Saudi IBAN Validator

The Anatomy of a Saudi IBAN

Every Saudi IBAN is exactly 24 characters, and each segment has a job. It opens with SA, the country code. The next two digits are the check digits, computed from the rest of the IBAN so that a single typo almost always breaks the checksum. Then comes the 2-digit bank code, which identifies the bank: 80 is Al Rajhi, 10 is Saudi National Bank, 20 is Riyad Bank, and so on through the major banks. The final 18 characters are the account number itself. The whole string is normally printed in groups of four (SA00 8000 0000 0000 0000 0000) purely so it is easier to read; the validator strips the spaces before checking.

The MOD-97 check from ISO 13616 is the clever part. It takes the IBAN, moves the first four characters to the end, converts every letter to a number (A = 10, B = 11, through Z = 35), and divides the resulting long digit string by 97. A genuine IBAN leaves a remainder of exactly 1. Because of how the check digits are chosen, swapping two adjacent digits, dropping a character, or mistyping one letter will almost always fail the check. That makes it a strong typo detector, and a weak identity detector: it confirms the string is well-formed, never that the account exists or that the bank code matches who the sender claims to be.