An IBAN is a fixed-format account identifier defined by ISO 13616. The first two characters are the ISO 3166-1 alpha-2 country code, the next two are check digits, and the remainder is the country-specific BBAN (Basic Bank Account Number). Total length varies by country: 15 (Norway) to 34 (Malta, Saint Lucia).
Validation is a two-step process: (1) length sanity per country, (2) the mod-97 check. The mod-97 algorithm: move the first 4 characters to the end, replace letters with numbers (A=10, B=11, …, Z=35), and check that the resulting integer mod 97 equals 1. The arithmetic is large-integer but can be chunked through 9-digit windows to stay in 32-bit safe-integer range.
A valid mod-97 does NOT mean the account exists, is open, or belongs to the named beneficiary. It only means the digits are internally consistent. Beneficiary-name verification ("Confirmation of Payee" / "VOP" / "SurePay") is a separate rail-side service.
The browser-safe implementation is at lib/iban.ts (isValidIban, normaliseIban); the server-side equivalent at apps/api/src/lib/iban.ts. The standalone validator route is POST /v1/iban/validate.