The International Bank Account Number (IBAN) has become the standard for identifying bank accounts in international transactions. Originally developed for European cross-border payments, IBAN is now used by over 80 countries worldwide. An IBAN combines country code, check digits, and domestic bank account number into a standardized format that enables reliable international fund transfers while also creating a sensitive identifier requiring protection.
IBAN detection benefits from the standard's built-in validation mechanisms. Unlike many identifiers that rely primarily on format matching and context, IBANs include check digits that enable mathematical verification. Our detection combines this validation with country-specific format rules and contextual analysis to achieve highly accurate identification while minimizing false positives.
Understanding IBAN Structure
IBANs follow a standardized structure defined by ISO 13616:
Country Code: Two letters identifying the country (DE for Germany, FR for France, GB for United Kingdom). This determines the expected length and internal format of the rest of the IBAN.
Check Digits: Two numeric digits calculated using modulo 97. These enable validation of the entire IBAN and detection of transcription errors.
Basic Bank Account Number (BBAN): The remainder contains country-specific bank and account identification. The BBAN structure varies by country but typically includes bank code, branch code, and account number.
For example, a German IBAN like DE89370400440532013000 breaks down as: DE (Germany) + 89 (check digits) + 37040044 (bank code) + 0532013000 (account number).
Validation Algorithm
IBAN validation uses the modulo 97 algorithm as specified in ISO 7064:
Step 1: Move the first four characters (country code + check digits) to the end of the string.
Step 2: Convert letters to numbers (A=10, B=11, ... Z=35).
Step 3: Calculate the remainder when dividing by 97.
Step 4: A valid IBAN produces a remainder of 1.
This validation catches most transcription errors—single character mistakes, transpositions, and many multi-character errors are detected. We perform this validation on all potential IBANs, rejecting sequences that match the format but fail validation.
Country-Specific Formats
Each country defines its IBAN length and BBAN structure. Examples:
Germany (DE): 22 characters. BBAN = 8-digit bank code (BLZ) + 10-digit account number.
France (FR): 27 characters. BBAN = 5-digit bank code + 5-digit branch code + 11-digit account + 2-digit RIB key.
United Kingdom (GB): 22 characters. BBAN = 4-character bank code + 6-digit sort code + 8-digit account.
Spain (ES): 24 characters. BBAN = 4-digit bank + 4-digit branch + 2 check digits + 10-digit account.
Italy (IT): 27 characters. BBAN = 1 check character + 5-digit bank + 5-digit branch + 12-digit account.
Netherlands (NL): 18 characters. BBAN = 4-character bank + 10-digit account.
We validate both the overall modulo 97 check and country-specific length and format requirements, rejecting IBANs that pass the general check but violate country rules.
Display Format Handling
IBANs appear in various display formats requiring flexible detection:
Paper Format: Grouped in blocks of four characters for readability: DE89 3704 0044 0532 0130 00. This is the standard for printed documents, invoices, and forms.
Electronic Format: Continuous without spaces: DE89370400440532013000. Used in electronic data interchange, file transfers, and system storage.
Mixed Formats: Some systems use partial grouping, different separators (hyphens, dots), or varying block sizes. We normalize all formats internally for validation.
Output Options: After detection, redacted output can preserve original formatting, standardize to paper format, or use electronic format based on your requirements.
Bank Identification
The BBAN portion of an IBAN contains bank identification codes:
Bank Code Extraction: Each country's BBAN structure defines where bank identification appears. We extract this code, enabling bank identification without exposing the full IBAN.
Bank Lookup: For many countries, we can identify the bank name and sometimes branch location from the extracted codes. This enables analytics about banking relationships without full IBAN exposure.
BIC Correlation: When both IBAN and SWIFT/BIC codes appear together, we can verify they're consistent (the IBAN's bank code should match the BIC's institution). Inconsistency may indicate errors or fraud.
SEPA and European Context
The Single Euro Payments Area (SEPA) makes IBAN the standard for European payments:
SEPA Countries: All EU/EEA countries, plus UK, Switzerland, Monaco, San Marino, and others use IBAN for SEPA payments. This creates widespread IBAN usage across European business.
Payment Regulation: EU regulations require IBAN acceptance for cross-border euro payments, ensuring IBAN presence throughout European financial documentation.
GDPR Implications: As personal data enabling financial transactions, IBANs are protected under GDPR. Proper handling, minimization, and protection support GDPR compliance.
Non-European IBAN
IBAN has expanded beyond Europe:
Middle East: UAE, Saudi Arabia, Qatar, Kuwait, Bahrain, and other Gulf states use IBAN for international transactions.
North Africa: Tunisia, Mauritania, and other countries have adopted IBAN.
Other Regions: Brazil, Costa Rica, Guatemala, and countries in other regions use IBAN formats.
Each adopting country registers its format with SWIFT, and we support all registered formats.
Common IBAN Contexts
IBANs appear in specific business contexts:
Invoices and Bills: Payment instructions on invoices prominently display IBANs, often with BIC codes for international payments.
Contracts and Agreements: Payment terms sections specify bank accounts using IBAN format.
Wire Transfer Records: International wire confirmations and records contain beneficiary and intermediary bank IBANs.
Payroll Documents: Employee payment information, especially for international employees, uses IBAN for salary deposits.
Vendor Management: Supplier master data includes IBANs for payment processing.
Redaction Options
Different use cases require different IBAN redaction approaches:
Full Redaction: Replace with [IBAN_REDACTED] or similar marker. Appropriate when no reference to the original is needed.
Partial Masking: Show country code and last few digits (DE**************3000) for verification while protecting the full number.
Country Preservation: Show country code only ([DE_IBAN_REDACTED]) for geographic analysis without account exposure.
Bank Preservation: Redact account portion while preserving bank identification. Enables bank-level analytics without individual account exposure.
Tokenization: Replace with consistent tokens enabling data linking. The same IBAN always produces the same token, enabling payment pattern analysis without exposing real accounts.
Integration Considerations
IBAN detection integrates with financial system workflows:
Payment Processing: Redaction before archival removes IBANs from historical payment records while maintaining transaction references.
Invoice Management: Process invoices to remove supplier banking details before sharing or long-term storage.
Vendor Data: Redact IBANs from vendor master exports shared with auditors or for analytics.
Compliance Reporting: Financial reports may need IBAN redaction before external distribution.
