Complete Guide to Sheba (Iranian IBAN): Structure, Validation, and Lookup

Sheba (Iranian bank account number) is Iran’s version of the global IBAN standard. Its goal is simple: one unique identifier for every bank account across the country, instead of account numbers each bank issued in its own format and that meant nothing outside that bank.

For an exchange business, Sheba is not just a form field. A mistake in it means the transfer comes back (optimistic case) or goes to the wrong account (pessimistic case). This guide is what your team needs to know.

Sheba structure

An Iranian Sheba has 26 characters: the two letters IR followed by 24 digits. Not one more, not one less.

• Country code: always IR.
• Check digits: two digits mathematically derived from the rest of the number. They do one job: catch typing errors. If you mistype one digit, these two digits no longer match.
• Bank code: three digits that identify the bank.
• Account identifier: 19 digits assigned by the bank itself. If the account number is shorter, it is padded with leading zeros — and those zeros are part of the Sheba, not decoration.

Practical point: the bank code tells you whether the transfer is internal (same bank, instant, no fee) or interbank (Paya/Satna, with different timing and fees). That one distinction is the difference between “it arrived now” and “it arrives tomorrow.”

Examples of commonly used bank codes

This list is not complete and it also changes — bank mergers retire codes. Get the reference list from the Central Bank, and if it is hardcoded in your software, update it once a year.

Validation: check it yourself before any API call

Sheba check digits are generated with the standard MOD-97-10 algorithm (from ISO 7064). The nice part is that you need no service and no internet connection to verify it — you can even do it on paper:

1. Take the first four characters (IR + the two check digits) and move them to the end of the number.
2. Convert letters to numbers: A=10, B=11, … I=18, … R=27, … Z=35. So IR becomes 1827.
3. You now have a very large number. Calculate its remainder when divided by 97.
4. If the remainder is exactly 1, the Sheba is structurally valid. Anything else means it is wrong.

Because the number is larger than normal integer capacity, in practice you process it digit by digit:

function shebaValid(string $sheba): bool
{
    $s = strtoupper(preg_replace('/[\s-]/', '', $sheba));
    if (! preg_match('/^IR[0-9]{24}$/', $s)) {
        return false;                       // invalid length or format
    }

    $re  = substr($s, 4).substr($s, 0, 4);  // first four characters to the end
    $num = '';
    foreach (str_split($re) as $ch) {
        $num .= ctype_alpha($ch) ? (string) (ord($ch) - 55) : $ch;
    }

    $rem = 0;                               // mod 97 digit by digit
    foreach (str_split($num) as $d) {
        $rem = ($rem * 10 + (int) $d) % 97;
    }

    return $rem === 1;
}

These ten lines of code catch most typing errors before you pay anything. If you use a paid lookup service, always run this check first; sending a malformed Sheba to the service means paying to hear “it is invalid.”

But pay attention: valid means “this number can be a Sheba” — not “this account exists.” You can generate a perfectly valid Sheba that is not connected to any account. To know whether the account exists and who owns it, there is no way around a lookup.

What does a Sheba lookup tell you?

A lookup usually returns three things:

• Account holder name — the most important part.
• Bank name — confirmation of the bank code.
• Ability to receive funds — some accounts (blocked, dormant, or special account types) do not accept deposits. Knowing this before sending means one fewer returned transfer.

For an exchange business, the account holder name is not just convenience; it is a real control:

1. Matching the name to the customer. If the customer is “Reza Ahmadi” and the Sheba belongs to someone else, you need a question. Sometimes the answer is simple and valid (spouse’s account, company account). Sometimes not.
2. Silent errors. A Sheba whose structure is correct but belongs to another person throws no error. The money goes out, and getting it back is no longer a technical issue — it is a legal one.
3. Compliance trail. Recording that “at the time this transfer was entered, the Sheba belonged to this person” is part of your KYC file. Three months later, when someone asks why this transfer was made, you have an answer.

Five mistakes that return the most transfers

• Missing leading zeros. If those 19 digits start with zero and the Sheba was typed into Excel, Excel “cleans up” the zeros and breaks the Sheba. Always store Sheba as text, not a number. (Excel does the same thing here, silently.)
• Persian and Arabic digits. The customer copies from a phone and ۱۲۳ comes in, not 123. To the eye they are the same; to the banking system they are completely different. Always normalize inputs to Latin digits.
• Missing or duplicated IR. Some systems add IR themselves, and the customer has also entered it: IRIR…. Normalize the input; do not reject it.
• Spaces, hyphens, and invisible characters. Copying from WhatsApp often brings direction marks (RTL/LTR) too. They are not visible, but they break the string. Remove everything except 0-9 and IR.
• I instead of 1 and O instead of 0. This happens when the Sheba is read from paper or an image. MOD-97 validation catches it — provided you run it.

General rule: normalize the input, then validate it, then run the lookup. In that order. Most “Sheba errors” are actually normalization errors, not customer errors.

Can an account number be converted to Sheba?

Partly. Each bank has its own rule for generating the 19 digits from the account number, and these rules are not official or stable. Online converters usually work based on reverse engineering and give wrong results for some account types.

Practical recommendation: get the Sheba from the customer directly (it is available in banking apps and card-to-card tools), then run a lookup. Generating a Sheba by formula and sending money based on it is a risk that is not worth taking.

This should not be manual

Sheba lookup is something that should happen quietly and in the right place, not by having the operator open another tab and copy-paste.

In Nexto, when you leave the Sheba field in the bank transfer form, local validation runs immediately, and if it is valid, the lookup is sent and the account holder name and bank are filled in automatically — with a green or red hint. The operator does nothing except look. And because the result is cached, looking up the same Sheba again by the same exchange business has no cost.

Practical result: a control that runs automatically always runs. A manual control is skipped exactly on the busiest day — the day it matters most.

Summary

Sheba has three layers, and all three are necessary: normalization (extra characters and non-Latin digits), validation (MOD-97, free and offline), and lookup (existence and account holder, the only way to know where the money is going).

You can add the first two to your system today at no cost. The third has a small cost, and in return it reduces returned transfers, expensive mistakes, and unanswered compliance questions.