Bank Account / IBAN: Data Point Intelligence Guide

Money leaves a trail in fixed-width fields. An IBAN names the country, the institution and often the branch before you ever see a customer name.

Understanding the Bank Account / IBAN as an intelligence artifact

A bank account identifier is a structured string that routes value. An IBAN under ISO 13616 opens with a two-letter country code and two check digits validated by a MOD-97 calculation, followed by a country-specific basic account number containing a national bank code, frequently a branch code, and the account number itself. A BIC under ISO 9362 identifies the institution: four characters for the bank, two for the country, two for the location and an optional three for the branch. US flows instead use a nine-digit routing number with its own checksum.

Internal layout and total length vary by country, from fifteen to thirty-four characters, so parsing demands per-country templates rather than a single pattern. Virtual IBANs issued by payment institutions resolve to a pooled account at a sponsor bank, breaking the assumption that one identifier equals one customer at one branch. BIC8 identifies an institution while BIC11 identifies a branch, and correspondent chains mean the visible account is rarely the ultimate destination.

Why it matters

The identifier alone, before any legal process, tells you the country of the account, the institution and often the branch and therefore a city. That places a counterparty under a named supervisor with a known risk profile and a defined legal-assistance channel. Repeated identifiers across invoices, fraud reports and leaked documents cluster otherwise unconnected cases. Institution choice is itself intelligence: a shift toward small correspondent-dependent banks or specific payment institutions is a behavioural signal.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Country and institution derive directly from the string, placing a counterparty under a named supervisor and legal-assistance regime.
• Branch codes narrow an account to a city or district, giving a physical pivot and a relationship-manager location.
• Checksum validation separates genuine identifiers from typos and fabricated numbers on fraudulent invoices instantly.
• Virtual IBAN ranges expose the payment institution operating behind an apparently mainstream bank identifier.
• The same account details recurring across unrelated victim reports link separate cases into one fraud cluster.
• Currency and account-type conventions in some national formats indicate the account's intended commercial use.
• Rapid changes of banking partner across a transaction series suggest de-risking or account closures upstream.
• Correspondent BICs in payment messages expose the intermediary chain and every jurisdiction the value actually crossed.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• SWIFT IBAN Registry (ISO 13616) — Authoritative per-country IBAN structure, length and worked examples needed to parse the national portion.
• ISO 9362 BIC directory — Institution and branch identification behind a BIC, including country and location codes.
• Federal Reserve E-Payments Routing Directory — Free lookup of US routing numbers to institution name, address and processing detail.
• Bundesbank Bankleitzahl file — German bank codes mapped to institution, BIC and branch, published and updated openly.
• EBA Credit Institutions Register — Authorised EU credit and payment institutions, useful for identifying virtual IBAN sponsors.
• FFIEC National Information Center — US bank ownership hierarchies linking an institution to its parent holding company.
• FinCEN advisories and FATF reports — Typologies and jurisdiction risk statements that put a payment corridor in context.
• National regulator registers — Licensing status and enforcement history for the institution holding the account.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Validate the format — Run MOD-97 on the IBAN or the routing checksum first, since invalid identifiers indicate fabrication or transcription error.
2. Decode the components — Split country, bank and branch codes using that country's registry template, then resolve the institution by name.
3. Classify the institution — Distinguish a licensed bank from a payment or e-money institution issuing virtual IBANs on a sponsor bank's rails.
4. Cluster your own holdings — Search existing case data, invoices and reports for the identical account, adjacent sequences or the same sponsor range.
5. Test the named party — Compare the stated beneficiary against company registry records; a mismatch between name and account country is a standing flag.
6. Escalate lawfully — Route any request for transaction records or holder identity through SAR, subpoena or mutual legal assistance channels.
7. Document and restrict — Store the identifier under access control with its source document reference and the date it was first observed.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Collected by these disciplines

• Financial Intelligence — Following Value Through the Financial System
• Accounting Intelligence — Financial Statements and Accounting Analysis
• Corporate Intelligence — Understanding Companies, Structure, and Control
• Legal Intelligence — Law, Litigation, and Regulatory Intelligence
• Cryptocurrency Intelligence — Tracing Value on Public Ledgers
• Sanctions Intelligence — Screening, Designations, and Evasion Detection

Investigated in these domains

• Financial Crime
• Anti-Money Laundering
• Corruption & Governance

Pivots to these data points

• Cryptocurrency Address — Blockchain wallet address for receiving or sending crypto assets.
• Transaction Hash — A blockchain transaction identifier for tracing fund flows.
• Stock Ticker / Security — An exchange-listed security symbol, pivoting to filings, ownership, and market data.
• Sanction / Watchlist Entry — An entry on a sanctions list, watchlist, or PEP database.

Inside the platform: where Bank Account / IBAN lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• datapoint.php?dp=dp_bank_account — Data point hub
• blockchain.php — Financial Crime dashboard
• sanctions.php — Anti-Money Laundering dashboard
• domain.php?d=corruption — Corruption & Governance dashboard
• search.php — Advanced search, filter and pivot
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Enrichment Runner
• Enrichment → Local
• Correlate Infrastructure
• Export STIX/MISP
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Validate the format is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Classify the institution turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Document and restrict feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Bank Account / IBAN

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Financial identifiers matter to defence in two places: contracting integrity and threat finance. Before funds move to a local vendor, contractor or partner unit, validating the account country, institution and beneficiary name against the contracting entity prevents diversion and prevents an audit finding that ends a programme. In threat finance cells the identifier links procurement to an institution under a named supervisor, which tells you which national channel could act. Constraints are strict: military analysts do not obtain account records directly, they task through the appropriate law enforcement or financial intelligence partner, and any product asserting that a specific account funds an adversary must survive legal review before it drives action.

🕵 National intelligence

For national intelligence a bank identifier is a high-value selector because it is stable, structured and repeated across procurement documents, invoices and correspondence. It supports network mapping against proliferation and sanctions requirements, and the institution behind it tells you the jurisdiction, the supervisor and the correspondent chain the value must cross. Fusion typically pairs open structural decoding, which is unclassified, with reporting that is not, so write products with the decoding separable from the sourcing. Dissemination to industry or partner regulators usually happens through the financial intelligence unit rather than directly. Retention should reflect that these identifiers are personal financial data even when they belong to a hostile network.

👮 Law enforcement

Investigators use the identifier as the anchor for tracing and for restraint. It is admissible as it appears on the seized or produced document, and the structural decoding is a matter of published standards that a court will accept readily. Everything beyond that requires process: account holder identity, statements, signatory records and beneficial ownership come by production order, subpoena or a request to the financial intelligence unit, and cross-border records generally require mutual legal assistance or a police-to-police channel where permitted. Suspicious activity reports are intelligence and usually cannot be used as evidence or disclosed. Chain of custody starts with the source document, preserved unaltered with the date it was obtained.

🔍 Private investigation and corporate security

In corporate investigations account identifiers appear on invoices, contracts and payment instructions, and their main lawful use is validation: does the account country and institution match the counterparty you believe you are paying, and is the beneficiary name consistent with the contracting entity. That single check defeats a large share of invoice redirection fraud. What a private actor may not do is probe an account with test transfers, pretext a bank, purchase account data from an information broker, or attempt to obtain a statement. Those are criminal offences in most jurisdictions. Where tracing is genuinely needed, the routes are civil disclosure orders through counsel or a criminal referral.

📰 Journalism and OSINT media

Publishing a bank identifier is almost always the wrong call. It enables fraud against the genuine holder, exposes the publisher to data-protection liability, and adds little that redaction would not preserve. The reportable facts are the institution, the jurisdiction and the flow, not the digits. Verification standards should be high: confirm the identifier is well formed, confirm the institution independently, and corroborate the payment with a second document or source before asserting it occurred. Protect the source who provided the document, since financial records are traceable to a small number of people. Offer the named parties a right of reply that describes the transaction without publishing the account.

🌍 NGO, humanitarian and human rights

For anti-corruption and asset-recovery work account identifiers in leaked or disclosed documents anchor the flow of stolen public funds and support submissions to authorities. Handle them as restricted from receipt: they are directly abusable and they identify individuals, including people incidental to the wrongdoing such as employees and family members. Do no harm means redacting before internal circulation, not only before publication. Where the material came from a whistleblower, protect them with the assumption that the institution can identify who accessed a record. Route findings to a financial intelligence unit or prosecutor rather than acting alone, and ensure staff handling this material have legal and security support.

🎓 University and research

Researchers studying payment corridors, correspondent banking retreat or financial crime typologies mostly work with aggregate and structural data rather than account-level records. Where account-level data appears, for example in leaked datasets or court exhibits, ethics review is essential and usually results in a requirement never to publish identifiers and to work on a hashed or truncated form. Reproducibility comes from publishing the parsing rules, the country templates and the code rather than the underlying data. Cite the standards bodies and central banks as sources for structure, document the vintage of the registry files used, and be explicit that a valid identifier is not evidence that an account existed.

Playbook: working Bank Account / IBAN end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Preserve the source document

Before touching the number, secure the artifact it came from: invoice, contract, payment instruction, message or statement. Hash it, record who provided it and when, and store it unaltered. The document is the evidence; the identifier is a field within it. A good output is a source record with provenance, custody and hash. Stop when you can demonstrate where the identifier came from without relying on anyone's memory.

Phase 2 — Validate the structure

Run the MOD-97 check on an IBAN, the checksum on a US routing number, and the format rules for the relevant national scheme. An invalid identifier means transcription error or fabrication, and both are analytically significant. Record the validation result rather than silently correcting a digit. A good output states valid, invalid or unknown scheme with the rule applied. Stop when you have a definite answer, including the answer that the country template is not one you hold.

Phase 3 — Decode the components

Split country code, national bank code, branch code and account number using that country's registry template. Resolve the bank code to a named institution and the branch code to a location where the scheme supports it. Record the registry file and its date. A good output is a decomposition table with each field labelled and the institution named. Stop when every character of the identifier is accounted for by the template.

Phase 4 — Classify the institution

Establish whether the resolved institution is a licensed bank, an electronic money or payment institution, or a sponsor bank behind virtual identifiers issued by a third party. Check the national regulator's register for authorisation status and any enforcement history. A good output names the institution, its licence type, its supervisor and whether the identifier is likely virtual. Stop when you know whether the visible bank is actually the customer's bank.

Phase 5 — Test the beneficiary name

Compare the stated beneficiary against company registry records and against the contracting party. Mismatches between the named payee, the contracting entity and the account jurisdiction are the standing indicator of redirection fraud and of intermediated payment. A good output is a three-way comparison with the discrepancy stated plainly. Stop when the beneficiary is either confirmed as the contracting party or clearly identified as someone else.

Phase 6 — Cluster your own holdings

Search existing cases, invoices, reports and datasets for the identical identifier, for adjacent serial ranges and for the same sponsor institution. Repeated identifiers across nominally unrelated reports are how separate victim complaints become one fraud cluster. A good output is a list of every internal record referencing the account, with dates. Stop when the search space is exhausted rather than when you find the first match.

Phase 7 — Map the corridor

Establish the likely correspondent chain and the jurisdictions the value would cross, using the institution's location and known correspondent relationships. This tells you which supervisors and which legal-assistance channels are relevant, and whether a clearing currency brings another regime into play. A good output is a corridor sketch naming jurisdictions and applicable authorities. Stop when you can name the realistic routes for a lawful request.

Phase 8 — Screen the parties

Run the institution, the beneficiary and any intermediary against sanctions and enforcement data, recording list versions. A designated institution or a bank in a jurisdiction subject to countermeasures changes both the risk and the available process. A good output is a dated screening record for every named party. Stop when the institution and every named person or company has been screened.

Phase 9 — Choose the lawful gateway

Decide, with counsel where necessary, which route can lawfully obtain what you still need: suspicious activity report, production order, subpoena, civil disclosure order, regulated information sharing or mutual legal assistance. Each has different evidential value and different timelines. A good output is a written plan naming the route, the authority and the material sought. Stop when the request is drafted, not when the need is identified.

Phase 10 — Restrict and minimise

Mask identifiers in circulated products, keep the full value in a restricted holding, log every access and set a retention period tied to the case. Account numbers about uninvolved parties should be deleted rather than retained for convenience. A good output is a product that supports the finding without exposing the digits. Stop when the working copy circulating internally is redacted.

Phase 11 — Refer and hand over

For private and NGO actors especially, the endpoint is usually a referral to law enforcement, the financial intelligence unit or the regulator, with the source document, the decoding and the analysis packaged coherently. Include the provenance record. A good output is a referral the recipient can act on without reconstructing your work. Stop when receipt is acknowledged and recorded. Keep a copy of exactly what you sent, because you may be asked to evidence the referral later.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
IBAN structure and validation references (ISO 13616)	Open	Published per-country IBAN templates giving total length, the position of national bank and branch codes, and worked validation examples.	Supplies the country template needed to split an identifier into bank, branch and account, and to run the MOD-97 check.
ISO 9362 business identifier codes	Licensed	The standard defining BIC structure, and the registration authority service resolving codes to institutions and branches.	Identifies the institution and branch behind a BIC and confirms whether a code is eight or eleven character form.
Federal Reserve E-Payments Routing Directory	Open	Free directory mapping United States routing numbers to institution name, address, telephone and processing arrangements.	Resolves a nine-digit routing number to a named US institution and its servicing arrangements without any legal process.
Deutsche Bundesbank bank code files	Open	German Bankleitzahl directory mapping national bank codes to institution, BIC, branch and payment participation.	Decodes the national portion of German IBANs and identifies which institution actually holds the account.
EBA credit institutions and payment institutions registers	Open	European registers of authorised credit institutions, payment institutions and electronic money institutions with passporting detail.	Distinguishes a licensed bank from a payment institution issuing virtual identifiers on a sponsor bank's infrastructure.
FFIEC National Information Center	Open	Structure and ownership hierarchies for United States banking organisations, linking institutions to holding companies.	Places the account-holding institution within its group and identifies the ultimate parent for risk assessment.
FinCEN advisories and guidance	Open	United States financial crime typologies, red flag advisories and regulatory guidance for reporting institutions.	Provides the recognised indicator sets against which an observed account pattern can be characterised credibly.
FATF mutual evaluations and jurisdiction statements	Open	Country-level assessments of anti-money-laundering effectiveness and lists of jurisdictions under increased monitoring.	Puts the account's jurisdiction in a supervisory risk context and informs how much weight to give local controls.
Egmont Group of Financial Intelligence Units	Open	The international network and secure channel through which financial intelligence units exchange information.	Identifies the counterpart financial intelligence unit and the realistic channel for a cross-border enquiry.
Bank for International Settlements payment statistics	Open	Committee on Payments and Market Infrastructures data and reports on national payment systems and correspondent banking.	Characterises the corridor: which systems clear the currency and how correspondent access has changed over time.
National regulator public registers	Open	Authorisation status, permissions, enforcement notices and change of control records for supervised institutions.	Confirms the institution is licensed for the activity implied and surfaces enforcement history relevant to the account.
Wolfsberg Group correspondent banking questionnaire	Open	Industry standard due diligence questionnaire completed by banks about their controls and correspondent relationships.	Sets the benchmark for what a bank should know about a respondent institution in the corridor you are examining.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Bank Account / IBAN. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• python-stdnum — Validates IBAN, BIC and many national account formats offline with country-specific rules; validation confirms structure only, never that the account exists.
• IBAN structure parsers with registry data — Split identifiers into country, bank, branch and account using registry templates; templates change, so an unpinned library will drift silently.
• Routing number lookup services — Resolve United States routing numbers to institution and address from published directories; they do not distinguish wire from ACH participation without care.
• OpenRefine — Normalises beneficiary names before comparison with registry records; clustering suggestions are heuristic and must be reviewed for corporate suffix collisions.
• Graph database for payment networks — Links accounts, entities and documents into a traversable network; edge weight and layout easily imply relationships the documents do not support.
• Redaction-capable document tooling — Applies irreversible masking of identifiers before circulation; overlay redaction in some formats can be reversed, so flatten and verify the output.
• Case management with access logging — Restricts and records access to identifier-level data for data-protection compliance; only effective if the restricted fields are not duplicated into working files.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
• Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
• Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
• Export STIX/MISP — Streams the selection in CTI standard formats for sharing with partners and ISACs.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• A valid checksum is the weakest possible positive. It tells you the string is well formed and nothing more. Fabricated invoices routinely carry structurally valid identifiers because generating one takes seconds.
• Virtual identifiers have quietly broken the classic inference chain. When the resolved institution is a sponsor bank serving a payment institution, branch and even bank inference is meaningless, and the customer relationship sits with a firm whose name never appears in the string.
• The beneficiary name mismatch is the single highest-yield check available without legal process, and many corridors still do not enforce name verification. Compare payee, contracting entity and account country as a routine, not as an escalation.
• Institution choice is behavioural evidence. A shift toward small correspondent-dependent banks, newly licensed payment institutions or a jurisdiction with weak supervision usually reflects upstream account closures rather than commercial preference.
• Never confirm an account by sending value to it, not even a token amount. It is an unlawful probe in many jurisdictions, it alerts the subject, and it contaminates the evidential record with your own transaction.
• Correspondent chains mean the visible account is rarely the endpoint. The jurisdictions the value crossed are frequently more important than the jurisdiction of the account, and they determine which authorities can actually help you.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Bank Account / IBAN is producing anything, and they are worth baselining before you change process or tooling.

• Proportion of inbound payment instructions where beneficiary name, contracting entity and account jurisdiction were reconciled before funds moved.
• Number of separate reports or cases linked into a single cluster through shared identifiers, sponsor ranges or institutions.
• Median time from identifying a need for account records to a lawful request being submitted through the correct gateway.
• Share of circulated products in which identifiers are masked, audited by sampling rather than by policy assertion.
• Detection rate for structurally invalid or fabricated identifiers on inbound documents, measured against later confirmed fraud outcomes.
• Proportion of referrals to law enforcement or the financial intelligence unit that were actionable without a request for further information.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• A valid checksum proves only that a string is well formed, not that the account exists or belongs to the stated party.
• Virtual IBANs make branch and even institution inference misleading, since the visible bank is a sponsor rather than the customer's bank.
• Beneficiary name and account holder frequently differ, and many payment corridors still do not enforce name matching.
• Publishing an account identifier enables fraud against the genuine holder and creates direct data-protection liability.
• Account country indicates where the account sits, not where the counterparty, the goods or the ultimate beneficiary are.
• Historic identifiers persist in documents long after closure, so an apparent match may be several years stale.

Legal and ethical considerations

Account identifiers are personal financial data in most regimes and are directly abusable, so treat them as restricted from the moment of collection. Transaction histories and holder identity require a lawful gateway: production order, subpoena, regulated information sharing or mutual legal assistance. Never attempt confirmatory transfers or account probing. Minimise retention, mask identifiers in circulated products, log every access, and preserve source documents unaltered so the chain of custody withstands challenge.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Bank Account / IBAN, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 6 intelligence disciplines, 3 mission domains, 4 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Can I find out who owns an account from the IBAN alone?

No, and any service claiming to do so is either guessing or trading in unlawfully obtained data. The identifier yields country, institution and often branch by published structure, and nothing about the holder. Holder identity sits with the institution and is protected by banking secrecy and data protection law everywhere. The lawful routes are a production order or subpoena in a criminal matter, a civil disclosure order through litigation, a regulated information-sharing arrangement between institutions, or mutual legal assistance across borders. Using a broker to shortcut that creates criminal exposure for you and destroys the evidential value of anything obtained.

The IBAN decodes to a large well-known bank but the payment feels wrong. What next?

Check whether it is a virtual identifier. Payment and electronic money institutions issue IBANs in ranges sponsored by a mainstream bank, so the visible institution is infrastructure rather than the customer's provider. Look up the bank code range against the sponsor's published documentation where available, check the national regulator's register for payment institutions passporting into that market, and note whether the beneficiary name matches a fintech rather than a bank. Practically, treat branch inference as void, expect a pooled account structure, and direct any lawful request at the payment institution as well as the sponsor.

We received an invoice with changed bank details from an existing supplier. What is the immediate analytic step?

Treat it as business email compromise until proven otherwise, and verify out of band using contact details you already hold, never the ones on the invoice. Then compare: does the new account country match the supplier's jurisdiction, does the beneficiary name match the contracting entity exactly, and is the institution a bank or a payment institution. A change from a domestic bank to a foreign payment institution with a slightly different payee name is the classic pattern. Preserve the email with full headers, preserve the invoice, and report to law enforcement quickly because recovery windows are measured in hours.

Should I publish account details in an investigation report?

Almost never. Publishing a live identifier enables fraud against the genuine holder, may breach data protection law, and can compromise a criminal investigation that has not yet acted. The reportable facts are the institution, the jurisdiction, the amounts and the flow, which carry the story without the digits. If the record is a court exhibit already in the public domain, that lowers but does not eliminate the risk. Where publication is genuinely necessary, mask all but the country and institution portion, and take a documented decision recording the public interest justification and the harm assessment.

How useful is the branch code in practice?

Useful for narrowing geography in some schemes and worthless in others. In countries where branch codes still map to physical offices, they place the relationship in a city or district, which supports a physical pivot and tells you which supervisor and which local process applies. But many banks have centralised account servicing, so the branch in the identifier may reflect where the account was opened years ago, or a processing centre rather than any real office. Some schemes carry no branch code at all. Always check the country template rather than assuming, and state the inference as approximate.

What is the difference between what a bank can share and what it can be ordered to produce?

Voluntary sharing is narrow and defined by statute: information-sharing arrangements between institutions for financial crime purposes, responses to regulator requests, and suspicious activity reports to the financial intelligence unit, which are intelligence rather than evidence and are usually protected from disclosure. Compelled production is broader: a court order or subpoena can obtain account opening documents, statements, signatory records, correspondence and internal risk files. The evidential quality also differs, since produced records come with a custodian attestation. Plan for the compelled route early, because the voluntary route rarely gives you anything usable in proceedings.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• ISO 13616 defines the international bank account number structure and the MOD-97 check digit calculation, with the registry specifying national templates.
• ISO 9362 defines the business identifier code identifying institution, country, location and branch.
• ISO 20022 defines the payment message schema in which account identifiers, parties and remittance information are exchanged.
• FATF Recommendation 16, the travel rule, requires originator and beneficiary information to accompany transfers, which determines what data exists to be obtained.
• The EU Funds Transfer Regulation implements travel rule requirements in European payments and defines the information payment service providers must carry.
• Wolfsberg Group principles set industry standards for correspondent banking due diligence and for handling respondent institution risk.
• The Egmont Group Principles for Information Exchange govern how financial intelligence units share information across borders.
• The UN Convention against Corruption chapter on asset recovery frames international cooperation for tracing and returning proceeds.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. ISO 13616 international bank account number standard — International Organization for Standardization. The standard defining IBAN structure, check digits and the national registry of templates.
2. E-Payments Routing Directory — Federal Reserve Financial Services. Public directory of United States routing numbers and institutions.
3. Credit institutions and payment institutions registers — European Banking Authority. Authorisation status for European banks, payment and electronic money institutions.
4. Advisories, guidance and reporting requirements — Financial Crimes Enforcement Network, US Department of the Treasury. Typologies and red flag guidance for financial institutions.
5. The FATF Recommendations — Financial Action Task Force. International standards covering wire transfer information and beneficial ownership.
6. Correspondent banking and payment system reports — Bank for International Settlements. Analysis of payment infrastructure and correspondent relationships by corridor.
7. Principles for information exchange between financial intelligence units — Egmont Group. The framework governing cross-border financial intelligence cooperation.
8. National Information Center structure data — Federal Financial Institutions Examination Council. Ownership hierarchies for United States banking organisations.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: validates and decodes account identifiers, then clusters cases sharing institutions, ranges or counterparties. Explore the platform, or browse the rest of the library by following any tag above.