Picture a US importer paying a first invoice of $18,500 to a supplier in Germany (illustrative). The invoice gives the supplier's IBAN, which starts with DE, and its bank's 11 character BIC, whose fifth and sixth characters also read DE. Both point to Germany. The importer's bank puts that BIC in the payment message, and AML transaction monitoring reads the same field when it checks where a cross border payment goes.
Who issues a SWIFT/BIC code, and what does it identify?
BIC is the international standard ISO 9362, and "Swift in its role of ISO registration authority issues BICs". Some sites still expand BIC as bank identifier code. swift.com gives the meaning as Business Identifier Code, and BICs go to financial and non financial institutions alike; SWIFT code is the everyday name for the same code.
Connected BICs can exchange messages on the SWIFT network. Non connected BICs have no access and are used for reference only. Each BIC has a data record with the holder's legal name, registered address and status, which the owner must confirm at least once a year.
What do SWIFT codes look like?
Table 1. The parts of a SWIFT/BIC code under ISO 9362.
| Part | Characters | Rule | What it tells you |
|---|---|---|---|
| Business party prefix | 1 to 4 | 4 letters or digits | The institution |
| Country code | 5 and 6 | 2 letters from ISO 3166-1 | The country |
| Business party suffix | 7 and 8 | 2 letters or digits | Completes the 8 character code for the institution |
| Branch identifier (optional) | 9 to 11 | 3 characters | A location, department, service or unit of the same institution |
The first 8 characters name the institution, so one bank can appear with 8 or 11. Older guides call the parts bank code, country code, location code and branch code; swift.com now says prefix, country code, suffix and branch identifier.
Example of a SWIFT code, read character by character
Here is the opening's code written as a layout, so that no real bank's code is printed: PPPP DE SS BBB (illustrative). PPPP, characters 1 to 4, is the bank's business party prefix. DE, characters 5 and 6, is Germany, the same letters that open a German IBAN. SS is the suffix, and 4 + 2 + 2 makes the 8 character code for the institution. BBB adds the branch: 8 + 3 = 11.
How do SWIFT codes operate in a payment?
Back to the invoice. The importer's bank may hold no account with the German bank, so the payment can pass through a correspondent bank that holds accounts for both. The messages name each bank by its BIC, which swift.com says is used "for addressing messages, routing business transactions and identifying business parties".
ISO 20022 changes what sits beside the code. From November 2026, cross border (CBPR+) payment messages were to carry town and country for every agent and party. swift.com added that "for agents, use of the BIC only continues to be a valid option rather than providing name and address" (25 March 2026). On 27 August 2026 SWIFT deferred the payments changes of that release and promised an update on the structured address timing by December (SWIFT).
How do you find your bank's SWIFT or BIC code?
- Your statement or online banking, where banks may show it.
- The bank's website, on its international payments page.
- SWIFT's BIC Directory, published by the issuer.
- A checker, to find or verify a bank's SWIFT/BIC code and see the institution and branch behind it.
SWIFT code, BIC or IBAN: which one does a payment need?
Table 2. BIC and IBAN compared.
| Code | Identifies | Length | Registered by | Needed when |
|---|---|---|---|---|
| BIC (SWIFT code) | An institution | 8 or 11 characters | SWIFT, as ISO 9362 registration authority | Naming the banks in an international payment |
| IBAN | One account at one institution in one country | Up to 34 characters (Germany: 22) | National formats under ISO 13616, registered by SWIFT at the request of a national standards body or central bank | Paying an account in a country that uses IBAN, including every SEPA payment |
Inside SEPA the IBAN is enough. Regulation (EU) No 260/2012 defines the BIC as a code that "unambiguously identifies a PSP", a payment service provider (Article 2(16)). After 1 February 2016 for cross border payments, and 1 February 2014 for national ones, providers "shall not require PSUs to indicate the BIC", PSUs being their customers (Article 5(7)). Recital 8 gives the reason: in the vast majority of EU payments the IBAN alone identifies the account. The rule is for euro payments. It covers credit transfers and direct debits within the EU.
What role do SWIFT/BIC codes play in international transactions and sanctions screening?
Four payment data rules bear on the parties and banks named in a cross border message:
- FATF's revised Recommendation 16 (18 June 2025), also called the travel rule for virtual assets, asks for new technology against fraud and error, for example "verification of recipients' banking information", by the end of 2030 (FATF).
- In the EU, Regulation (EU) 2023/1113 sets payer and payee data (Article 4) and has the payee's provider check those fields for admissible characters (Article 7(1)).
- In the UK, Article 4 of Regulation (EU) 2015/847 sets the payer and payee data.
- In the US, 31 CFR 1010.410(f) has transmittals of $3,000 or more carry "the identity of the recipient's financial institution".
Minhac Celik, author of this entry, on screening: "A screening rule that reads names only misses the banks in the chain, because an ISO 20022 payment can still name a bank by its BIC alone, with no name or address, so the code has to be resolved to an institution and a country before the payment is screened."
complead, formerly Sanction Scanner, screens payments in payment screening, where the API checks both the sender and the receiver while the payment is in process.
What are the security warning signs around a SWIFT/BIC code?
Read the code against its payment. Enhancing security around a SWIFT/BIC code starts there, and no sign below proves fraud alone:
- New bank details by email. A known supplier's new bank and code is the email compromise move behind invoice redirection and CEO fraud; call back on a number on file.
- A country that does not fit. Characters 5 and 6 name a different country from the IBAN's first two letters or the customer's own country.
- No record behind the code. It breaks the ISO 9362 layout or returns no registered institution.
- A new beneficiary bank on a first large payment. The pattern of a customer talked into paying a scammer's account (APP fraud).
Before the first payment to a new beneficiary:
- Check the code against the bank named on the invoice.
- Compare characters 5 and 6 of the BIC with the first two letters of the IBAN.
- If the payment then stalls, ask the sending bank for the UETR and its last GPI tracker status.
Related terms
- GPI tracker. SWIFT's service that follows a payment by its UETR.
- Correspondent banking. A bank holding accounts for other banks and paying for them.
- Travel rule. FATF Recommendation 16 as it applies to virtual asset transfers.
- Wire fraud. Fraud that uses a wire, radio or television transmission.
- CEO fraud. A fraudster poses as an executive to order a payment.
- APP fraud. A person tricked into paying a criminal.
