Definition
The IBAN (International Bank Account Number) is the unique, international identifier of a bank account, defined by the ISO 13616 standard.
Its length varies by country (from 15 to 34 characters), but its purpose is the same everywhere: to let any bank route a payment to the right account without ambiguity.
Anatomy of a French IBAN
A French IBAN is 27 characters long. Example: FR76 3000 6000 0112 3456 7890 189
FR— country code (2 letters, ISO 3166).76— international check digits (2 digits, MOD 97-10 algorithm).30006— bank code (5 digits).00001— branch code (5 digits).12345678901— account number (11 characters).89— national RIB key (2 digits).
The last 23 characters make up the old French RIB: the IBAN is the RIB prefixed with the country code and the international check digits.
IBAN lengths by country
A few reference points:
- Germany: 22 characters (
DE89 3704 0044 0532 0130 00). - France, Spain, Italy: 27 characters.
- Belgium: 16 characters.
- Switzerland: 21 characters.
- Malta: 31 characters (the longest in the SEPA zone).
Hence the most common integration error: providing a 27-character field on the assumption that it is universal. You must allow for up to 34 characters.
Validation: MOD 97-10
The algorithm is simple:
- Move the first 4 characters to the end of the string.
- Replace each letter with its position in the alphabet + 9 (A=10, B=11, … Z=35).
- Compute the result modulo 97.
- If the result equals 1, the IBAN is structurally valid.
Beware: structurally valid does not mean the account exists. VoP additionally checks that the name matches the holder and that the account is active.
IBAN vs BIC
- IBAN — identifies the account (and indirectly the bank, via the country and bank codes).
- BIC — identifies the bank (its SWIFT code).
Since 2016, the BIC is no longer required within SEPA: the IBAN alone is enough, since the recipient bank can be derived from it. The BIC remains useful for non-SEPA transfers or as a consistency field in some APIs.
What the IBAN does not do
- Does not reveal the holder's name: that is the role of VoP.
- Does not guarantee the account is active: a valid IBAN can correspond to a closed account.
- Is not strictly confidential: it travels in every transfer, yet remains sensitive (risk of fraudulent direct debits if the mandate is not verified).
- Is not a RIB: the RIB is the French national format that combines the IBAN, BIC, holder and address in a printable form.
In the PSD2 ecosystem
The IBAN is the key identifier in all PSD2 APIs: the debtorAccount of the payment authorization, the creditorAccount of the payment request in STET and the Berlin Group, mandatory in any transfer request.
Concrete examples
- Form field:
maxlength=34, stripping spaces and uppercasing on the front end, MOD 97-10 validation on the server before the API call. The classic mistake: validating length only. - Display: group into blocks of 4 characters separated by spaces — the ISO standard and far more readable.
- Libraries:
iban(npm),python-stdnum,iban4j(Java) handle validation and formatting — never re-implement MOD 97-10 by hand. - Wise, Revolut, N26: their customer IBANs are often Belgian or Lithuanian (local licensing). They are perfectly valid within SEPA for a French customer, even though some employers still refuse them — an illegal practice under the SEPA regulation.
- Virtual IBANs: Treezor, Swan or Stripe Treasury generate virtual IBANs attached to a parent account, to track by customer or by use — widely used for collections.
- Security: never log an IBAN in clear text; treat it as sensitive data.