Technical Architecture

How IBAN Validation Works: Algorithms & MOD-97 Checksums

Understanding the internal mechanics of IBAN validation: from basic regex length constraints to ISO 7064 Modulus 97 mathematical checksum verification.

The 4-Step IBAN Validation Pipeline

When an IBAN is processed by PayeeValidate, it passes through four rigorous validation layers before being declared valid:

1. Sanitization & Normalization: Strips whitespace, hyphens, and converts all letters to uppercase.
2. Length & Country Regex Check: Verifies that the country code is supported and that the total length matches the exact national standard (e.g., exactly 22 characters for Germany).
3. Rearrangement & Letter Conversion: Prepares the string for mathematical checksum verification by moving the first 4 characters to the end and converting letters to numeric values (A=10, B=11, ..., Z=35).
4. ISO 7064 MOD-97 Calculation: Divides the resulting gigantic integer by 97. If the remainder is exactly 1, the check digits are mathematically valid.

Deep Dive into MOD-97 Checksums

The core security feature of an IBAN is its check digit (characters 3 and 4). Because IBAN strings can be up to 34 characters long, simple checksum algorithms fail. The ISO 7064 Modulus 97 algorithm treats the converted numeric string as a massive integer and performs modulo arithmetic.

For example, taking DE89370400440532013000:

• Move DE89 to the end: 370400440532013000DE89
• Convert letters to numbers (D=13, E=14): 370400440532013000131489
• Calculate 370400440532013000131489 mod 97
• The result is 1. The IBAN is mathematically verified.

Why Standard Regex Isn't Enough

Many developers initially attempt to validate IBANs using only regular expressions. While regex can check format and length, it cannot detect transposed digits (e.g., typing 29 instead of 92). Adding MOD-97 checksum validation is mandatory to catch human typos.

Frequently Asked Questions

What happens if an IBAN fails MOD-97?

The transaction or input is rejected immediately as invalid, preventing transfer errors before they occur.

Are all countries using MOD-97?

Yes, every official SEPA and ISO 13616 compliant country uses the MOD-97 checksum standard.

How fast is this calculation?

Using optimized BigInt arithmetic at the edge, our validation engine computes MOD-97 checks in microseconds.

Related pages: IBAN Structure | IBAN Validation API | What is an IBAN?