Do you still need a BIC?

Inside SEPA, most euro transfers no longer require one: the IBAN alone is enough. You will still be asked for a BIC on many international transfers, older payment forms and some payroll or invoicing systems.

The same thing. BIC is the official name (Business Identifier Code, ISO 9362); SWIFT is the organisation that issues them, so the code is often called a SWIFT code.

Why can’t a BIC be calculated from an IBAN?

An IBAN contains a national bank identifier, not the BIC. The two are linked by directories that each country’s central bank or payments body maintains, which is what this tool looks up.

Privacy.

IBANtoBIC is built to need almost nothing from you. This page says exactly what happens to what you enter, what the site stores, and what it does not.

Last updated 19 August 2026.

The short version

No account. Nothing to sign up for, nothing to log in to.
IBANs are never stored. An IBAN you enter is validated and looked up in memory; it is not written to our database or our logs.
No analytics, no ads, no tracking cookies. Two technical cookies keep the site secure; that is all.
Your recent lookups and “My bank account” stay in your browser. They are never sent to us.
What we do keep: anonymous counts of bank identifiers we could not resolve, and the problem reports you choose to send.

What happens to an IBAN you enter

The IBAN is sent to our server, checked (country, length, check digits), reduced to its national bank identifier, and that identifier is matched against our copy of the official bank directory. The result comes back and the IBAN is discarded. Our code never writes an IBAN to the database or to a log file, and batch lookups work the same way, line by line — a CSV you choose is read in your browser and only the IBANs in it are sent.

Result links (“Share”) contain the IBAN in the address, so share them only with people who may see that account number. They are marked so search engines do not index them. Opening one sends that address to our server like any page request; we do not store it.

What we store

Two things, neither of which identifies you or your account:

Unresolved bank identifiers. When a valid IBAN’s bank is not in the directory, we record the country and the bank identifier (for example the three-digit Belgian bank code) with a counter and the date — not the account number, not your IP address. It tells us which registries or banks we are missing.
Problem reports. If you report a wrong or missing BIC, we store the country, the bank identifier, the BIC the result showed, the reason you picked and your note. The form has no field for the IBAN by design. Please do not put personal details in the note.

Everything else in our database is the bank directory itself — public registry data.

Stored in your browser only

Two conveniences live in your browser’s local storage and nowhere else: the list of recent lookups (your last few valid results) and “My bank account” (one IBAN with its result, if you choose to save it). They are never sent to our server and are not part of any page we deliver. Use “Clear” and “Remove” on the homepage to delete them, or clear the site’s data in your browser.

Cookies

The site sets two cookies, both strictly necessary and neither used to track you:

ibantobic-session — an anonymous session identifier that protects the forms against cross-site request forgery. Expires after two hours of inactivity.
XSRF-TOKEN — the matching security token the browser sends back with each lookup. Same lifetime.

There are no analytics, advertising or third-party cookies, which is why there is no cookie banner.

Third parties and server logs

Our body font (Proxima Nova) is served from our own server. The heading font (Poppins) is loaded from Bunny Fonts, a privacy-focused font service: your browser requests the font files from them, and they state that they do not log or track those requests. No other third-party scripts, embeds or CDNs are used, and the bank directories are imported on our server — your browser never contacts the registries.

To limit abuse, requests to the lookup endpoints are counted per IP address for one minute in a short-lived cache; nothing is kept beyond that. Like any website, the servers that run IBANtoBIC keep standard access logs (IP address, requested address, browser, time) for security and troubleshooting; they are rotated after a short period and are not combined with anything else or used to identify visitors.

Your rights and contact

Under the GDPR you can ask what personal data we hold about you and have it corrected or deleted. In practice we hold none that can be tied to you — but if you have a question or a request, write to the operator named on the imprint. If you think we have not handled your data properly you may also complain to your national data protection authority.