Skip to content
IBANforge

Compliance Check

Pre-flight risk triage for a payment, in one call. Runs a full IBAN validation, then adds a compliance block: sanctions screening of the holding bank (OFAC, EU, UN), FATF country status, SEPA reachability (SCT / SDD / SCT Inst), Verification of Payee participation, and a 0–100 risk score your code or agent can branch on.

Endpoint

POST https://api.ibanforge.com/v1/iban/compliance

Cost: $0.02 per request (or free-tier quota / prepaid credits)

Request

Headers

HeaderValueRequired
Content-Typeapplication/jsonYes
AuthorizationBearer ifk_... (free API key)One of the two
X-PAYMENTx402 payment tokenOne of the two

Body

{
  "iban": "DE89 3704 0044 0532 0130 00"
}
FieldTypeDescription
ibanstringThe IBAN to check. Spaces and hyphens are stripped automatically. Case-insensitive.

Response

Success (200)

{
  "iban": "DE89370400440532013000",
  "valid": true,
  "country": { "code": "DE", "name": "Germany" },
  "check_digits": "89",
  "bban": { "bank_code": "37040044", "account_number": "0532013000" },
  "sepa": { "member": true, "schemes": ["SCT", "SDD", "SCT_INST"], "vop_required": true },
  "formatted": "DE89 3704 0044 0532 0130 00",
  "bic": { "code": "COBADEFFXXX", "bank_name": "Commerzbank", "city": "Köln" },
  "issuer": { "type": "bank", "name": "Commerzbank" },
  "risk_indicators": {
    "issuer_type": "bank",
    "country_risk": "standard",
    "test_bic": false,
    "sepa_reachable": true,
    "vop_coverage": true
  },
  "compliance": {
    "sanctions": {
      "country_sanctioned": false,
      "bank_sanctioned": false,
      "matched_lists": [],
      "fatf_status": "member"
    },
    "reachability": { "sepa_instant": false, "sct": false, "sdd": false, "screened": false },
    "vop": { "participant": false, "status": "not_found", "screened": false },
    "risk_score": 0,
    "risk_level": "low",
    "flags": ["sepa_register_unavailable", "vop_register_unavailable", "sanctions_list_unavailable_un"]
  },
  "meta": {
    "scope": "bank_bic_only",
    "disclaimer": "Informational triage only — NOT a regulated AML/CFT product. Sanctions screening is performed at the BANK (BIC8) level: it flags the holding institution, NOT the beneficiary / account-holder name. Most sanctions designations target persons and companies, which this does not screen. Use a regulated provider (Refinitiv, ComplyAdvantage, etc.) for name-level KYC/AML obligations.",
    "sanctions_as_of": "2026-07-05T04:29:13.136Z",
    "fatf_as_of": "2026-02"
  },
  "cost_usdc": 0.02,
  "processing_ms": 25.66
}

This example shows the answer when the EPC registers and the United Nations list were not consulted for the call: screened: false on reachability and vop, and one *_unavailable flag per source left out, so a false there proves nothing. When they were consulted, screened is true and the values are the bank's own.

The compliance block

FieldDescription
sanctions.country_sanctionedThe IBAN country appears on a comprehensive sanctions program (e.g. RU, BY, IR).
sanctions.bank_sanctionedThe holding bank (BIC8) is designated on a screened sanctions list (OFAC, EU, UN).
sanctions.matched_listsWhich lists matched, e.g. ["OFAC"]. Empty when clean.
sanctions.fatf_statusFATF standing of the country: member, grey_list, black_list, suspended (RU since 2023), or non_member.
reachabilityWhether the bank is reachable via SEPA SCT, SDD and SCT Inst (EPC registers).
vopVerification of Payee participation and status — required in the euro area since October 2025.
risk_score0–100 aggregate. Higher = riskier.
risk_levellow (0–19), medium (20–39), elevated (40–59), high (60–79), critical (80–100) — or unassessable when the screen itself could not run.
flagsMachine-readable reasons behind the score, e.g. ["sanctioned_country", "fatf_black_list"] — every flag name matches the score line it explains (sanctioned_bank, test_bic, bank_code_not_allocated, no_vop, …).

A sanctioned-country IBAN (e.g. Russia) returns risk_level: "high" with a score of 60+ and explicit flags — try it in the playground.

Scope — read this before relying on it

The meta.scope field says bank_bic_only, and it means it: screening is performed at the bank level (BIC8), not the account-holder level. It flags payments routed through designated institutions or sanctioned countries. It does not screen beneficiary names, and it is not a regulated AML/CFT product — for name-level KYC/AML obligations, use a regulated provider. The full disclaimer ships in every response, so downstream agents can't miss it.

Russian IBANs are the one exception to the exact BIC8 match. The bank is named from the Bank of Russia BIC directory, and the default SWIFT BIC of every line of the same licence (head office and branches) is compared with the lists on its first six characters, because the lists often carry another BIC of the same bank. A Russian bank without any SWIFT BIC is not screened (bank_screened: false, institution_listed: null), and a bank that a list designates without a BIC, or under a BIC with another prefix, cannot be matched.

Data freshness

SourceRefresh
Sanctions lists (OFAC, EU, UN)Weekly — see meta.sanctions_as_of in every response
FATF listsPer FATF plenary — see meta.fatf_as_of
SEPA reachability (EPC SCT / SDD / SCT Inst)Monthly

Use cases

  • Pre-flight payment triage — block critical, escalate high, review elevated and medium, pass low. Treat unassessable as unscreened, never as clean.
  • Agent guardrails — an MCP agent checks compliance before initiating any transfer (check_compliance tool).
  • Onboarding screening — flag supplier or customer IBANs held at designated banks before first payout.

Next steps