The mod 97 checksum in an IBAN, the International Bank Account Number, caught all 16,452 substitutions of one digit for another and all 1,197 swaps of adjacent digits that we made in the 89 example IBANs SWIFT publishes, and every one of the 444 single-character substitutions it let through put a letter where a digit was, or the reverse. A pass proves only that the string is well formed; whether the account exists, and whose it is, only the receiving bank can confirm. Malaysia, Singapore and Hong Kong have no bank account format in SWIFT's IBAN Registry, so accounts there have no IBAN; Timor-Leste, which joined ASEAN on 26 October 2025, has one.
Check digits guarantee a catch on every wrong digit
An IBAN is a two-letter country code, two check digits and a Basic Bank Account Number (BBAN) of up to 30 characters. To validate it, move the first four characters to the end, turn each letter into two digits (A is 10, Z is 35) and divide by 97, the MOD 97-10 method of ISO/IEC 7064. A correct IBAN leaves 1.
The abstract of ISO/IEC 7064 promises detection of "all single substitution errors". For digits, mod 97 alone bore that out. We changed every character after the country code in SWIFT's 89 examples to every other digit and letter. No digit-for-digit substitution got through, nor any adjacent digit swap, doubled-digit error such as 11 typed as 22 (4,518 cases) or swap of two digits one character apart (1,144). These count altered examples rather than real typing.
A letter typed where a digit belongs voids the arithmetic's guarantee
Wikipedia's IBAN article, a top search result for the question, said on 2 October 2026 that the check is "guaranteed to detect any instances where a single character has been … mistyped". Our count contradicts that. Of 69,195 single-character substitutions, 444 passed mod 97 alone (0.64%), every one swapping a digit and a letter. All 3,725 letter-for-letter substitutions were caught.
The ISO guarantee applies to the string of digits the algorithm processes. When a letter is turned into two digits for the calculation, a single mistyped letter becomes a multi-digit error, voiding the single-substitution promise. Still, only 436 of 47,528 digit-to-letter substitutions passed (99.1% caught), and 8 of 1,490 letter-to-digit ones. The only swaps to pass also involved a letter: 2 of 1,379 adjacent, 3 of 1,365 one character apart, and 7 of 1,370 look-alikes such as O for 0.
Each country's format string rules out most remaining misses
SWIFT, registration authority for ISO 13616 since 2006, publishes each national format in the IBAN Registry. Release 103 (September 2026) has 89 entries for countries and territories, from Norway's 15 characters to Russia's 33. Each entry gives the BBAN's structure; Germany's is 8!n10!n: eight digits, then ten, with no place for a letter.
The format check catches 301 of the 444 errors mod 97 alone passed. With mod 97 plus the registry format, 143 of 69,195 remain, all in fields that may hold letters or digits. A range test closes a second gap: mod 97 cannot tell check digits 01 from 98, 00 from 97 or 99 from 02. Under the generation rule in the EBS204 guide of the European Committee for Banking Standards, real check digits fall between 02 and 98, our derivation, as ISO 13616's text is paywalled. Iraq's registry example with 01 in place of its 98 passes mod 97 alone and fails the range.
Our validator vouched for letters in numeric fields
Until 2 October 2026, our IBAN validator got the arithmetic right, its chunked mod 97 agreeing with exact big-integer arithmetic on all 89 examples, but tested only length and mod 97, despite a method note claiming ISO 13616 structure. It passed all 444 of those substitutions, accepted 01 and letters as check digits, and in all 89 entries accepted a letter in a field reserved for digits. It put five newer SEPA members outside SEPA, said the UK had left it, and said ASEAN accounts had no IBAN.
The fix made on 2 October 2026 checks each character against the Release 103 format, requires check digits from 02 to 98, and takes SEPA membership from the European Payments Council. Over the same sweep it passes 143 substitutions, 1 adjacent swap and 3 look-alikes, and its presets, once including a widely copied British example, now load only SWIFT's own.
The TL prefix attests to an IBAN format inside ASEAN
Timor-Leste became ASEAN's 11th member on 26 October 2025, the ASEAN Secretariat says, when the declaration on its admission was signed. Its registry entry, from Banco Central de Timor-Leste, is TL plus 21 digits; SWIFT's example is TL38 0080 0123 4567 8910 157. Its effective date, September 2014, resets on revision, so it does not date TL's first registration. Brunei, Cambodia, Indonesia, Laos, Malaysia, Myanmar, the Philippines, Singapore, Thailand and Vietnam have no entry, nor do Hong Kong, Taiwan or mainland China.
The Association of Banks in Singapore says PayNow sends Singapore dollars through FAST to a mobile number, NRIC/FIN or Virtual Payment Address, so "the sender no longer needs to know the recipient's bank/MPI and account number". ABS also lists each GIRO bank's four-digit bank code beside its SWIFT BIC. Bank Negara Malaysia's Interoperable Fund Transfer Framework of 30 June 2026 describes a National Addressing Database linking an account to a mobile number, NRIC, passport or business registration number. From abroad, the receiving bank names the details it needs.
Mod 97 proves only that the string is well formed
A recital of Regulation (EU) 2024/886 records the old position: the account identifier alone decided where a payment went, and "PSPs are not required to verify the name of the payee". It inserted Article 5c into Regulation 260/2012, so a payer's bank must offer Verification of Payee, matching the IBAN against the payee's name: in the euro area from 9 October 2025, in other EU countries by 9 July 2027. A valid IBAN does not identify the account holder, and the rule binds EU banks only.
SEPA reaches further. The European Payments Council's scope list (EPC409-09, version 8.0, 24 December 2025) has 41 countries: 27 in the EU, 3 more in the European Economic Area and 11 outside it. Albania, Montenegro, Moldova, North Macedonia and Serbia joined between November 2024 and May 2025, though the registry's SEPA column still marks them outside. The UK stayed in, under an EPC Board decision of 7 March 2019. National ID numbers share the gap between well formed and real, covered in our guide to ID check digits.
Brazil's revised format accepts letters in its bank identifier
In a copy of the registry file archived on 10 May 2026, Brazil's eight-character bank identifier was 8!n, digits only; the Release 103 entry, effective August 2026, makes it 8!c, letters or digits, and SWIFT's new Brazilian example has an A there. No source we read gives the reason. Our inference: in that field, a letter typed for a digit used to break the format and now meets mod 97 alone, which let just under 1% of such errors through over the 89 examples.
View author profile → · Editorial policy
