86 countries use the IBAN standard today, and if your business sends international payments, knowing which ones, and what format they require, directly affects whether your transfers go through or come back rejected.
This guide is for finance teams, treasury professionals, and payment operations managers who need a reliable, up-to-date reference on IBAN-compliant countries, format structures, and validation best practices. Whether you’re onboarding a new international supplier, building a payment integration, or auditing your accounts payable data, this is your starting point.
Key Takeaways
- 86 countries currently use the IBAN standard, including all 36 SEPA countries
- Every IBAN follows the same structure: 2-letter country code + 2 check digits + BBAN
- The UK uses IBANs for international transfers only, domestic payments rely on sort codes, account numbers, and Confirmation of Payee
- Always validate IBANs before sending payments, check digit errors cause most cross-border payment failures
- Structural validation alone is not enough, account ownership verification is essential to prevent fraud
- Format specifications change: use the SWIFT IBAN Registry as your authoritative source
What Is an IBAN and Why Does It Matter for Cross-Border Payments?
An International Bank Account Number (IBAN) is a standardised identifier used to uniquely recognise a bank account across borders. Governed by ISO 13616 and maintained by SWIFT, it was designed to eliminate the ambiguity of inconsistent domestic account formats that caused payment failures in international transfers.
For UK businesses, the distinction is important: IBANs are not used for domestic payments. Transfers within the UK rely on sort codes, account numbers, and payment rails such as Faster Payments, BACS, and CHAPS. However, any payment sent from a UK bank to a European or IBAN-zone beneficiary must include a valid IBAN, and the reverse applies to incoming international payments from IBAN countries.
What Does an IBAN Look Like? Format and Structure Explained
Every IBAN is made up of four components:
| Component | Length | Example (United Kingdom) |
|---|---|---|
| Country Code | 2 letters | GB |
| Check Digits | 2 digits | 29 |
| Bank Identifier (BBAN) | 4 letters | NWBK |
| Sort Code + Account Number (BBAN) | 14 digits | 60161331926819 |
Full example:GB29 NWBK 6016 1331 9268 19
Total IBAN length is fixed per country, ranging from 15 characters (Norway) to 34 characters (some newer adopters). The BBAN, everything after the first 4 characters, follows country-specific rules and encodes the local bank code, branch code, and account number.
Quick Reference: IBAN Formats for Key Trading Partners
| Country | Code | Length | Example |
|---|---|---|---|
| United Kingdom | GB | 22 | GB29 NWBK 6016 1331 9268 19 |
| Germany | DE | 22 | DE89 3704 0044 0532 0130 00 |
| France | FR | 27 | FR76 3000 6000 0112 3456 7890 189 |
| Spain | ES | 24 | ES91 2100 0418 4502 0005 1332 |
| Netherlands | NL | 18 | NL91 ABNA 0417 1643 00 |
| Italy | IT | 27 | IT60 X054 2811 1010 0000 0123 456 |
| Switzerland | CH | 21 | CH93 0076 2011 6238 5295 7 |
| UAE | AE | 23 | AE07 0331 2345 6789 0123 456 |
| Saudi Arabia | SA | 24 | SA03 8000 0000 6080 1016 7519 |
| Poland | PL | 28 | PL61 1090 1014 0000 0712 1981 2874 |
Which Countries Use IBAN? Full List by Region
86 countries and territories appear in the current SWIFT IBAN Registry.
Europe (SEPA Zone — 36 Countries)
All EU member states plus Iceland, Liechtenstein, Norway, Switzerland, United Kingdom, Andorra, Monaco, San Marino, and Vatican City. IBAN is mandatory for all euro-denominated transfers within SEPA.
| Country | Code | Length |
|---|---|---|
| Austria | AT | 20 |
| Belgium | BE | 16 |
| Bulgaria | BG | 22 |
| Croatia | HR | 21 |
| Cyprus | CY | 28 |
| Czech Republic | CZ | 24 |
| Denmark | DK | 18 |
| Estonia | EE | 20 |
| Finland | FI | 18 |
| France | FR | 27 |
| Germany | DE | 22 |
| Greece | GR | 27 |
| Hungary | HU | 28 |
| Ireland | IE | 22 |
| Italy | IT | 27 |
| Latvia | LV | 21 |
| Lithuania | LT | 20 |
| Luxembourg | LU | 20 |
| Malta | MT | 31 |
| Netherlands | NL | 18 |
| Norway | NO | 15 |
| Poland | PL | 28 |
| Portugal | PT | 25 |
| Romania | RO | 24 |
| Slovakia | SK | 24 |
| Slovenia | SI | 19 |
| Spain | ES | 24 |
| Sweden | SE | 24 |
| Switzerland | CH | 21 |
| United Kingdom | GB | 22 |
Within the SEPA zone, EU Regulation 260/2012 mandates that payment service providers accept IBANs as the sole account identifier, no additional domestic account number required. In practice, however, format compliance alone does not guarantee payment security: even a correctly formatted IBAN can route funds to the wrong beneficiary. This is why Confirmation of Payee requirements are being strengthened across European markets, and why the UK’s own CoP framework exists for domestic transfers.
Middle East and Africa
| Country | Code | Length |
|---|---|---|
| Bahrain | BH | 22 |
| Egypt | EG | 29 |
| Iraq | IQ | 23 |
| Jordan | JO | 30 |
| Kuwait | KW | 30 |
| Lebanon | LB | 28 |
| Libya | LY | 25 |
| Mauritania | MR | 27 |
| Qatar | QA | 29 |
| Saudi Arabia | SA | 24 |
| Tunisia | TN | 24 |
| United Arab Emirates | AE | 23 |
Americas and Caribbean
| Country | Code | Length |
|---|---|---|
| Brazil | BR | 29 |
| Costa Rica | CR | 22 |
| Dominican Republic | DO | 28 |
| El Salvador | SV | 28 |
| Guatemala | GT | 28 |
Which Countries Do NOT Use IBAN?
The following major economies use domestic account identifiers instead:
- United States: ABA routing number + account number
- Canada: Institution + transit + account number
- Australia / New Zealand: BSB + account number
- China, Japan, South Korea, India: Country-specific domestic standards
Sending a payment to a US or Australian bank account with an IBAN field will cause the transfer to fail. Always detect the destination country and apply the correct identifier type.
How Are IBAN Check Digits Validated?
Check digits in positions 3–4 catch transcription errors before a payment is sent. The algorithm is ISO 7064 MOD-97-10:
- Move the 4-character header (country code + check digits) to the end
- Replace each letter with its numeric equivalent (A=10, B=11 … Z=35)
- Divide the resulting number by 97
- A valid IBAN returns a remainder of 1
Most payment systems handle this automatically, but any system accepting user-submitted IBANs should validate check digits at the point of entry, not at the point of payment. A structurally valid IBAN can still belong to a fraudulent account, check digit validation catches formatting errors, not bad actors. Understanding the fraud verification process helps clarify what additional controls are needed beyond structural checks.
How Should You Validate IBANs Before Sending Payments?
Structural validation (format + check digits) is a minimum baseline, not a complete solution. A structurally valid IBAN can still point to a non-existent or fraudulent account.
The recommended validation stack:
- Format check — correct country code, correct length, valid characters
- Check digit validation — MOD-97-10 confirms no transcription errors
- Account existence and ownership verification — confirms the IBAN maps to a real, active account held by the expected beneficiary
The third layer is where most fraud is caught. Authorised Push Payment (APP) fraud and Business Email Compromise (BEC) attacks often substitute a legitimate IBAN with a fraudulent one that passes structural validation perfectly. Bank account verification software handles all three layers automatically — checking format, confirming account existence, and verifying that the account belongs to the expected beneficiary.
Trustpair does this continuously, flagging changed IBANs and verifying beneficiary identity before payment release. J.P. Morgan, for instance, partnered with Trustpair to automate bank account ownership validation at scale globally. If you’re evaluating your options, our guide on IBAN verification tools covers the key criteria to look for.
What Are the Rules for Storing and Displaying IBANs?
- Store: Always uppercase, no spaces —
GB29NWBK60161331926819 - Display: Groups of 4 characters —
GB29 NWBK 6016 1331 9268 19 - Never store: Lowercase or space-formatted strings — normalisation errors cause validation mismatches
How Should Finance Teams Implement IBAN Validation at Scale?
For teams processing high volumes of supplier or counterparty payments, one-off manual checks are neither scalable nor reliable. Key implementation principles:
- Validate at intake — when a supplier submits banking details, not at payment time
- Re-validate before every payment — especially for high-value or infrequent transfers
- Re-validate on any change — changed bank details are the primary fraud vector; treat every update as a new submission
- Handle non-IBAN countries correctly — detect the destination and collect the appropriate domestic identifiers (sort code + account number for UK domestic, ABA routing for the US, BSB for Australia, etc.)
Re-validating on any change is particularly critical: fraudsters frequently impersonate suppliers to request bank detail updates, a tactic that bypasses format-only checks entirely. At high volumes, automated account validation is the only reliable approach.