IBAN Validator

The International Bank Account Number (IBAN) is defined by ISO 13616. ISO designated SWIFT as its registration authority in 2006, and only a national standards body or a national central bank can ask SWIFT to register a country's format (SWIFT). An IBAN is a two-letter country code, two check digits, and a Basic Bank Account Number (BBAN) of up to 30 letters and digits whose length is fixed for each country. The current IBAN Registry, Release 103 of September 2026, has 89 entries for countries and territories, from Norway's 15 characters to Russia's 33. This tool's table is generated from that release.

Length, format, check digits, checksum

Each registry entry also gives the BBAN's structure, field by field. Germany's is 8n,10n: eight digits, then ten digits. Brazil's changed in Release 103: since August 2026 the eight-character bank identifier may contain letters as well as digits (8c where it was 8n), and the registry's example for Brazil now has an A in it. The tool checks every character against its country's structure, so a letter where the registry allows only digits is rejected even when the arithmetic happens to work out.

The checksum is MOD 97-10 from ISO/IEC 7064, as the European Committee for Banking Standards described it in EBS204: move the first four characters to the end, replace each letter with a number (A=10, B=11, … Z=35), and divide by 97. A valid IBAN leaves a remainder of 1. Under EBS204's rule the check digits are issued as 98 minus a remainder that runs from 0 to 96, so they always fall between 02 and 98. That range is our derivation from the generation rule, not a quotation from ISO 13616, whose text is paywalled. It matters because mod 97 cannot tell 00, 01 and 99 apart from 97, 98 and 02: a checker that tests only the remainder accepts the registry's example for Iraq with its check digits 98 replaced by 01. This one does not.

What the check digits miss

We tested every single-character error in all 89 example IBANs SWIFT publishes in the registry. The checksum alone caught all 16,452 changes of one digit to another and all 1,197 swaps of two neighbouring digits. Of the 69,195 single-character substitutions, 444 got through, and every one of those changed a digit into a letter or a letter into a digit: a letter counts as two digits in the arithmetic, so the error stops being a single substitution. With the registry's format checked as well, as this tool now does, 143 of the 69,195 still pass, all of them in fields the registry itself allows to hold letters or digits. These are counts over SWIFT's 89 examples, one per country, not over real-world typing errors.

SEPA is 41 countries, and the UK is one of them

The European Payments Council's list of the SEPA schemes' geographical scope (EPC409-09, version 8.0, 24 December 2025) has 41 countries: the 27 EU member states, 3 more in the European Economic Area, and 11 outside it. Montenegro and Albania were admitted on 21 November 2024, North Macedonia and Moldova on 6 March 2025, and Serbia on 22 May 2025. The United Kingdom stayed in SEPA's scope after 1 February 2020, under an EPC Board decision of 7 March 2019. The "In SEPA" line in the result follows the EPC's list, not the registry's own SEPA column, which still marks those five newer members as outside. Within the EU, Regulation 260/2012 (Article 5(7)) stopped payment providers from requiring a BIC for national euro transfers after 1 February 2014 and for cross-border ones after 1 February 2016; the EPC notes that EU and EEA law fully applies only between institutions in the EU and EEA.

Singapore, Malaysia and the ASEAN exception

Singapore, Malaysia and eight other ASEAN members have no entry in the registry, and neither do Hong Kong or Taiwan. Timor-Leste does: its central bank's format (TL, 23 characters) has been in the registry since September 2014, and Timor-Leste became ASEAN's 11th member on 26 October 2025. In Singapore, PayNow, launched on 10 July 2017, sends Singapore dollars through FAST to a mobile number, NRIC/FIN or Virtual Payment Address, so the sender does not need the recipient's bank and account number. The Association of Banks in Singapore publishes a list pairing each GIRO bank's four-digit bank code with its SWIFT BIC. In Malaysia, Bank Negara Malaysia's Interoperable Fund Transfer Framework (30 June 2026) describes a National Addressing Database that links an account to a mobile phone number, NRIC number, passport number or company or business registration number, and the same framework covers DuitNow Transfer. Across borders, the Monetary Authority of Singapore describes the PayNow–PromptPay link with Thailand (29 April 2021) as the world's first linkage of real-time payment systems, and the PayNow–DuitNow link with Malaysia (17 November 2023) lets a sender pay using just the recipient's mobile number or Virtual Payment Address. None of these uses an IBAN.

A valid IBAN is not a verified account

Passing every check here shows that the string is well formed. It does not show that the account exists, that it is open, or who holds it. The EU's Regulation 2024/886 records that the account identifier alone used to decide where a payment went, with no duty on the bank to check the payee's name. Its Article 5c now requires the payer's bank to offer Verification of Payee, which compares the IBAN with the payee's name before you pay: from 9 October 2025 in the euro area, and by 9 July 2027 in EU countries outside it. Elsewhere, only the receiving bank can confirm an account.