Technical

BIC

Bank Identifier Code

The international SWIFT code that identifies a bank (8 or 11 characters). No longer mandatory within SEPA since 2016, but essential for international transfers outside the euro area.

Definition

The BIC (Bank Identifier Code), also known as the SWIFT code, is the international identifier of a bank, defined by the ISO 9362 standard.

Made up of 8 or 11 characters, it unambiguously designates an institution (and optionally a branch) anywhere in the world. Since 2016 it is no longer mandatory within SEPA — the IBAN is enough — but it remains essential for international transfers outside the euro area.

Anatomy of a BIC

Four blocks, using the example BNPAFRPPXXX:

  • 4 letters — the bank (BNPA = BNP Paribas).
  • 2 letters — the country (ISO 3166: FR).
  • 2 characters — the location, often the city (PP = Paris).
  • 3 optional characters — the branch (XXX = head office).

That gives either BNPAFRPP (8 characters) or BNPAFRPPXXX (11 characters with the branch).

BIC vs IBAN

The most common confusion:

  • BIC — identifies the bank.
  • IBAN — identifies the specific account within that bank.

A BIC on its own enables no transfer (the account is missing); an IBAN on its own is enough within SEPA, because it already contains the bank code needed to derive the BIC. That is precisely why the BIC became optional within SEPA in 2016.

When the BIC is still useful

  • International transfer outside SEPA: sending USD, CHF or GBP outside the euro requires the BIC on the SWIFT side.
  • Identifying a bank: a stable, global identifier, handy for databases, routing rules or reporting.
  • VoP: the beneficiary's bank often uses it internally to route the call.
  • Accounting reconciliation: some export formats (CAMT, MT940) identify counterparties by their BIC.

What the BIC does not do

  • It does not identify an account: that's the IBAN.
  • It does not validate an account holder: that's VoP.
  • It is no longer required within SEPA since 2016 (EU Regulation 260/2012).
  • It says nothing about a bank's solvency (that is the job of Moody's, S&P, etc. ratings).

BIC connected to SWIFT or not

Not every BIC is connected to the network:

  • Connected BIC (8th character ≠ 0): the bank actively uses SWIFT for international messaging.
  • Non-connected BIC (8th character = 0): an identification-only BIC, with no direct receipt of SWIFT messages — typical of small banks or certain fintechs.

A technical detail that can take you by surprise during a pan-European integration.

In the PSD2 ecosystem

In PSD2 APIs (STET, Berlin Group), the BIC appears in the bicFi field or its equivalent. Rarely required on the payer side (the IBAN is enough), it is still passed in clearing flows and shown on statements.

Real-world examples

  • A few French BICs: BNP Paribas BNPAFRPPXXX, Société Générale SOGEFRPPXXX, Crédit Agricole IDF AGRIFRPPXXX, LCL CRLYFRPPXXX, Boursorama BOUSFRPPXXX, Revolut Bank UAB (Lithuania) REVOLT21XXX, N26 Bank GmbH (Germany) NTSBDEB1XXX.
  • A classic mistake: a customer types their BIC by hand and gets it wrong. The fix: derive it automatically from the IBAN via a library (iban on npm, iban4j), which removes the manual entry and half the errors.
  • Wise / Revolut: their BICs are Lithuanian, Belgian or Irish depending on their licence. Perfectly usable within SEPA for a French customer, even if an employer or public service may be surprised by them (and wrongly reject them).
  • PSD2 API: in a STET request, the BIC sits in debtorAgent.bicFi. A BIC that does not exactly match the one derived from the IBAN usually does not cause the payment to fail — a tolerance commonly applied on the ASPSP side.
  • Directory: to resolve a BIC, prefer the official SWIFT directory over free databases, which are often outdated (renamed or merged banks, closed branches).

Sources

Go deeper

From the blog

Longer reads to go beyond the definition.

April 7, 2026
technical

Technical architecture of a PSD2 API: what to know before writing the first line of code — Read more

A technical overview of PSD2 for CTOs, developers and technical PMs: API standards, security (mTLS, eIDAS certificates), OAuth2, SCA flows, consent management, implementation pitfalls.

April 6, 2026
regulation

Understanding PSD2: what it changes for your customers and your business — Read more

Everything an executive, a product manager or a business team needs to understand about PSD2. Players, consent, opportunities, without technical jargon.