Finnish bank code check: monetary institution codes

Finnish bank codes come from the Finance Finland list of monetary institution codes, and they behave unlike the national registers we read in Germany, Austria or Belgium in three ways.

First, the code is not a fixed slice of the IBAN: Finnish institution codes run one to four characters at the head of the BBAN, so the check reads the longest allocated prefix rather than a positional cut. A fixed three-digit slice would ask about a code nobody was given, and deny a group whose code is shorter.

Second, Finnish codes are allocated to banking groups, not to individual institutions.

Third, and this is the one to design around, the list we hold is partial. It is a transcription of the Finance Finland publication dated 16 March 2026, and nothing refreshes it automatically. Since 16 September 2026 the API therefore treats it as a list that names holders without refusing anyone: a hit is served, a miss is not a denial.

The publisher has never confirmed the terms for reusing the list, so since 25 September 2026 the API reads it from a private file, not from its public repository. An answer served without that file says the list was not consulted (status: "unavailable"), never that a code is refused.

One call

curl -X POST https://api.ibanforge.com/v1/iban/validate \
  -H "Content-Type: application/json" \
  -d '{"iban": "FI2112345600000785"}'

The response is abridged below to the block this page is about. The list's own values (the code, the group and the month of the list) are left out here; the API serves them.

{
  "valid": true,
  "bank_code_check": {
    "value": "…",
    "status": "verified",
    "match": "register",
    "register": "Finance Finland monetary institution codes (allocated to banking groups, not individual institutions; transcribed list, a miss is not a denial)",
    "authoritative": false,
    "as_of": "…",
    "institution": { "name": "…", "street": null, "post_code": null, "town": null, "country": "FI" }
  }
}

This is Finland's official example IBAN. value is the allocated code the answer is about, which can be shorter than three digits, and institution.name is the banking group that holds it.

Read the register string, it is doing work

Look at what register says: "allocated to banking groups, not individual institutions; transcribed list, a miss is not a denial". Both clauses ship inside the response, because a Finnish answer claims less than a German or Austrian one, in both directions:

Register	A `verified` result means	A code the list does not hold means
DE, AT, BE, SK, CZ, BG, CH / LI	the code is allocated to this named institution	not allocated: `not_in_register`, `authoritative: true`
FI	the code is allocated to this banking group	nothing: the answer falls back to our composite map, `authoritative: false`

What a miss means here

A Finnish code the list does not carry is never refused. The answer falls through to what any country without a register gets: our composite bank-code map, authoritative: false, and at worst status: "not_in_register" with reason: "absent_from_reference_data", which says something about our data and nothing about the code. You will never see not_allocated for Finland. The IBAN's checksum keeps saying valid: true beside it either way.

The reason is the list itself: a transcription that nothing refreshes cannot tell a new or renamed institution from a code nobody holds, and a refusal read off an eleven-month-old list is not something a payment engine should stop on. Finland goes back to the registers that settle a negative once the list is re-read against a current publication.

The institution block for Finland

A hit carries an institution block with the name of the banking group the code belongs to, and no address: the list publishes none, and a group-level code has no single seat to describe. authoritative: false stays beside it, for the reason above.

Freshness

as_of is the month of the list itself, not our monthly refresh: nothing re-reads the Finance Finland publication automatically, and an answer you act on has to say how old its list is.

The honest limits

A hit confirms the group, not the branch or the institution. If your process needs to know exactly which member bank holds the account, a Finnish bank-code check is not the tool.
A miss proves nothing. The list is partial and dated; an absent code is not a refusal.
We check the bank code, never the account or its holder. Nothing in this answer looks past the code at the head of the BBAN.
Prefix length matters. The check uses the longest allocated prefix; a naive fixed-width slice of a Finnish BBAN will produce wrong lookups against any register, including this one.
No addresses. The list names groups and publishes no seat.