Validate an IBAN: the mod-97 check explained

The algorithm on DE89 3704 0044 0532 0130 00

1. Remove spaces and upper-case: DE89370400440532013000 (22 characters, the German length).

2. Move the first four to the end: 370400440532013000DE89.

3. Replace letters: D = 13, E = 14 → 3704004405320130001314 89, written together: 370400440532013000131489.

4. Compute that number modulo 97. Do it in chunks so no integer overflows: take the first 9 digits, remainder mod 97, append the next 7 digits, remainder again, until the end. The remainder is 1, so the IBAN is valid.

To generate the check digits for a new account: put 00 in their place, compute the remainder r the same way, then the check digits are 98 − r, padded to two digits.

export function ibanValid(input) {
  const iban = input.toUpperCase().replace(/[\s-]/g, "");
  if (!/^[A-Z]{2}[0-9]{2}[A-Z0-9]+$/.test(iban)) return false;
  const rearranged = iban.slice(4) + iban.slice(0, 4);
  let r = 0;
  for (const ch of rearranged) {
    const v = ch >= "A" ? String(ch.charCodeAt(0) - 55) : ch; // A=10 … Z=35
    for (const d of v) r = (r * 10 + Number(d)) % 97;
  }
  return r === 1;
}

What does mod-97 catch, and what does it miss?

It catches every single wrong character and every swap of two adjacent characters (the two errors people make when typing). It does not catch a wrong country, a wrong length with coincidentally valid digits, a letter where the national format wants a digit, a closed account or a bank that left the SEPA scheme. That is why a real validator does four more things: country known, length right for the country, BBAN pattern from the registry, SEPA flag from the EPC list; and why a payment system then still receives rejects (AC01, account number incorrect) from the bank.

Why do the registry and the SEPA list matter?

The SWIFT IBAN Registry (the ISO 13616 registration authority’s file) lists for each country the IBAN length, the BBAN structure in a compact notation (8!n10!n means eight digits then ten digits), and where the bank and branch identifiers sit. The European Payments Council publishes the list of countries in the SEPA schemes; it is not the same as the EU (Switzerland and the UK are in, Türkiye is not) and it changed in October 2025. The API returns sepa and sepaSince so a payments team can warn before sending.

Can you get the BIC from an IBAN?

The IBAN gives the bank identifier inside the BBAN (the German Bankleitzahl, the French code banque), but mapping it to the BIC and the bank’s name needs the SWIFT BIC Directory or IBAN Plus, which are licensed data products, not open data. We prefer to say so and put BIC lookup on the roadmap than to ship a scraped directory that goes stale. The validation itself needs no BIC: since 2016 (Regulation 260/2012) an IBAN alone suffices for SEPA payments.