code402.dev / for payment platforms
Validate bank details before you send money
If your platform moves money for other people, a mistyped or impossible bank detail is not a cosmetic bug â it is a failed payout, a reversal, a support ticket, or a fraud loss. The checks below are deterministic: the same input always produces the same verdict, and every response explains why. No model, no guessing, no scraping.
What we check
| Check | Method | Catches |
|---|---|---|
| IBAN | ISO 13616 + ISO 7064 MOD-97-10 | transposed or mistyped digits, impossible country/length combinations |
| SWIFT/BIC | ISO 9362 structure | malformed bank, country or branch codes |
| ABA routing | Fedwire/ACH (3,7,1) mod-10 checksum | routing numbers that cannot be valid |
| LEI | ISO 17442 + MOD-97-10 check digits | bad entity identifiers on counterparty records |
| VAT | MOD-97 family | malformed tax identifiers on invoices |
| Sanctions (address/jurisdiction) | OFAC SDN digital-currency address list + sanctioned jurisdictions | known-listed payout addresses and restricted jurisdictions |
What this is not. These are structural checks. They do not prove an
account exists, is open, or belongs to the name on the invoice. We do not do name-based or fuzzy
sanctions screening, and our sanctions screen is address- and jurisdiction-level only â a no-match
result is not a sanctions clearance. Every response states its own scope and whether the check
was checksum-verifiable or format-only. Treat this as one cheap gate before your own controls, never
as a replacement for them.
Why a per-call check rather than a platform contract
- Deterministic and offline-computable. No external lookup in your payout path.
- Explainable. A verdict carries its reason and its scope, so support and compliance can read it.
- Audit trail. Every call returns a signed XDR-1 receipt that verifies offline against a published signer â evidence you can hand to an auditor.
- Batch it.
batch-validateruns up to 50 identifiers in one paid call with one receipt, so a nightly payout file is one charge, not fifty.
Integrate in an afternoon
REST, MCP, or the SDKs. The first calls each day are free, so you can run this against your worst historical samples before committing to anything.
curl -X POST https://hcrb.in/v1/tools/iban-check/call \
-H 'content-type: application/json' \
-d '{"input":{"iban":"GB29NWBK60161331926819"}}'