International Bank Account Number (IBAN) - Global

Detects International Bank Account Numbers (IBANs) across the full ISO 13616 / SWIFT IBAN Registry country set, extending coverage beyond the EU-focused eu-iban pattern to non-EU IBAN countries verified against the SWIFT IBAN registry — at minimum United Kingdom (GB, 22 chars), Switzerland (CH, 21), Norway (NO, 15), Saudi Arabia (SA, 24), United Arab Emirates (AE, 23), and Turkey (TR, 26). The structural regex widens eu-iban's BBAN length range (12-36 alphanumeric characters) down to 8-32 specifically to also catch shorter formats such as Norway's 15-character IBAN (11-character BBAN), which falls below eu-iban's minimum and would not match it. This pattern intentionally co-fires with eu-iban for EU country codes, since neither pattern restricts the 2-letter prefix to a specific country allow-list — see false_positives.

Type: regex
Engine: boost_regex
Confidence: high
Confidence justification: High confidence: the two-letter country code prefix followed by exactly two check digits, combined with the mod-97 checksum validator, produces low false positive rates. The widened length range trades a small amount of extra structural looseness (to reach Norway's shorter format) for broader global coverage; the checksum validator carries the precision that the regex alone cannot express without banned per-country length alternation.
Jurisdictions: global
Regulations: GDPR, CCPA/CPRA
Frameworks: ISO 27001, ISO 27701, PCI-DSS, SOC 2
Data categories: financial, pii
Scope: narrow
Risk rating: 9
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Unsupported

Pattern

\b[A-Z]{2}\d{2}[\s-]?[A-Z0-9]{4}(?:[\s-]?[A-Z0-9]{4}){1,6}(?:[\s-]?[A-Z0-9]{1,4})?\b

Corroborative evidence keywords

IBAN, bank account, international bank, account number, account no, SWIFT, BIC, sort code, routing number, [object Object], [object Object]

Proximity: 300 characters

Should match

GB33BUKB20201555555555 — United Kingdom (GB) IBAN, 22 characters, no delimiters — the SWIFT/ISO 13616 published example
CH56 0483 5012 3456 7800 9 — Switzerland (CH) IBAN, 21 characters, space-separated groups
NO8330001234567 — Norway (NO) IBAN, 15 characters — the global minimum length, shorter than eu-iban's regex can match
SA4420000001234567891234 — Saudi Arabia (SA) IBAN, 24 characters, no delimiters
AE460090000000123456789 — United Arab Emirates (AE) IBAN, 23 characters, no delimiters
TR190006200009112345678901 — Turkey (TR) IBAN, 26 characters, no delimiters

Should not match

GB33BUKB — Only 8 characters — too short, missing the mandatory second BBAN group
1234567890123456 — Digit-only string missing the two-letter country code prefix
INVALID123456789 — Starts with more than two letters before any digit, not a valid IBAN structure

Known false positives

Co-fires with eu-iban for EU country codes, since both patterns use the same generic 2-letter-country + 2-digit-checksum + alphanumeric BBAN structure and neither restricts the country code to an allow-list. This is expected and by design. Mitigation: Deploy either pattern alone, or both if RulePack budget allows and de-duplicate at the reporting layer. The mod-97 Func_iban checksum validator rejects the overwhelming majority of structurally- shaped non-IBAN strings regardless of which pattern fires.
Product codes, serial numbers, or reference numbers beginning with two letters and two digits (e.g. invoice-prefix or license-plate-like strings) can coincidentally satisfy the structural pattern. Mitigation: Validate the check digits using the MOD-97 algorithm (Func_iban). Require corroborative evidence keywords within the proximity window.