8000 [Validator] Structure of BIC changed with ISO 9362:2022 · Issue #51975 · symfony/symfony · GitHub
[go: up one dir, main page]
Skip to content

[Validator] Structure of BIC changed with ISO 9362:2022 #51975

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
luxemate opened this issue Oct 10, 2023 · 8 comments
Closed

[Validator] Structure of BIC changed with ISO 9362:2022 #51975

luxemate opened this issue Oct 10, 2023 · 8 comments
Labels
Bug Help wanted Issues and PRs which are looking for volunteers to complete them. Status: Reviewed Validator

Comments

@luxemate
Copy link
Contributor
luxemate commented Oct 10, 2023 •
edited
Loading

Symfony version(s) affected

all

Description

I have found some preview of the new standard, which can be interpreted as:

Party prefix is 4 upper-case alphanumeric characters (A to Z and 0 to 9 only)

We found out about the issue in production, because someone was tying to use an IBAN from UAE bank, which has BIC E097AEXXXXX.

How to reproduce

Use BIC E097AEXXXXX with the BicValidator.

Possible Solution

Use ctype_alnum for the first 4 characters.

Additional Context

Proof from iban.com

image

Element description from the updated standard

image

Conventions used in the format column

The following conventions are used in this document:

  1. character representations:
    • a: upper-case letters (alphabetical characters A to Z only);
    • n: digits (numeric characters 0 to 9 only);
    • c: upper-case alphanumeric characters (A to Z and 0 to 9 only).
  2. length indications:
    • nn!: fixed length;
    • nn: maximum length.
@luxemate luxemate added the Bug label Oct 10, 2023
@OskarStark
Copy link
Contributor

friendly ping @mvhirsch as you contributed the BicValidator IIRC

@mvhirsch
Copy link
Contributor
mvhirsch commented Oct 11, 2023 •
edited
Loading

The validator was implemented using the ISO 9362:2014 standard, because I implemented it back in 2015. I'm happy to see updates, but I do not have access to any official document for ISO 9362:2022. The ISO 9362:2014 described the first 4 characters to be alphabetical only, IIRC.

According to ISO Database (OBP):

the style of the BIC structure in Clauses 4 and 5 has been aligned with the style used in the ISO 17442 series;

I don't know the ISO 17442 either, making it hard for me giving any advice on this.

Sadly the BIC isn't officially registered by SWIFT (maybe a "non-connected" BIC?): https://www2.swift.com/bsl/?bicSearch_bic=E097AEXXXXX

No validator I tried on the internet is able to validate it. According to some research, it may seem to be the Al Maryah Community Bank, which itself states it's BIC is E097AEXX (using the 8 chars variant). This is BIC is also invalid as the above according to the BicValidator.

Without access to official documents I can not recommend anything from my side.

@luxemate
Copy link
Contributor Author
luxemate commented Oct 11, 2023 •
edited
Loading

@mvhirsch I've provided a link to a preview of ISO 9362:2022 in the first message. Not sure how legit is it, but looks like one. I've also found info on SWIFT website (https://www.swift.com/standards/data-standards/bic-business-identifier-code) that states:

The BIC is an 8 character code, defined as ‘business party identifier’, consisting of the business party prefix (4 alphanumeric), the country code as defined in ISO 3166-1 (2 alphabetic), and the business party suffix (2 alphanumeric).

The branch identifier is a 3 character optional element that can supplement the 8 character BIC, used to identify specific locations, departments, services or units of the same business party.

Is it official enough?

@mvhirsch
Copy link
Contributor

I just implemented your suggestion, it now fails on previously valid BICs within the test cases.

SWIFT refers to the ISO 9362. As I stated above: without access to that document, I'm not able to help you here.

Neither I can access a big trusted & validated BIC database after so many years. I'm really not able to help here (beside the fact I can manage a code review, if you provide a PR).

@derrabus
Copy link
Member

Apparently, the validator needs an update. I've added the "help wanted" label.

If someone needs this validator to be updated, please have have a look behind that 40 CHF paywall and send a PR.

@derrabus derrabus added Status: Reviewed Help wanted Issues and PRs which are looking for volunteers to complete them. and removed Status: Needs Review Status: Waiting feedback labels Oct 16, 2023
@Seb33300
Copy link
Contributor

If someone needs this validator to be updated, please have have a look behind that 40 CHF paywall and send a PR.

I think you forgot to provide the link?
https://www.iso.org/standard/84108.html

@maxbeckers
Copy link
Contributor

As far as I know it was not used for a long time, but it was already defined in ISO-9362-2014 that the first 4 characters of the BIC may also contain numbers.

@MatTheCat
Copy link
Contributor
MatTheCat commented Mar 8, 2024 •
edited
Loading

Okay don’t ask me how I found it but the change from alphabetic to alphanumeric four first characters comes from the second edition (from 1994).

ISO 9362:2022 says a valid BIC contains

  • 4 upper-case alphanumeric characters (party prefix)
  • 2 upper-case letters (country code)
  • 2 upper-case alphanumeric characters (party suffix)

These three parts form a business party identifier.

It can then be followed by 3 upper-case alphanumeric characters (branch identifier).

From https://www.swift.com/swift-resource/9586/download:

SWIFT, as RA, has no plan to issue BICs with
numeric characters in the first 4 characters.

If applications have implemented restrictions
on the allowed characters, it would be good
practice to remove this restriction at the
occasion of a software update to respect the
standard specification of 4 alpha-numeric
characters.

Maybe there can be other Registration Authorities outside of ISO ¯\_(ツ)_/¯

Implementation-wise, this means the ctype_alpha check on the four first characters can be removed (since the whole BIC is checked by ctype_alnum).

Removing a check means that BICs previously considered valid would still be. However, Bic::INVALID_BANK_CODE_ERROR would then become useless, and data sets expecting this code valid.

@MatTheCat MatTheCat mentioned this issue Mar 9, 2024
Merged
nicolas-grekas added a commit that referenced this issue Mar 12, 2024
@nicolas-grekas
bug #54219 [Validator] Allow BICs’ first four characters to be digits…
6b550a1 
… (MatTheCat)

This PR was merged into the 5.4 branch.

Discussion
----------

[Validator] Allow BICs’ first four characters to be digits

| Q             | A
| ------------- | ---
| Branch?       | 5.4
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Issues        | Fix #51975
| License       | MIT

While a lot of sources claim a BIC’s first four characters must be letters, this is not the case since ISO 9362:1994. The confusion may come from SWIFT (ISO 9362’s registration authority) saying that

> [We have] no plan to issue BICs with numeric characters in the first 4 characters.

[Source](https://www.swift.com/swift-resource/9586/download) (clicking this link will trigger a download)

However, the next paragraph says

> If applications have implemented restrictions on the allowed characters, it would be good practice to remove this restriction at the occasion of a software update to respect the standard specification of 4 alpha-numeric characters.

As `@luxemate` stumbled on such a valid BIC (see linked issue), this PR removes the `Bic::INVALID_BANK_CODE_ERROR` check. This constant won’t be referenced anymore so it may be deprecated and removed later.

Commits
-------

0d824a7 [Validator] Allow BICs’ first four characters to be digits
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Bug Help wanted Issues and PRs which are looking for volunteers to complete them. Status: Reviewed Validator
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
9 participants
@nicolas-grekas @mvhirsch @Seb33300 @OskarStark @luxemate @derrabus @MatTheCat @maxbeckers @carsonbot
0