AML and OFAC screening

Battle-tested libraries: iban on npm (Kevin Boltz), schwifty for Python, iban4j for Java. They wrap the mod-97 math plus the SWIFT registry tables. For compliance, IBAN validation is always paired with:

• OFAC / EU sanctions screening: the BBAN's bank code is matched against blocklists.
• AML (anti-money laundering): transaction monitoring layered on top of valid IBANs.
• BIC inference: in some countries the BBAN encodes the bank code, making the BIC/SWIFT optional.

FAQ

Does Brazil use IBAN domestically? No. Brazilian IBANs exist on paper but are used almost exclusively for inbound international wires. Domestic transfers use Pix, TED or DOC, all keyed by agency + account number, not IBAN.

Does SEPA include Brazil? No. SEPA is restricted to 36 European countries. A SEPA Credit Transfer cannot be sent to a BR IBAN — the bank will reject or route it as a SWIFT wire (more expensive, slower).

Can I check an account balance from an IBAN? No. An IBAN is an identifier, not an authentication token. Balance and statement access require open banking consent (PSD2 in Europe, Open Finance in Brazil) signed by the account holder.

Why do BR IBANs have 29 characters? Brazil's BBAN packs the 8-digit bank code, the 5-digit branch (agencia), the 10-digit account, an account type and a check character — all required by Bacen's internal routing scheme.

Does the mod-97 check guarantee the account exists? No. It only proves the IBAN is well-formed. Confirming that the account exists and is open requires an IBAN verification API (Wise, ClearBank, SurePay), often used to prevent confirmation-of-payee fraud.