Country-specific checksums

[globalcitizen]

We could support the calculation of known national (BBAN-level) or bank-specific (sub-BBAN-level) checksums against algorithms where known. Please contribute if you know any.

[globalcitizen]

Fun, fun, fun

Zero or more checksum digits
In some cases like the Netherlands (and perhaps French SIREN), there are no checksum digits but an algorithm exists anyway. About half of the countries have 1 checksum digit, and about half have 2.

Types of algorithms
In some cases like Spain, we see a single check digit applied to part of the BBAN, and a second check digit applied to the rest of the BBAN.

Normally however, the checksum should be applied to the whole BBAN minus the checksum itself, or possibly with the checksum zeroed (where this is significant) or the checksum replaced with 'XX' (where this is logical).

Newer countries almost certainly use an ISO7064 variant. Unfortunately, the ISO insists on charging for its standards, so we can't get a copy. In addition, there are actually two ISO7064 standards, a 1983 version and a 2003 version. Probably the older countries use the 1983 version. What differences exist are unclear. If someone would like to donate me copies of either standard, that would be useful. According to the ISO7064 java library, ISO7064 defines the following 'pure' systems, each of which use a single modulus for all stages of the calculation:

• ISO/IEC 7064, MOD 11-2 for numeric strings with one check digit or the supplementary check character "X"
• ISO/IEC 7064, MOD 37-2 for alphanumeric strings with one check digit or letter or the supplementary check character "*"
• ISO/IEC 7064, MOD 97-10 for numeric strings with two check digits
• ISO/IEC 7064, MOD 661-26 for alphabetic strings with two check letters
• ISO/IEC 7064, MOD 1271-36 for alphanumeric strings with two check digits or letters

In addition, it also defines the following 'hybrid' systems (not implemented by the library). The hybrid systems each use two moduli in the calculation. One modulus is equal to, and the other is one greater than, the number of characters in the character set of the string to be protected. These hybrid systems always provide a check character within the character set of the string to be protected:

• ISO/IEC 7064, MOD 11,10 for numeric strings with one check digit
• ISO/IEC 7064, MOD 27,26 for alphabetic strings with one check letter
• ISO/IEC 7064, MOD 37,36 for alphanumeric strings with one check digit or letter

There are also three other major algorithms:

• Luhn algorithm (1954) - for numeric strings with one check digit, based on mod10
• Verhoeff algorithm (1969) - for numeric strings with one check digit, complex, based on lookup tables
• Damm algorithm (2004) - for numeric strings with one check digit, complex and rare, based on weakly totally anti-symmetric quasigroups.

Summary of Algorithms

Algorithm	Input type	Output characters	Basis	References	Comments
ISO/IEC 7064, MOD 11-2	Numeric	1 digit/X	Mod11 Radix 2	java
ISO/IEC 7064, MOD 37-2	Alphanumeric	1 digit/letter/*	Mod37 Radix 2	java
ISO/IEC 7064, MOD 97-10	Numeric	2 digits	Mod97 Radix 10	java
ISO/IEC 7064, MOD 661-26	Alphabetic	2 letters	Mod661 Radix 26	java	Unlikely.
ISO/IEC 7064, MOD 1271-36	Alphanumeric	2 digits or letters	Mod 1271 Radix 36	java
ISO/IEC 7064, MOD 11,10	Numeric	1 digit	Hybrid
ISO/IEC 7064, MOD 27,26	Alphabetic	1 letter	Hybrid		Unlikely
ISO/IEC 7064, MOD 37,36	Alphanumeric	1 digit/letter	Hybrid
Luhn	Numeric	1 digit	Mod10
Verhoeff	Numeric	1 digit	Complex
Damm	Numeric	1 digit	Complex

Automation
Which system is in use should be possible to determine even without offficial documentation through reverse engineering given a sufficient number of real world account number examples. So, please contribute real world example BBANs for each of these countries.

I am working on developing a utility to automatically construct various inputs to various algorithms and test them for a given IBAN. This should help us to detect the correct implementation for new countries. The properties of a given country's input that can be automatically determined are:

• Number of output check digits/characters (0, 1 or 2)
• Check digits (0-9 only) or check characters? (ie. may include X or A-Z)
• The various potential inputs (bank/branch portion, account portion), with checksum places removed or zeroed

So far I have ported the Java implementation to PHP using code generation, gathered working implementations of the final three algorithms, and written a general testing utility.

Countries with apparent national checksum systems

Data here is combined from Wikipedia, SWIFT official registry sources, random code and hearsay. We are looking to get solid references wherever possible, and in other cases to validate by reverse engineering a sufficient number of BBANs.

Country	IBAN Format (x=checksum)	Digits	Algorithm	References	Done
Albania	ALkk bbbs sssx cccc cccc cccc cccc	1	Luhn(bank+branch)	Reversed	✔
Belgium	BEkk bbbc cccc ccxx	2	No-pad MOD97 bbbc cccc cc	hearsay, OCM	✔
Bosnia	BAkk bbbs sscc cccc ccxx	2	?	official
East Timor	TLkk bbbc cccc cccc cccc cxx	2	ISO7064-MOD97-10	official + 2nd	✔
Estonia	EEkk bbss cccc cccc cccx	1	?	official doesn't work. Alternate supplied below.
Faroe Islands	FOkk bbbb cccc cccc cx	1	?	Banks not responding to emails.
Finland	FIkk bbbb bbcc cccc cx	1	?	validate-only code, finnish-hearsay, finnish-other, OCM
France	FRkk bbbb bggg ggcc cccc cccc cxx	2	Two systems: RIB=MOD97 (EBCDIC+pad+concat) SIREN=sum/10=0	hearsay, OCM	✔
Hungary	HUkk bbbs sssk cccc cccc cccc cccx	1	?	?
Italy	ITkk xaaa aabb bbbc cccc cccc ccc	[A-Z]{1}	Custom	pdf pp82-84 OCM (not this) Details supplied below.	✔
Luxembourg	LUkk cccc cccc cccc xx	2	?	OCM
Macedonia	MKkk bbbc cccc cccc cxx	2	ISO7064-MOD97-10	Reversed	✔
Mauritania	MRkk bbbb bsss sscc cccc cccc cxx	2	?
Monaco	MCkk bbbb bsss sscc cccc cccc cxx	2	Same as France.	@gaetan-be	✔
Montenegro	MEkk bbbc cccc cccc cccc xx	2	ISO7064-MOD97-10	Reversed	✔
Netherlands	NLkk bbbb cccc cccc cc	0	MOD11(account)	Reversed. hearsay, OCM. Exception:INGB	✔
Norway	NOkk bbbb cccc ccx	1	Custom MOD11	OCM	✔
Poland	PLkk bbbs sssx cccc cccc cccc cccc	1	?	?
Portugal	PTkk bbbb ssss cccc cccc cccx x	2	ISO7064-MOD97-10	hearsay, OCM	✔
San Marino	SMkk xaaa aabb bbbc cccc cccc ccc	[A-Z]{1}	?
Serbia	RSkk bbbc cccc cccc cccc xx	2	ISO7064-MOD97-10	official, Wikipedia	✔
Slovenia	SIkk bbss sccc cccc cxx	2	ISO7064-MOD97-10	Reversed	✔
Spain	ESkk bbbb gggg xxcc cccc cccc	2	MOD11	OCM, Wikipedia	✔
Sweden	SEkk bbb c cccc cccc cccc ccx	1	?	hearsay

Other situations

Code	Country	Situation
AT	Austria	Many, many bank-specific checksum schemes. (hearsay)
DE	Germany	Many, many bank-specific checksum schemes. (source)
CH	Switzerland	Some evidence of bank-specific legacy checksum schemes. (hearsay)

[globalcitizen]

@dem3trio @gaetan-be I've cleaned up this issue and did a fair bit of work yesterday. Still looking for help with remnants.

[gaetan-be]

Monaco is the same system as France

Example IBAN: MC1112739000700011111000h79
RIB = 12739000700011111000h
Checksum = 79

Checked against
http://marlot.org/util/calcul-de-la-cle-rib.php

BTW, did you debug the BE BBAN issue you had? I saw there was 1 digit missing in the BBAN, hence your wrong checksum calculation.

[globalcitizen]

Thanks for the tip on Monaco, seems to work, released as v2.4.8.

[BE (IANA:.be, ISO3166-1 alpha-2:BE): Belgium]
Is a SEPA member? Yes.
Example IBAN: BE68 5390 0754 7034
 - country  BE
 - checksum 68
 - bban     539007547034
 - bank     539
 - branch
 - account  007547034
 - natcksum 34
    (National checksum manually validated.)
    (National checksum automatically validated.)
    (Correction of national checksum functionality validated.)

Looks fine to me, that's the BE output from utils/test.php

[globalcitizen]

I've emailed the Danish National Bank about the Faroe Islands system (and to confirm that Denmark had no such pre-IBAN nation-wide domestic checksum scheme) and hope they will respond this week.

We should probably email the others also.

[globalcitizen]

Their reply: "My recommendation to you will be to ask the Danish Bankers Association ('Finansraadet' in Danish) cf. this link http://www.finansraadet.dk/en/Pages/mainpage.aspx or alternatively one of the Faroese bank directly e.g. Eik Banki, www.eik.fo or Nordoya Sparikassi P/F, www.ns.fo."

I have emailed all of them, as well as this other one. A Finnish bank appears to have a branch there, but I figured they probably haven't been around as long as the others so weren't worth asking.

Also wrote to the Bank of Greenland to verify whether any historic national checksum scheme existed.

[globalcitizen]

The Netherlands (NL) bank INGB IBANs in the test set I gathered were all failing national checksums, yet are real world IBANs. It seems INGB has been leading the migration away from the previous national checksum scheme. In v2.4.15 a check has been added which returns '' (unimplemented/no known national checksum scheme) when input is determined to derive from the INGB bank. This marks our first bank-specific checksum feature.

[globalcitizen]

Bank of Slovenia is bank 01 in Slovenia (SI) and has a similar national checksum special case exception. Released in v2.4.17.