IBAN Validation API: The Complete Developer Guide for 2026

International Bank Account Numbers are the backbone of cross-border payments. Every wire transfer in Europe, the Middle East, and an expanding list of countries worldwide relies on IBANs to route funds to the correct institution and account. Yet a surprising number of payment failures trace back to a single root cause: invalid or mistyped IBANs.

If you are building payment infrastructure, onboarding flows, or any system that touches bank account data, programmatic IBAN validation is not optional — it is a hard requirement. This guide walks you through everything you need to know: IBAN structure, the validation algorithm, what a production-grade API should return, and how to integrate Edge's IBAN Validation API into your stack.

What Is an IBAN?

An IBAN (International Bank Account Number) is a standardized format defined by ISO 13616 for identifying bank accounts across national borders. Originally introduced in the European Union to simplify cross-border euro payments, IBANs are now used in over 80 countries.

The IBAN does not replace domestic account numbers. Instead, it wraps them in a standardized envelope that includes country identification and error-detection digits, making it possible for any system worldwide to parse and validate the account reference without country-specific logic.

IBAN Structure Breakdown

Every IBAN follows a fixed structure, though the total length varies by country (from 15 characters for Norway to 34 for Malta and others).

DE89 3704 0044 0532 0130 00
││   │
││   └── BBAN (Basic Bank Account Number) — country-specific
│└────── Check digits (2 numeric characters)
└─────── Country code (ISO 3166-1 alpha-2)

The Three Components

1. Country Code (2 letters)

The first two characters are the ISO 3166-1 alpha-2 country code. DE for Germany, GB for the United Kingdom, BH for Bahrain, SA for Saudi Arabia. This tells the receiving system which country's banking infrastructure to route through and what BBAN format to expect.

2. Check Digits (2 numbers)

Characters 3 and 4 are numeric check digits computed using the MOD-97 algorithm (ISO 7064). These digits allow any system to detect transcription errors — a single mistyped character anywhere in the IBAN will cause the check to fail. The check digits catch over 99% of single-character errors and all transposition errors.

3. BBAN — Basic Bank Account Number (up to 30 characters)

The remainder of the IBAN is the BBAN, which is country-specific. It typically contains a bank code, a branch code, and the domestic account number. The structure and length of the BBAN differ by country:

Country	IBAN Length	BBAN Structure
Germany (DE)	22	8-digit bank code + 10-digit account
United Kingdom (GB)	22	4-char bank code + 6-digit sort code + 8-digit account
Bahrain (BH)	22	4-char bank code + 14-char account
Saudi Arabia (SA)	24	2-digit bank code + 18-digit account
France (FR)	27	5-digit bank + 5-digit branch + 11-char account + 2 check
Netherlands (NL)	18	4-char bank code + 10-digit account

The MOD-97 Validation Algorithm

The check digit verification is the mathematical core of IBAN validation. Here is how it works step by step:

1. Move the first four characters to the end. For DE89370400440532013000, this produces 370400440532013000DE89.

2. Convert letters to numbers. Each letter is replaced by its position in the alphabet plus 9 (A=10, B=11, ..., Z=35). D=13, E=14. The string becomes 370400440532013000131489.

3. Compute modulo 97. Divide the resulting number by 97. If the remainder is exactly 1, the IBAN is valid. Any other remainder indicates an error.

This sounds simple, but implementing it correctly requires handling very large numbers (up to 38 digits). Most programming languages cannot handle this with native integer types. You need either big-integer arithmetic or an iterative modulo approach that processes the number in chunks.

// Iterative MOD-97 for large numbers
function mod97(ibanDigits) {
  let remainder = 0;
  for (let i = 0; i < ibanDigits.length; i++) {
    remainder = (remainder * 10 + parseInt(ibanDigits[i], 10)) % 97;
  }
  return remainder;
}

While the MOD-97 check catches transcription errors, it tells you nothing about whether the bank code is real, whether the account structure matches the country's rules, or whether the bank participates in SEPA. That is where full validation comes in.

Why Basic Validation Is Not Enough

A checksum-valid IBAN can still be completely unusable. Consider these scenarios:

• The country code is valid and the check digits pass, but the bank code does not correspond to any real financial institution.
• The IBAN structure matches the country's length requirement, but the BBAN format violates the country's specific rules (wrong character types in certain positions).
• The bank exists but has been acquired, merged, or had its codes reassigned.
• The IBAN is structurally valid but the bank does not participate in SEPA — so your euro transfer will be rejected.

Production payment systems need more than a checksum. They need to resolve the bank code to a real institution, verify the BBAN structure against country-specific rules, and determine network participation.

How Edge's Full IBAN Validation Works

Edge's IBAN Validation API performs multi-layered validation in a single request and returns a comprehensive response that includes everything a payment system needs.

Making a Request

curl -X POST https://api.edge.bh/v1/services/iban/validate \
  -H "X-Api-Key: your_api_key_here" \
  -H "Content-Type: application/json" \
  -d '{"iban": "DE89370400440532013000"}'

const response = await fetch('https://api.edge.bh/v1/services/iban/validate', {
  method: 'POST',
  headers: {
    'X-Api-Key': 'your_api_key_here',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ iban: 'DE89370400440532013000' }),
});

const result = await response.json();

Response Structure

The API returns a rich response that goes far beyond pass/fail:

{
  "valid": true,
  "iban": {
    "formatted": "DE89 3704 0044 0532 0130 00",
    "electronic": "DE89370400440532013000",
    "country_code": "DE",
    "check_digits": "89",
    "bban": "370400440532013000"
  },
  "country": {
    "name": "Germany",
    "iso": "DE",
    "sepa": true,
    "iban_length": 22
  },
  "bank": {
    "name": "Commerzbank",
    "bic": "COBADEFFXXX",
    "bank_code": "37040044",
    "city": "Koln",
    "zip": "50447"
  },
  "validations": {
    "format": true,
    "length": true,
    "checksum": true,
    "country_code": true,
    "bban_structure": true,
    "bank_code": true
  }
}

What Each Validation Layer Checks

Format validation confirms the IBAN contains only valid characters (alphanumeric) and starts with two letters followed by two digits.

Length validation checks that the total length matches the expected length for the given country. A German IBAN must be exactly 22 characters. A British IBAN must be exactly 22. A French IBAN must be 27.

Checksum validation performs the full MOD-97 algorithm described above.

Country code validation verifies the two-letter prefix is a recognized ISO 3166-1 country that uses the IBAN system.

BBAN structure validation applies country-specific rules. For Germany, it checks that positions 5-12 are numeric (bank code) and positions 13-22 are numeric (account number). For the UK, it checks that positions 5-8 are alphabetic (bank code), positions 9-14 are numeric (sort code), and positions 15-22 are numeric (account number).

Bank code resolution looks up the bank code in Edge's financial institution directory to return the bank name, BIC/SWIFT code, and branch information. This is the layer that distinguishes a structurally valid IBAN from a practically usable one.

SEPA Detection and BIC Resolution

For businesses processing euro payments within the Single Euro Payments Area, knowing whether a beneficiary's bank participates in SEPA is critical. A SEPA Credit Transfer (SCT) sent to a non-SEPA bank will be rejected, often with fees.

Edge's response includes SEPA participation status at the country level and resolves the BIC/SWIFT code directly from the bank code. This means you do not need a separate BIC lookup call — the full validation gives you everything needed to populate a SEPA payment instruction.

This is particularly valuable for payment platforms that need to determine the correct payment rail. If the destination IBAN is in a SEPA country with a SEPA-participating bank, you can route via SCT/SDD (lower cost, faster settlement). Otherwise, you route via SWIFT (higher cost, slower).

For dedicated BIC lookups, see our BIC/SWIFT Lookup API guide.

Real-World Use Cases

Payment Onboarding Forms

When a merchant or employee submits bank details through your platform, validate the IBAN in real-time before the form is submitted. Display the resolved bank name as confirmation — users can immediately see if they entered the right account.

// Real-time validation on form blur
async function onIbanBlur(iban) {
  const res = await fetch('https://api.edge.bh/v1/services/iban/validate', {
    method: 'POST',
    headers: {
      'X-Api-Key': apiKey,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({ iban: iban.replace(/\s/g, '') }),
  });
  const data = await res.json();

  if (data.valid) {
    showBankConfirmation(data.bank.name, data.iban.formatted);
  } else {
    showValidationErrors(data.validations);
  }
}

Payroll Processing

Before executing a payroll run, validate every employee's IBAN to catch errors before they cause failed transfers, returned payments, and delayed salaries. For batch scenarios, see our Bulk IBAN Validation API guide.

KYC and Compliance

Financial regulations often require that the bank account country matches the customer's declared country of residence. The structured response lets you programmatically enforce these rules.

Payment Routing

Use the SEPA flag and BIC data to automatically select the optimal payment rail for each transfer, reducing costs and settlement times.

The Cost of Not Validating

Failed payments are expensive. The direct costs include return fees (typically 5-25 EUR per failed SEPA transfer), investigation fees for SWIFT returns, and staff time to manually correct and resubmit. The indirect costs are worse: delayed vendor payments strain relationships, failed salary transfers create legal liability, and customer-facing payment failures erode trust.

A single API call that costs a fraction of a cent prevents all of this. Edge's full IBAN validation costs 3 credits per request — at standard pricing, that is less than $0.01 per validation.

Building It Yourself vs. Using an API

Some teams consider building IBAN validation in-house. The MOD-97 check is straightforward to implement, but production-grade validation requires significantly more:

• Country rules database. You need the BBAN structure rules for all 80+ IBAN countries, updated when countries change their formats.
• Bank directory. Resolving bank codes to institution names and BICs requires maintaining a database of tens of thousands of financial institutions across all IBAN countries.
• SEPA participant lists. The EBA publishes SEPA participant registries that are updated regularly. You need to ingest and refresh this data.
• Maintenance. New countries adopt IBAN. Banks merge, rebrand, and change codes. Country rules get updated. This is ongoing operational work.

An API abstracts all of this. Edge maintains the data, updates the registries, and handles the edge cases so you can focus on your core product. Get started by creating your account on the Edge dashboard.

Integration Best Practices

Validate early, validate often. Check IBANs at the point of entry — in forms, during file imports, and before payment execution. The earlier you catch an error, the cheaper it is to fix.

Store the electronic format. Always store IBANs in electronic format (no spaces). Use the formatted version only for display purposes.

Cache responses when appropriate. If you validate the same IBAN repeatedly (e.g., a recurring payment beneficiary), cache the validation result. The bank data changes infrequently.

Handle the full response. Do not just check the valid boolean. Inspect the validations object to give users specific feedback about what is wrong — "Invalid check digits" is more helpful than "Invalid IBAN."

Use HTTPS exclusively. IBAN data is sensitive financial information. All requests to Edge's API are over TLS, and you should ensure your own systems handle this data with appropriate care.

Frequently Asked Questions

What is the difference between basic and full IBAN validation?

Basic IBAN validation checks the format, length, and MOD-97 checksum. It confirms the IBAN is structurally valid but does not verify whether the bank code corresponds to a real institution. Full validation does everything basic validation does, plus it resolves the bank code against a financial institution directory, returns the bank name and BIC/SWIFT code, checks BBAN structure against country-specific rules, and reports SEPA participation. Basic validation costs 1 credit; full validation costs 3 credits. For more details, see our Basic IBAN Validation guide.

How many countries support IBAN?

As of 2026, over 80 countries use the IBAN system. This includes all European Union and European Economic Area countries, the United Kingdom, most Middle Eastern countries (Bahrain, Saudi Arabia, UAE, Qatar, Kuwait), and several countries in North Africa, Central Asia, and the Caribbean. Edge's API supports all IBAN-issuing countries with country-specific BBAN structure validation.

Can I validate multiple IBANs in a single request?

Yes. Edge's Bulk IBAN Validation API accepts an array of IBANs and returns individual validation results for each one. This is significantly more efficient for batch processing scenarios like payroll runs, vendor payment files, or data migrations.

Does the API return the BIC/SWIFT code for every valid IBAN?

The API returns BIC data when the bank code can be resolved in Edge's financial institution directory. Coverage is comprehensive for European, UK, and GCC banks. In rare cases where a bank code is valid but the institution is not in the directory (typically very small or newly licensed banks), the BIC field will be null while the IBAN still validates as structurally correct. For dedicated BIC lookups, see the BIC/SWIFT Lookup API.

Is the IBAN validation API suitable for real-time form validation?

Yes. Edge's IBAN validation endpoint typically responds in under 100 milliseconds, making it suitable for validating IBANs as users type or when a form field loses focus. The API is designed for high throughput and low latency, so it will not introduce noticeable delay in your user interface.

How does IBAN validation help with PSD2 and payment compliance?

PSD2 and related payment regulations require payment service providers to verify account details before executing transfers. IBAN validation is the first line of defense — it ensures the account identifier is structurally correct and corresponds to a real financial institution. Combined with name-matching (Confirmation of Payee), IBAN validation helps meet the regulatory requirement to take reasonable steps to prevent misdirected payments. The structured response from Edge's API provides the data points compliance teams need for audit trails.