IBAN Validation Algorithm Explained

Overview of IBAN Structure

Before diving into the algorithm, it helps to understand what you are validating. Every IBAN follows the same high-level structure, regardless of country:

The total length ranges from 15 characters (Norway) to 34 characters (Saint Lucia). The country code tells you which country's banking system the account belongs to. The check digits provide the error-detection capability. The BBAN contains the domestic bank details — bank code, branch code, and account number — in a format defined by each country's national banking authority.

The validation algorithm operates on the entire IBAN as a single unit. It does not care about the internal structure of the BBAN; it treats the whole string as input and produces a simple pass/fail result based on the MOD-97 remainder.

The 4-Step MOD-97 Verification

The core of IBAN validation is a four-step process that converts the alphanumeric IBAN into a large integer and checks whether it is divisible by 97 with a remainder of 1. Here are the steps:

This algorithm is defined by ISO 13616 (which governs the IBAN structure) and uses the MOD-97-10 check character system from ISO 7064. The reason the valid remainder is 1 (not 0) is by design: it ensures that check digits of 00 and 01 are impossible, which provides an additional sanity check.

Worked Example

Let's validate the British IBAN GB29 NWBK 6016 1331 9268 19 step by step.

If any single character had been mistyped — for example, changing the 9 in the check digits to an 8 (GB28) — the final remainder would not be 1, and the validation would fail. This is the power of the MOD-97 algorithm: it detects the error before any money moves.

Letter-to-Number Conversion Table

The following table shows the numeric value assigned to each letter during Step 2 of the algorithm. This mapping is defined by ISO 13616 and follows a simple rule: each letter's value equals its position in the alphabet plus 9 (A is the 1st letter, so A = 1 + 9 = 10).

The conversion is case-insensitive — lowercase letters should be converted to uppercase first. Digits (0–9) pass through unchanged and are not substituted.

Why 97 Was Chosen

The choice of 97 as the modulus is not arbitrary. It was selected for specific mathematical properties that maximize error detection in alphanumeric strings:

• 97 is prime. Using a prime modulus ensures that the check-digit system detects all single-character substitution errors. With a composite modulus, certain substitution errors could go undetected because the difference between two character values might share a factor with the modulus.
• 97 is the largest prime below 100. This is significant because it allows the check digits to fit in exactly two decimal digits (values 02 through 98), keeping the IBAN compact. A larger prime would require three digits for the check field, adding length to every IBAN.
• 97 guarantees transposition detection. Because 97 is coprime to both 10 and to every difference between letter values (which range from 10 to 35), swapping any two adjacent characters will always change the MOD-97 remainder. This mathematical property guarantees 100% detection of transposition errors.
• The false-positive rate is approximately 1 in 97. For random multi-character errors, the probability that the corrupted IBAN still produces a remainder of 1 is approximately 1/97, or about 1.03%. This means the algorithm catches roughly 99% of all random errors, which is far superior to simpler check-digit schemes like MOD-10 (Luhn), which catches about 90%.

The combination of these properties makes MOD-97 one of the most effective check-digit systems in use for financial identifiers. The designers of the IBAN standard specifically selected it because the cost of a misdirected international payment far exceeds the minor increase in computational complexity compared to simpler alternatives.

Country-Specific BBAN Validation

The MOD-97 algorithm validates the IBAN as a whole, but it does not examine the internal structure of the BBAN. A comprehensive validation system also checks country-specific rules:

• Length. Each country defines a fixed IBAN length. Germany requires exactly 22 characters, France requires 27, Norway requires 15. An IBAN with the wrong length for its country code is invalid even if the MOD-97 check passes (which it would not, since the length error changes the numeric value).
• Character pattern. Each country specifies which BBAN positions must be numeric and which may be alphabetic. A German BBAN is entirely numeric (18 digits), while a British BBAN starts with four letters (the bank identifier, e.g., NWBK) followed by 14 digits. A letter in a position that should be numeric is invalid.
• National check digits. Some countries embed additional check digits within the BBAN. France includes a 2-digit RIB key, Spain includes 2 CCC control digits, and Belgium includes a 2-digit national check. These must be validated separately from the IBAN-level MOD-97 check.
• Bank code existence. Some validation systems go a step further and verify that the bank code in the BBAN corresponds to a real, active bank. This requires an up-to-date database of bank codes and is not part of the IBAN standard itself, but it provides an additional layer of confidence.

A robust IBAN validator performs all of these checks in sequence: country code recognition, length verification, character pattern matching, MOD-97 checksum, and (optionally) national check-digit validation and bank code lookup.

Edge Cases

Several edge cases deserve attention when implementing or reasoning about IBAN validation:

Implementation Approach

The numeric string produced by Step 2 can easily exceed 30 digits, which overflows standard 32-bit and 64-bit integer types. The standard solution is the chunking technique: instead of computing MOD 97 on the entire number at once, you process it in segments of up to 9 digits (which safely fits in a 32-bit integer) or 16 digits (for 64-bit), carrying the remainder forward.

The chunk size of 7 digits is conservative and works with 32-bit integers (the maximum intermediate value is a 9-digit number when the remainder is prepended, which fits within 2^31 – 1 = 2,147,483,647). Languages with 64-bit integers can use larger chunks for fewer iterations. Languages with native big-integer support (such as Python or JavaScript's BigInt) can skip chunking entirely and compute the modulus directly on the full number.

Here is the complete validation flow in pseudocode:

For a practical guide to implementing this in real code, see our guide on how to validate bank details in code.

What the Algorithm Does Not Check

It is important to understand the limits of MOD-97 validation:

• Account existence. A valid MOD-97 result does not mean the account exists. The IBAN could refer to a closed account, a never-issued account number, or a test account. Only the receiving bank can confirm account existence.
• Account holder identity. The IBAN contains no information about who owns the account. The algorithm cannot verify that the IBAN belongs to the person you intend to pay.
• Account status. An IBAN that passes validation may belong to a frozen, blocked, or restricted account. The validation algorithm has no way to know the account's current status.

MOD-97 validation is a necessary first step, but it is not sufficient on its own. For high-value transfers, consider using confirmation-of-payee services (where available) to verify the account holder's name before sending money.

Frequently Asked Questions

Does passing MOD-97 guarantee the account exists?

No. MOD-97 validation confirms that the IBAN is structurally correct and that the check digits match the rest of the string. It does not verify that the bank code refers to a real bank or that the account number has been issued. A valid IBAN could refer to a non-existent account. Account existence is verified only when the payment is actually processed by the receiving bank.

What types of errors does MOD-97 catch?

MOD-97 catches 100% of single-character substitution errors (any one character changed to a different character) and 100% of transposition errors (any two adjacent characters swapped). For all other error types — including multiple substitutions, non-adjacent transpositions, insertions, and deletions — it catches approximately 99% of errors. The only scenario where an error goes undetected is when the corrupted IBAN happens to produce a MOD-97 remainder of 1 by coincidence, which has a probability of roughly 1 in 97.

Can two different IBANs have the same check digits?

Yes, but only if they have different BBANs. The check digits are derived from the combination of country code and BBAN. Two accounts at different banks or in different countries can coincidentally end up with the same check digits. For example, a German IBAN and a French IBAN could both have check digits 76, but the rest of their structure would be entirely different. Within the same country, two IBANs with the same check digits will always have different BBANs, so there is no risk of confusion. The check digits are not unique identifiers — they are error-detection codes specific to the IBAN they belong to.

Validate an IBAN

You do not need to run this algorithm by hand. Paste any IBAN into our free IBAN validator and it will run the full validation pipeline automatically: country code check, length verification, character pattern matching, MOD-97 checksum, and a detailed breakdown of the bank and account details encoded in the number. All processing runs entirely in your browser — no data is sent to any server.