# IBAN

> International Bank Account Number

The unique, international identifier of a bank account. In France, 27 characters that encode the bank, the branch, the account number and a check key all at once.

_Category: technique_

---

## Definition

The **IBAN** (_International Bank Account Number_) is the unique, international identifier of a bank account, defined by the ISO 13616 standard.

Its length varies by country (from 15 to 34 characters), but its purpose is the same everywhere: to let any bank route a payment to the right account without ambiguity.

## Anatomy of a French IBAN

A French IBAN is 27 characters long. Example: `FR76 3000 6000 0112 3456 7890 189`

- `FR` — country code (2 letters, ISO 3166).
- `76` — international check digits (2 digits, MOD 97-10 algorithm).
- `30006` — bank code (5 digits).
- `00001` — branch code (5 digits).
- `12345678901` — account number (11 characters).
- `89` — national RIB key (2 digits).

The last 23 characters make up the old French RIB: the IBAN is the RIB prefixed with the country code and the international check digits.

## IBAN lengths by country

A few reference points:

- **Germany**: 22 characters (`DE89 3704 0044 0532 0130 00`).
- **France, Spain, Italy**: 27 characters.
- **Belgium**: 16 characters.
- **Switzerland**: 21 characters.
- **Malta**: 31 characters (the longest in the SEPA zone).

Hence the most common integration error: providing a 27-character field on the assumption that it is universal. You must allow for up to 34 characters.

## Validation: MOD 97-10

The algorithm is simple:

1. Move the first 4 characters to the end of the string.
2. Replace each letter with its position in the alphabet + 9 (A=10, B=11, … Z=35).
3. Compute the result modulo 97.
4. If the result equals 1, the IBAN is structurally valid.

Beware: structurally valid does not mean the account exists. VoP additionally checks that the name matches the holder and that the account is active.

## IBAN vs BIC

- **IBAN** — identifies the account (and indirectly the bank, via the country and bank codes).
- **BIC** — identifies the bank (its SWIFT code).

Since 2016, the BIC is no longer required within SEPA: the IBAN alone is enough, since the recipient bank can be derived from it. The BIC remains useful for non-SEPA transfers or as a consistency field in some APIs.

## What the IBAN does not do

- **Does not reveal the holder's name**: that is the role of VoP.
- **Does not guarantee the account is active**: a valid IBAN can correspond to a closed account.
- **Is not strictly confidential**: it travels in every transfer, yet remains sensitive (risk of fraudulent direct debits if the mandate is not verified).
- **Is not a RIB**: the RIB is the French national format that combines the IBAN, BIC, holder and address in a printable form.

## In the PSD2 ecosystem

The IBAN is the key identifier in all PSD2 APIs: the `debtorAccount` of the payment authorization, the `creditorAccount` of the payment request in STET and the Berlin Group, mandatory in any transfer request.

```mermaid
flowchart LR
    subgraph IBAN_FR["French IBAN — 27 characters"]
        FR["FR<br/>(country)"]
        K["76<br/>(MOD 97 key)"]
        BANK["30006<br/>(bank)"]
        BR["00001<br/>(branch)"]
        ACC["12345678901<br/>(account)"]
        RIB["89<br/>(FR RIB key)"]
    end

    FR --> K --> BANK --> BR --> ACC --> RIB

    IBAN_FR -->|"Routing"| PAYMENT["SEPA payment<br/>(SCT, SCT Inst, SDD)"]
```

## Concrete examples

- **Form field**: `maxlength=34`, stripping spaces and uppercasing on the front end, MOD 97-10 validation on the server before the API call. The classic mistake: validating length only.
- **Display**: group into blocks of 4 characters separated by spaces — the ISO standard and far more readable.
- **Libraries**: `iban` (npm), `python-stdnum`, `iban4j` (Java) handle validation and formatting — never re-implement MOD 97-10 by hand.
- **Wise, Revolut, N26**: their customer IBANs are often Belgian or Lithuanian (local licensing). They are perfectly valid within SEPA for a French customer, even though some employers still refuse them — an illegal practice under the SEPA regulation.
- **Virtual IBANs**: Treezor, Swan or Stripe Treasury generate virtual IBANs attached to a parent account, to track by customer or by use — widely used for collections.
- **Security**: never log an IBAN in clear text; treat it as sensitive data.

## Sources

- [ISO 13616 — International Bank Account Number (IBAN)](https://www.iso.org/standard/81090.html) — ISO
- [IBAN Registry](https://www.swift.com/standards/data-standards/iban-international-bank-account-number) — SWIFT

---

Source: https://openfinanceguide.com/en/glossary/iban