What Is an IBAN Number

Definition, standards, and background

IBAN (International Bank Account Number) is the ISO 13616 standard for numbering bank accounts in a consistent, internationally usable format. In the official IBAN registry published by SWIFT, the term is defined as an “expanded version” of a domestic account identifier (BBAN), intended for international use and uniquely identifying an individual account at a specific financial institution in a specific country.

The standard behind IBAN is maintained by the International Organisation for Standardisation. The current “structure” specification is published as ISO 13616-1:2020, which describes IBAN’s elements for international data interchange and automated processing.

ISO designates a Registration Authority for IBAN formats (so that each country’s IBAN template is formally registered and maintained). ISO’s maintenance-agency listing identifies SWIFT as Registration Authority for the ISO 13616 series (Part 2 covers the Registration Authority role).

Structure and components

At a high level, an IBAN has three conceptual parts:

• Country code (2 letters): based on ISO 3166-1 alpha-2 country codes.

• Check digits (2 digits): a checksum computed using the ISO/IEC 7064 MOD 97-10 method.

• BBAN (up to 30 characters): the Basic Bank Account Number, which is the country-specific domestic account structure; it contains (at minimum) a bank identifier in a fixed position and length for that country.

Because the BBAN is country-specific, IBAN length is fixed per country but varies across countries; the absolute maximum is 34 characters (2 + 2 + up to 30).

“Electronic” vs “print” presentation

IBAN is often shown in two ways:

• Electronic format: continuous characters, no spaces (what systems typically store and transmit).

• Print format: grouped in blocks (commonly 4 characters per block) to improve readability; some guidance also notes that a printed IBAN may be prefixed by the label “IBAN”, but that label is not part of the identifier itself.

Some authorities explicitly warn users to remove the word “IBAN” and all spaces before validating or submitting it into a form. For example, the Saudi Central Bank (SAMA) instructs users not to input the word “IBAN” and to remove spaces when checking a Saudi IBAN.

How to read the official “format notation” in country templates

The SWIFT IBAN Registry uses a compact notation to describe each national IBAN template:

• n = digit (0–9)

• a = uppercase letter (A–Z)

• c = alphanumeric (letters and digits)

• ! indicates fixed length (e.g., 4!a = exactly four letters).

Country IBAN formats and examples

The country formats below come from the SWIFT IBAN Registry (Release 99, December 2024), which publishes ISO 13616-compliant national templates, lengths, and examples.

Comparison table of formats and lengths

What the BBAN typically contains in these examples

Although the BBAN is country-specific, the SWIFT registry highlights two consistent design ideas: the BBAN has a fixed length per country, and it contains a bank identifier in a fixed position/length.

A few concrete illustrations from the same official templates:

• United Kingdom: the example shows a 4-letter bank identifier (“NWBK”), followed by a 6-digit branch identifier and an 8-digit account number, producing a 22-character IBAN.

• Germany: the template is numeric after the prefix and check digits: 8 digits of bank identifier + 10 digits of account number, producing 22 characters.

• Italy: the template includes an additional national check character in the BBAN portion (shown as a single letter in the example), consistent with Italy’s domestic account structure.

• Saudi Arabia: the template includes a 2-digit bank identifier and an 18-character account segment (which may include leading zeros), for a total of 24 characters.

Separately, SAMA confirms Saudi IBANs begin with “SA” and are exactly 24 characters long, and it provides the same example formatting guidance.

Using an IBAN for domestic and international transfers and its relation to BIC SWIFT

International transfers

For many international payments (especially outside SEPA), banks commonly ask for:

• The recipient’s IBAN (or account number)

• The recipient bank’s BIC/SWIFT code (a bank identifier used in international routing)

• The beneficiary name and additional address/reference details, depending on the corridor and compliance checks.

For example, HSBC UK describes that international payments typically require the beneficiary’s IBAN or account number and the receiving bank’s “SWIFT or BIC” code, and it emphasises checking details to avoid delays or returns.

Domestic payments and SEPA context

Within the SEPA framework for euro retail payments, IBAN functions as the payment account identifier that enables a consistent domestic and cross-border experience for euro-denominated credit transfers and direct debits. The Central Bank of Ireland explains that, under the SEPA Regulation, PSPs must enable users to identify a payment account solely by its IBAN.

In practice, this means many European domestic transfers (e.g., domestic euro credit transfers) use IBAN just as routinely as cross-border transfers.

Relationship to BIC/SWIFT

• IBAN identifies the account (and embeds a country-specific bank identifier inside the BBAN).

• BIC (Business Identifier Code) identifies the bank or payment service provider in an internationally standardised way (referenced as ISO 9362 in IBAN documentation).

Within SEPA, the operational need to provide BIC has been reduced over time. Latvijas Banka (the central bank of Latvia) states that the SEPA migration regulation removed the requirement for users to provide BIC for national payments from 1 January 2014, and applied a similar rule for cross-border payments from 1 February 2016.

The Financial Conduct Authority similarly summarises that firms must not make it a mandatory requirement for payer/payee to provide the BIC to initiate a SEPA payment transaction and that they should use IBAN instead.

A practical nuance: some countries’ IBAN structures incorporate characters that help identify the bank (sometimes aligned with BIC components). Latvijas Banka notes that Latvia’s IBAN structure uses the first four characters of the PSP’s BIC, which enables deriving the BIC from the IBAN in Latvia.

Validation rules, common errors, and an example check digit calculation

What “IBAN validation” can and cannot tell you

An IBAN “passes validation” when it satisfies (a) the country-specific format/length rules and (b) the checksum rule. The UK IBAN standard from Pay.UK describes the verification process and explicitly notes that passing verification does not ensure the account still exists (it may have been closed).

Core validation steps (MOD 97-10 overview)

Pay.UK’s standard lays out the basic verification steps (presented here in simplified wording, while preserving the same logic):

1. Remove spaces and (if present) the “IBAN” label.

2. Move the first four characters (country code + check digits) to the end.

3. Convert letters A–Z into numbers (A=10 … Z=35).

4. Divide the resulting large number by 97; if the result leaves remainder 1, the IBAN is valid.

The SWIFT IBAN Registry also ties the check digits to ISO/IEC 7064 MOD97-10.

Example validation calculation

Using the official UK example from the SWIFT IBAN Registry: GB29 NWBK 6016 1331 9268 19.

1. Remove spaces (electronic form):
   GB29NWBK60161331926819

2. Move first four characters to the end (country code + check digits):
   NWBK60161331926819GB29

3. Convert letters to digits (A=10 … Z=35):

   • N=23, W=32, B=11, K=20, G=16, B=11
     Resulting numeric string:
     2332112060161331926819161129

4. Compute mod 97:
   2332112060161331926819161129 mod 97 = 1 → the IBAN passes the checksum rule.

This demonstrates what the checksum is designed to do: detect common transcription mistakes early. It does not confirm funds will reach the intended beneficiary unless the beneficiary details are correct and correspond to the intended person/business.

Common errors and practical validation rules

Common issues flagged by official checkers and standards include:

• Including the word “IBAN” in a form field that expects only the identifier (SAMA explicitly warns against this for Saudi IBANs).

• Leaving spaces or separators in electronic fields; many validators require you to remove spaces first.

• Wrong length for the country (e.g., NL is 18, DE is 22, FR and IT are 27, ES is 24, SA is 24).

• Assuming “valid checksum” means “correct beneficiary”—a misconception explicitly contradicted by Pay.UK’s note that verification does not ensure an account still exists.

• Trying to generate your own IBAN from guesswork; SAMA instructs users to contact their bank and not attempt to generate an IBAN themselves.

Benefits, limitations, security, and how to find your IBAN

Benefits

The core benefits stem from standardisation and error reduction:

• SWIFT describes IBAN as facilitating the automation of cross-border payment processing, with each country having a defined national format under ISO 13616.

• The SWIFT IBAN Registry emphasises that IBAN enables exchanging account identification details in a machine-readable form and supports cross-border transaction processing.

• For direct debits in SEPA, the European Payments Council describes consumer benefits including automation (reducing missed deadlines) and a refund process for erroneous debits.

Limitations

Important constraints for any general-audience explanation:

• Not universal worldwide: The Bank of Italy notes that IBAN is widely adopted (primarily across the EU) but not universal, with some major countries using different identification systems.

• Checksum validation is not account verification: Pay.UK explicitly states that IBAN verification does not ensure the account exists.

• Payments can still be misdirected if the IBAN is a real (valid) IBAN but not the intended recipient’s; the Bank of Italy warns that even a single wrong digit can send money to the wrong recipient, analogous to a wrong address.

Security and fraud considerations

IBAN is an identifier needed to receive transfers; it is not, by itself, an authentication credential. The practical risk is less “someone can withdraw money with my IBAN” and more “someone can trick me into sending money to the wrong IBAN” or “a fraudster can substitute bank details in an invoice or email”.

Key real-world fraud patterns and mitigations include:

• Payment diversion / business email compromise: the UK “Report Fraud” guidance describes how criminals impersonate suppliers or executives and send altered payment instructions to redirect payments to accounts controlled by criminals; it advises verifying payment requests via a secondary channel and implementing verification protocols.

• Growing role of scam-driven credit transfer fraud: the European Central Bank notes that in 2024 total payment fraud value increased and highlights “manipulation of payers”; it states that for credit transfers, payment service users bore about 85% of fraud losses in 2024 mainly due to scams that trick users into initiating fraudulent transfers.

• Scale and composition of fraud (EEA reporting): the joint European Banking Authority / ECB report summarises industry-reported fraud totals (e.g., €4.3bn in 2022 and €2.0bn in H1 2023) and attributes much of the fraud value to credit transfers and card payments.

A practical takeaway for end users: treat changes to bank details as high-risk events. Verify new IBANs using an independent channel (for example, call a known phone number from a previous invoice or official website, not a number in the suspicious email). This mirrors official anti-fraud guidance.

Also note that some payment ecosystems are adding beneficiary name checks (sometimes called “Verification of Payee”) to reduce misdirected payments; the Bank of Italy mentions an obligation for banks and Poste Italiane to offer customers a way to verify correspondence between the beneficiary’s name and the IBAN, aiming to prevent errors (while noting it may not always prevent fraud).

For direct debit risk specifically, EPC explains that in the SEPA Direct Debit Core scheme, payers can request a “no-questions-asked” refund within eight weeks, and can request a refund up to 13 months for unauthorised direct debits—important consumer protection if direct debit credentials are abused.

How to find your IBAN

Most people obtain their IBAN from their bank or payment provider; you generally do not “invent” it.

Common official pathways include:

• Bank statements and online banking: HSBC states that your IBAN and BIC appear on paper statements and can be displayed in online or mobile banking under account details.

• Ask your bank directly: SAMA explicitly advises that if you need an IBAN for your own use, you should contact your bank, and it warns users not to attempt to generate their own IBAN.

• Country-specific services: some central banks publish rules or tools; for example, the Saudi central bank offers an IBAN checker and provides formatting guidance.

Some payment and remittance services also display the account’s IBAN in-app as part of account details (for example, sends.co), but the authoritative source remains your bank or the institution that issued the payment account.