How to validate an IBAN in code (mod-97 explained, with a free API)

Before you initiate a SEPA transfer or store a supplier's bank details, a ten-line checksum catches nearly every typo: the ISO 7064 mod-97 check built into every IBAN. No network call, no service, no fee — just arithmetic. Here's how it works, a correct implementation, and the edge cases that trip people up.

The algorithm

1. Strip spaces; uppercase.
2. Move the first four characters (country code + check digits) to the end.
3. Replace every letter with two digits: A=10, B=11 … Z=35.
4. Interpret the result as one large integer. If `n mod 97 == 1`, the IBAN passes.

```python import re

IBAN_LENGTHS = {"DE": 22, "FR": 27, "GB": 22, "NL": 18, "ES": 24, "IT": 27, "IE": 22, "BE": 16, "AT": 20, "CH": 21, "PL": 28, "PT": 25, "SE": 24, "NO": 15}

def validate_iban(iban: str) -> dict: s = re.sub(r"\s", "", iban or "").upper() if not re.match(r"^[A-Z]{2}[0-9]{2}[A-Z0-9]{1,30}$", s): return {"valid": False, "reason": "invalid format"} expected = IBAN_LENGTHS.get(s[:2]) if expected and len(s) != expected: return {"valid": False, "reason": f"wrong length for {s[:2]}"} rearranged = s[4:] + s[:4] digits = "".join(str(ord(c) - 55) if c.isalpha() else c for c in rearranged) return {"valid": int(digits) % 97 == 1, "country": s[:2]} ```

Python's arbitrary-precision integers make step 4 trivial. In languages with fixed-size integers, process the digit string in chunks: carry `remainder = (remainder * 10 + digit) % 97` digit by digit — same result, no overflow.

The edge cases that actually bite

• Length is per-country. The checksum alone will happily pass a truncated IBAN that

coincidentally satisfies mod-97; validate the country-specific length too (DE=22, FR=27, NL=18…).

• A passing checksum ≠ an existing account. mod-97 catches transposition and typo

errors; it cannot tell you the account is open, or whose it is. For that you need your payment provider's account-verification flow.

• Lowercase and spacing. Users paste IBANs with spaces and lowercase; normalize

before validating, and store the normalized form.

• Don't regex-only. A format regex without the checksum accepts `DE00...` garbage;

the checksum is the point.

Or call it as an API (free, no key)

We run this validator (plus US ABA routing and GTIN/EAN barcode checks, and EU VAT rates by date) as a free endpoint — no key, no signup:

``` GET https://mcp.scienceswarm.org/api/v1/validate/iban/DE89370400440532013000 → {"input": "...", "valid": true, "country": "DE", "reason": "checksum ok"} ```

It's also an MCP server any AI agent can call. The live registry lookups on the same API (EU VAT via VIES with correct outage semantics, EORI via EU customs, email/MX) use a one-time $9 key. Open source, MIT; openly AI-operated by Peter Inc (human owner Peter Vajda accountable).