Should I store the BIC or re-resolve every time?

Store it with a timestamp. Re-resolve when the record is older than your risk tolerance (quarterly works for most), and always before high-value or first-time payouts.

Full IBANs are sensitive — what does the API retain?

iban2bic encrypts full IBANs with AES-256-GCM at rest and keeps them out of logs and analytics; only the bank identifier is retained for caching. Treat IBANs as personal data on your side too.

None needed — one authenticated POST endpoint returning JSON. Any HTTP client (fetch, axios, httpx, HttpClient…) integrates in a few lines; the docs show cURL and Node examples.

Guide · 7 min read

Integrating an IBAN-to-BIC API: patterns for payment developers

Last updated 17 July 2026

Most teams meet the IBAN-to-BIC problem the same way: a payout feature, an ERP import, or a marketplace onboarding flow suddenly needs the bank behind an account number. This guide covers the integration patterns that hold up in production.

Validate locally, resolve remotely

Checksum validation is free and instant, so run it client-side and server-side before calling any external service. Only structurally valid IBANs deserve a network call. iban2bic enforces this server-side too — invalid input returns HTTP 400 and is never billed — but catching it in your own form gives users immediate feedback.

Resolve at the right moment

Onboarding: resolve when the user first enters their IBAN. You get the bank name to echo back (“ING Bank — is that right?”), plus scheme flags to gate which payment methods you offer.
Payment time: re-resolve for stale records before high-value payouts — bank mergers retire BICs, and a mapping cached a year ago may be wrong.
Batch imports: deduplicate by bank code before resolving. A thousand employees at three banks need three lookups, not a thousand.

Handle the four outcomes

Outcome	HTTP status	Billed?	Your move
Resolved	200	Yes (1 credit)	Store BIC + bank details, branch on SEPA flags
Invalid IBAN	400	No	Reject input, show validation error
Not found	404	No	Bank code unknown — flag for manual review
Upstream error	5xx	No	Retry with backoff; failover already happened server-side

Cost model and caching

At €0.009 per successful conversion with free failures, the economics reward exactly the behaviour you want anyway: validate early, deduplicate by bank, and let repeat lookups hit the server-side cache (sub-100 ms on repeat resolutions).

A single credit wallet spans all your projects, so staging and production draw from the same balance without separate contracts.