obOpen Banking Lab
GlossarySTETBlogContact
Technical

IBAN

International Bank Account Number

The unique, international identifier of a bank account. In France, 27 characters that encode the bank, the branch, the account number and a check key all at once.

See also:BICSEPASCTSCT InstSDDVoP

Definition

The IBAN (International Bank Account Number) is the unique, international identifier of a bank account, defined by the ISO 13616 standard.

Its length varies by country (from 15 to 34 characters), but its purpose is the same everywhere: to let any bank route a payment to the right account without ambiguity.

Anatomy of a French IBAN

A French IBAN is 27 characters long. Example: FR76 3000 6000 0112 3456 7890 189

  • FR — country code (2 letters, ISO 3166).
  • 76 — international check digits (2 digits, MOD 97-10 algorithm).
  • 30006 — bank code (5 digits).
  • 00001 — branch code (5 digits).
  • 12345678901 — account number (11 characters).
  • 89 — national RIB key (2 digits).

The last 23 characters make up the old French RIB: the IBAN is the RIB prefixed with the country code and the international check digits.

IBAN lengths by country

A few reference points:

  • Germany: 22 characters (DE89 3704 0044 0532 0130 00).
  • France, Spain, Italy: 27 characters.
  • Belgium: 16 characters.
  • Switzerland: 21 characters.
  • Malta: 31 characters (the longest in the SEPA zone).

Hence the most common integration error: providing a 27-character field on the assumption that it is universal. You must allow for up to 34 characters.

Validation: MOD 97-10

The algorithm is simple:

  1. Move the first 4 characters to the end of the string.
  2. Replace each letter with its position in the alphabet + 9 (A=10, B=11, … Z=35).
  3. Compute the result modulo 97.
  4. If the result equals 1, the IBAN is structurally valid.

Beware: structurally valid does not mean the account exists. VoP additionally checks that the name matches the holder and that the account is active.

IBAN vs BIC

  • IBAN — identifies the account (and indirectly the bank, via the country and bank codes).
  • BIC — identifies the bank (its SWIFT code).

Since 2016, the BIC is no longer required within SEPA: the IBAN alone is enough, since the recipient bank can be derived from it. The BIC remains useful for non-SEPA transfers or as a consistency field in some APIs.

What the IBAN does not do

  • Does not reveal the holder's name: that is the role of VoP.
  • Does not guarantee the account is active: a valid IBAN can correspond to a closed account.
  • Is not strictly confidential: it travels in every transfer, yet remains sensitive (risk of fraudulent direct debits if the mandate is not verified).
  • Is not a RIB: the RIB is the French national format that combines the IBAN, BIC, holder and address in a printable form.

In the PSD2 ecosystem

The IBAN is the key identifier in all PSD2 APIs: the debtorAccount of the payment authorization, the creditorAccount of the payment request in STET and the Berlin Group, mandatory in any transfer request.

Concrete examples

  • Form field: maxlength=34, stripping spaces and uppercasing on the front end, MOD 97-10 validation on the server before the API call. The classic mistake: validating length only.
  • Display: group into blocks of 4 characters separated by spaces — the ISO standard and far more readable.
  • Libraries: iban (npm), python-stdnum, iban4j (Java) handle validation and formatting — never re-implement MOD 97-10 by hand.
  • Wise, Revolut, N26: their customer IBANs are often Belgian or Lithuanian (local licensing). They are perfectly valid within SEPA for a French customer, even though some employers still refuse them — an illegal practice under the SEPA regulation.
  • Virtual IBANs: Treezor, Swan or Stripe Treasury generate virtual IBANs attached to a parent account, to track by customer or by use — widely used for collections.
  • Security: never log an IBAN in clear text; treat it as sensitive data.

Sources

Back to glossary