Developing Financial Systems: Implementing IBAN Validation Logic and Regex

Building software that handles financial transactions—whether it's an e-commerce checkout, an HR payroll platform, or an Enterprise Resource Planning (ERP) system—requires rigorous data validation. One of the most critical fields is the bank account number. Accepting a malformed IBAN will lead to failed wire transfers, bounced payments, and severe operational friction. In this technical guide, we will explore the logic of implementing a bulletproof IBAN validation system, focusing on Regular Expressions (Regex) and the mathematical challenges of the MOD-97 algorithm.

The Three Tiers of IBAN Validation

A robust validation architecture should provide immediate, client-side feedback before making any server calls. The process is broken down into three distinct tiers: Sanitization/Basic Regex, Country-Specific Length Checking, and Cryptographic Math (MOD-97).

Tier 1: Sanitization and Basic Regex

Users will copy-paste IBANs in various formats. Some include spaces every four characters, some use dashes, and some type in lowercase.

1. Sanitization: Strip all non-alphanumeric characters (spaces, hyphens) and convert the entire string to uppercase.
2. Basic Format Validation: According to ISO 13616, an IBAN must start with two letters (Country Code), followed by two digits (Check Digits), followed by up to 30 alphanumeric characters.

The standard Regex pattern to enforce this is:
/^[A-Z]{2}[0-9]{2}[A-Z0-9]+$/

If the sanitized string fails this Regex test, reject it immediately. There is no need to proceed to heavier mathematical checks.

Tier 2: Country-Specific Length Validation

An IBAN's length is not universal; it is strictly defined by the issuing country, ranging from 15 to 34 characters. A French IBAN is always 27 characters; a German one is always 22.

To implement this, you must maintain a key-value dictionary (or Map) in your codebase:

const ibanLengths = {
  GB: 22, DE: 22, FR: 27, TR: 26, CH: 21, NO: 15 // ... and so on
};

Extract the first two characters (substring(0, 2)), look up the expected length in the dictionary, and ensure iban.length === expectedLength. If the country code isn't in your dictionary, or the length mismatches, the validation fails.

Tier 3: The MOD-97 Algorithm and the BigInt Problem

If the string passes Tier 1 and Tier 2, it is structurally plausible. Now, you must prove it mathematically using the MOD-97-10 check.

The logic is defined as:

1. Move the first 4 characters (Country Code + Check Digits) to the end of the string.
2. Convert all alphabetical characters to integers (A = 10, B = 11 ... Z = 35).
3. Take the modulus 97 of the resulting string. If the result is 1, the IBAN is valid.

The Developer's Trap: Precision Loss

The string generated in Step 2 will be a number up to 30 digits long. In languages like JavaScript, the standard Number type (a 64-bit float) loses precision after 15 safe integer digits. If you run hugeNumber % 97, the browser will silently truncate the number, yielding a mathematically incorrect modulo, leading to false positives or false negatives.

Solution 1: Native BigInt

Modern programming languages support arbitrarily large integers. In JavaScript, you can use BigInt:

// Assuming 'numericString' is the fully converted 30-digit string
const isValid = BigInt(numericString) % 97n === 1n;

Solution 2: Piecewise Modulo Arithmetic

If you are working in a constrained environment or supporting legacy systems without BigInt, you must calculate the modulo piece by piece, traversing the string:

function mod97(numericString) {
  let remainder = 0;
  for (let i = 0; i < numericString.length; i++) {
    const char = numericString[i];
    remainder = (remainder * 10 + parseInt(char, 10)) % 97;
  }
  return remainder;
}

This loop ensures that the numbers in memory never exceed safe integer limits, providing perfect accuracy.

Testing Your Implementation

When writing unit tests for your validation module, it is crucial to test edge cases: valid IBANs, IBANs with transposition errors (swapped digits), invalid country codes, and length mismatches.

If you encounter unexpected failures during development, or if you need a reliable sandbox to verify a specific IBAN's MOD-97 remainder step-by-step, you can cross-reference your results with our IBAN Validation and Calculator. Our tool breaks down the format, length, and modulo checks, acting as an excellent debugging companion for developers building secure financial pipelines.