Check a UK Bank Account Number: IBAN & Sort Code Guide

Checking bank details means separating three questions: is the identifier correctly formatted, does the intended account match the supplied name, and is the payment request genuine? A valid IBAN answers only the first. Use independent confirmation when bank details change; neither a document check nor a name match guarantees that a payment is safe.

To validate an IBAN number, verify the country code (2 letters), check digits (2 digits), and bank-specific account number using the ISO 13616 standard and the MOD 97-1 algorithm defined in ISO 7064. A UK sort code is validated by checking its 6-digit format (XX-XX-XX) against the Extended Industry Sort Code Directory (EISCD), which confirms the sort code is active and identifies the bank branch. Format validation alone catches transcription errors but does not confirm the account exists or belongs to the expected party — full verification requires Confirmation of Payee (CoP) or an account verification API.

This guide covers the structure of UK and international bank account identifiers, the verification methods available, the regulatory requirements under FCA and Pay.UK rules, and the practical steps to automate bank account validation in your workflows.

This article is provided for informational purposes and does not constitute legal advice. Consult a qualified professional for situation-specific guidance.

UK Bank Account Identifiers: Sort Code and Account Number

The United Kingdom uses a dual-identifier system for domestic payments. The sort code (6 digits, formatted as XX-XX-XX) identifies the bank branch, while the account number (8 digits) identifies the individual account. Together, they route payments through the BACS, Faster Payments, and CHAPS networks.

For international payments and SEPA transactions, UK accounts are represented as IBANs. The UK IBAN is 22 characters long and follows a defined structure.

UK IBAN Structure

IBAN Structures Across Major European Countries

IBAN length and composition vary by country. Any validation system must account for these national differences.

The IBAN Check Digit Algorithm (MOD 97-1)

The IBAN check digits at positions 3-4 are calculated using the MOD 97-1 algorithm defined in ISO 7064. This mathematical validation detects certain transcription errors; it does not establish account ownership.

The validation process follows four steps. First, move the first four characters (country code and check digits) to the end of the string. Second, convert all letters to numbers using the mapping A=10, B=11 through Z=35. Third, compute the remainder when dividing the resulting number by 97. Fourth, if the remainder equals 1, the check digits are valid.

This verification catches data entry mistakes but provides no assurance about whether the account exists, is active, or belongs to the expected party.

Confirmation of Payee: The UK Standard for Name Matching

Confirmation of Payee is an account-name checking service. The PSR’s Specific Direction 17 guidance, checked 14 October 2026, describes Group 1 and Group 2 deadlines of 31 October 2023 and 31 October 2024, with exemptions. This is a requirement for directed payment service providers, not a statement that every payment or account is covered.

How CoP Works

When the service is available, the payment provider compares the supplied payee details with the receiving account. The response can indicate a match, close match or no match; a check may also be unavailable. Follow the provider’s guidance and investigate discrepancies before proceeding.

A warning should trigger review, not an automatic override. Confirm changes using contact details already held on file, not those supplied with the new payment instruction.

CoP Limitations

A name match does not establish that an invoice is genuine, that an email sender is authorised, or that the intended transaction is safe. An unavailable response does not by itself establish fraud. Verify what the payment provider actually checked.

APP Fraud and the Regulatory Landscape

For UK Faster Payments, PS24/7 confirms a maximum reimbursement level of £85,000 per claim from 7 October 2024. Scope and exclusions matter: do not treat this as a guarantee for every business payment. Reference checked 14 October 2026.

The PSR’s consolidated policy statement, May 2025 describes the five-business-day reimbursement timescale and conditions for pausing it to obtain information, with a 35-business-day outer limit. Check the current rules and the facts of a claim with the payment provider rather than promising an unconditional five-day refund.

CHAPS and BACS Controls

Check the operating rules and verification services for the payment rail you use. Do not apply a Faster Payments reimbursement rule to another rail by analogy. Ask the bank or payment provider which checks it performs and which responsibilities remain with your organisation.

Bank account verification methods compared

Common Bank Account Fraud Patterns

Bank account fraud takes several forms, each exploiting different gaps in verification processes.

Invoice Redirection Fraud

A fraudster impersonates a supplier and sends changed bank details, sometimes alongside a genuine invoice. A process that updates the supplier record without independent confirmation can redirect the payment. Keep the verification channel separate from the change request.

Account Takeover

The fraudster gains access to a legitimate business email account and sends payment instructions from a trusted address. Because the email is authentic, the request bypasses social engineering defences.

Mule Accounts

Fraudsters recruit or coerce individuals to open bank accounts in their own names, then use these accounts to receive fraudulent payments. The account passes CoP name checks if the payer has been given the mule's name as the expected payee.

Practical Verification Workflow

An effective bank account verification process operates at three levels, each adding assurance.

Level 1: Format Validation

Validate the sort code against the EISCD to confirm it is a valid, active sort code assigned to a participating bank. Validate the account number length (8 digits for UK accounts). For IBANs, run the MOD 97-1 check digit calculation. This level catches data entry errors.

Level 2: Account Existence Check

Use a provider whose documented service checks the required account attributes. A directory or checksum lookup does not establish live account status. Treat unavailable or unsupported checks as unresolved, not as successful verification.

Level 3: Name Matching and Identity Verification

CoP provides name matching for UK accounts. For international payments or higher-risk transactions, supplement CoP with identity verification and KYC checks. Cross-reference the account holder's name with corporate registry data, proof of address documentation, and existing supplier records.

Automating Bank Account Verification

Manual verification of bank details does not scale. A procurement team processing hundreds of supplier invoices monthly cannot realistically call each supplier's bank to confirm account ownership. Automation addresses this gap by integrating bank account validation directly into accounts payable and onboarding workflows.

A document workflow can extract bank identifiers and compare them across submitted files. Format validation, account-name checks and live account verification are separate capabilities. Confirm which provider performs each step and which external data it requires; do not infer live bank access from document extraction.

Keep the check result, source, timestamp and reviewer decision in an audit trail. Automation can reduce repeated entry, but failed checks, unavailable providers and mismatched names still need an explicit handling path.

The integration with broader customer due diligence processes ensures that bank account verification is not treated as an isolated check but as part of a comprehensive onboarding and monitoring programme.

Take action

Discuss your document types, volumes and required checks with CheckFile. Confirm supported formats, integrations and response expectations in the agreed scope before a pilot.

Request a free pilot

---

Frequently Asked Questions

Does passing the IBAN check digit validation mean the account is legitimate?

No. The MOD 97-1 algorithm verifies the mathematical consistency of the IBAN structure. It confirms the check digits are correct for the given account number, but it does not confirm the account exists, is active, or belongs to the expected party. A fraudster can provide a syntactically valid IBAN for an account they control.

Is Confirmation of Payee mandatory for all UK payments?

Coverage depends on the directed provider, account and payment flow, with exemptions. Ask your payment provider whether the check applies and how to handle a match, mismatch or unavailable result. A missing response is not proof that the account is fraudulent.

What should a business do when a supplier requests a change of bank details?

Never update bank details based solely on an email or letter. Contact the supplier using a previously verified phone number (not a number provided in the change request). Verify the new bank details through CoP or an IBAN verification API. Require dual authorisation for any bank detail change in your accounts payable system. Document the verification in your audit trail.

How do IBAN verification APIs work?

Capabilities vary by provider. Ask which checks are format-only, which use a bank directory, and which rely on a live name or account service. Test coverage, unavailable responses, audit records and error handling before integration. There is no universal latency or fraud-detection guarantee.

What is the difference between IBAN validation and bank account verification?

IBAN validation checks the structure and check digits. Account verification uses additional services to check specified account attributes. Neither validates the commercial reason for a payment; independent confirmation of the request remains necessary.