IBAN Format Explained: Structure, Country Codes, and the Mod-97 Check

If you build payment forms, billing systems, or test data, you will eventually parse an IBAN and have to decide whether it is well-formed before sending money anywhere near it. This guide covers the IBAN format as defined by ISO 13616: how the structure breaks down, why every country has a different length, and exactly how the mod-97 check confirms the two check digits. Every worked example here is arithmetically verified, and every test value is a documentation IBAN, never a real account.

What is an IBAN and how does its format work?

An IBAN is an International Bank Account Number defined by ISO 13616. Its format is a fixed sequence: a two-letter ISO 3166 country code ^[iso-3166], two numeric check digits, then a country-specific Basic Bank Account Number (BBAN). The whole string is at most 34 alphanumeric characters and has one fixed length per country.

The standard is published jointly by ISO and the European Committee for Banking Standards, and the registry of national formats is maintained by SWIFT as the official registration authority ^[iso-13616]. That registry is the single source of truth for how many characters each country uses and what its BBAN contains. The IBAN was created to make cross-border payments routable and checkable without a human reading account numbers aloud.

How long is an IBAN in each country?

IBAN length is fixed per country and never variable within one country. ISO 13616 sets the upper bound at 34 characters, but each national format pins an exact length: Germany 22, France 27, the United Kingdom 22, Spain 24, and the Netherlands 18. A validator should reject any IBAN whose length does not match its country code.

Checking length against the country code is the cheapest and most effective first filter. It catches truncated copy-paste errors and wrong-country mistakes before you spend cycles on the arithmetic. The table below lists common formats from the official IBAN registry ^{[iban-registry]}.

Lengths range from 15 characters in Norway to 33 in Russia, currently the longest real IBAN in the registry. ISO 13616 sets a theoretical maximum of 34 characters, but no country currently uses all 34 (Malta, for example, uses 31). Because the spread is wide, hardcoding a single length check is a common bug; always look the length up by country code.

How do the IBAN check digits work with mod 97?

The two check digits are computed with the ISO 7064 mod-97-10 algorithm. To validate, move the first four characters to the end of the string, replace each letter with two digits where A=10 and Z=35, interpret the result as one integer, and take it modulo 97. A correct IBAN always yields a remainder of exactly 1.

ISO 7064 is the standard for check character systems, and mod-97-10 is the specific scheme IBAN uses ^[iso-7064]. The same idea appears in RFC-style banking specs and is described in the IBAN entry on Wikipedia for quick reference ^{[wikipedia-iban]}. Here are the steps in order.

1. Remove all spaces and uppercase the string.
2. Verify the length matches the country code; reject early if it does not.
3. Move the first four characters (country code + check digits) to the end.
4. Replace each letter with two digits: A=10, B=11, ... Z=35. Digits stay as-is.
5. Read the resulting all-digit string as one large integer.
6. Compute integer mod 97. If the remainder is 1, the check digits are valid.

How are the check digits generated for a new IBAN?

Generating check digits is the inverse of validation. Take the country code plus '00' as placeholder check digits, append the BBAN, rearrange and convert exactly as above, compute the integer mod 97, subtract that remainder from 98, and zero-pad to two digits. Those two digits become characters 3 and 4. This is the routine our generators use to produce format-valid test IBANs, and it matches the procedure set out by the European Committee for Banking Standards ^[ecbs-iban].

The check digits enable a sanity check of the bank account number to confirm its integrity before submitting a transaction.

What does the BBAN contain inside an IBAN?

The BBAN is everything after the check digits, and its internal layout is defined per country. It typically packs a bank identifier, an optional branch or sort code, the domestic account number, and sometimes a national check digit, in a fixed order and character set. Because the order differs by country, you cannot parse a BBAN without knowing the country first.

Note that some countries embed their own check inside the BBAN, separate from the IBAN check digits. France carries a two-digit cle RIB, Italy a single-letter CIN, and Spain a two-digit domestic control. A full validator can verify those national checks too, but the IBAN-level mod-97 test is what every country shares.

How does IBAN validation relate to US ABA routing numbers?

The United States does not use IBANs; it routes domestic payments with a nine-digit ABA routing number that has its own weighted mod-10 checksum. If your system handles both regions, validate each with the correct algorithm rather than forcing one scheme onto the other. You can check routing numbers with our ABA routing number validator and IBANs with the IBAN validator.

How do you generate safe test IBANs without using real accounts?

Generate test IBANs by assembling a valid country code, a BBAN built from reserved or documentation patterns, and freshly computed mod-97 check digits. The result passes format validation but maps to no real account. Use these strictly for QA, automated tests, demos, and privacy-preserving fixtures, never to imitate a real payee.

This matters because real account numbers in test fixtures are both a privacy risk and a compliance problem. Synthetic IBANs let you exercise validation logic, payment UIs, and error paths without ever touching live banking data. The documentation IBANs in the tables above are the canonical examples published in the standard and Wikipedia precisely so engineers can copy them safely ^{[wikipedia-iban]}.

Two stats worth keeping in mind for context. The IBAN standard is used in over 80 countries listed in the SWIFT IBAN registry ^{[iban-registry]}. And because the mod-97 scheme detects all single-character errors and most transpositions, it catches the large majority of manual entry mistakes before a payment is ever submitted, as documented in the ISO 7064 specification ^[iso-7064].

Putting it together: parse the country code, look up and confirm the length, run the mod-97 check for the shared check digits, and optionally verify any national check inside the BBAN. That sequence is exactly what /tools/iban-validator runs, and it is enough to reject the vast majority of malformed inputs before they reach a payment rail.