How to issue French IBANs

A French IBAN carries two independent check digits, and a generator that computes only one of them produces account numbers that look valid everywhere except France. Issuing French IBANs is a short technical exercise wrapped in a long administrative one: the identifier itself is trivial arithmetic, but the code that sits inside it is allocated by someone else, and the moment the first IBAN goes live a specific set of French collections switches on. This piece covers the format, who allocates which component, the scheme and clearing layer, and the reporting catalogue that starts on day one.

1. The French IBAN format

The French IBAN follows the ISO 13616 pattern FR2!n5!n5!n11!c2!n — 27 characters, of which the last 23 are the national BBAN:

• Positions 1–2: country code, always FR
• Positions 3–4: two IBAN check digits, computed modulo 97 under ISO/IEC 7064
• Positions 5–9: the five-digit bank code — the CIB, code interbancaire
• Positions 10–14: the five-digit branch code, code guichet
• Positions 15–25: eleven alphanumeric characters of account number
• Positions 26–27: the two-digit clé RIB

The clé RIB is a separate, older check and it is the one foreign builds miss. It is computed over the three BBAN components with fixed weightings — 89 on the bank code, 15 on the branch code, 3 on the account number — modulo 97, with the key being 97 minus the remainder, producing a value between 01 and 97. Where the account number contains letters, they must first be substituted for digits under the defined conversion table before the arithmetic runs. Take that table from the French banking specification rather than from a code snippet: the substitution is the single most commonly mis-implemented part of the calculation, and it fails silently, because a wrong key still looks like two digits.

2. Who allocates which component

Only one of the three BBAN components is yours to choose, and the split is worth getting right before the build starts.

• The CIB is attributed by the ACPR and identifies the institution. It is the first five characters of every French RIB and the basis on which domestic interbank transfers are routed.
• The code guichet is allocated by the institution itself. The concatenation of CIB and guichet code is what identifies a specific branch — physical or virtual.
• The account number is entirely the firm’s, subject only to length and character-set rules.

Two French reference files matter alongside the code itself. The Fichier des Implantations Bancaires (FIB), maintained by the Banque de France, lists institutions authorised by the ACPR together with the branches they have declared in France and Monaco, and is what other French PSPs consult to confirm that a set of bank coordinates routes somewhere real. REGAFI is the ACPR’s own register of authorised financial firms, and it is more than a public lookup: the Banque de France states that the reference data it uses for its payment-means collections is the REGAFI position at 31 December of the preceding year. If the responsible officer recorded in REGAFI is stale on 31 December, the following year’s collection letters go to the wrong person.

3. The BIC connection

The CIB does not travel outside France. Cross-border messaging uses the BIC under ISO 9362, and every authorised French PSP has one; the first four letters form the BIC4 used in counterparty checks.

Sequence matters. Apply for the BIC alongside the ACPR licensing file rather than after grant — the application runs in parallel and takes weeks, and SEPA scheme adherence depends on it. Holding the BIC back moves go-live, not the licence.

4. The CFONB standards layer

The Comité Français d’Organisation et de Normalisation Bancaires (CFONB) maintains the French banking-payments standards that overlay the EU SEPA and ISO 20022 framework: the RIB document format used in customer-facing flows, the legacy CFONB fixed-width file formats still consumed by French corporate treasuries, national additions to ISO 20022 messages, and mandate handling for direct debits. A firm entering the French market needs the CFONB layer in addition to the European Payments Council rulebooks — the rulebooks tell you what a credit transfer is, and the CFONB specifications tell you what French counterparties will actually accept in a file.

5. Scheme adherence, and the ICS

Issuing IBANs nobody can pay into is pointless, so adherence to at least one European Payments Council scheme is the precondition:

• SCT — the baseline, required to receive incoming credit transfers
• SCT Inst — mandatory for euro-area PSPs under the Instant Payments Regulation from the defined dates
• SDD Core — optional, heavily used in France, with French-law overlays on mandates

Collecting by direct debit adds one French-specific step that is easy to discover late: the creditor needs an ICS, the identifiant créancier SEPA. The Banque de France maintains the national ICS reference. A firm that intends to collect its own fees by SDD needs an ICS of its own, not just scheme adherence.

6. Clearing access

French euro payments clear through the national retail system, interconnected with the wider EU instant and large-value rails. Access is technical and contractual:

• Direct participation requires a settlement account at the Banque de France and demonstrated operational readiness
• Indirect participation through a sponsor is the common route for smaller PSPs
• The PSD3 and PSR package, once in force, changes direct-access rules for non-bank PSPs materially

7. What switches on with the first IBAN

This is the part that is systematically under-scoped, because most of it is not supervisory reporting and therefore does not appear in the licensing project plan.

• FICOBA — immediately, and per account. Article 1649 A of the Code général des impôts obliges declaration of the opening, modification and closure of accounts of any kind; the arrêté of 14 June 1982, codified at Articles 164 FB to 164 FF of Annex IV to the CGI, is the operative instrument, and declarations are made in the FICOBA 3 XML format. It reaches firms operating with French residents under the freedom to provide services, not only French-established ones. It is event-driven, and the modification limb is where pipelines drift.
• RPC — monthly. The relevé de paiements clientèle covers cross-border transfers and direct debits made for customers, due by the 20th of the following month. Responsibility sits with whoever holds the resident client’s account, which is exactly what issuing French IBANs makes you.
• CRC — monthly, if you issue cards. The card counterpart of the RPC, feeding the travel-services line of the balance of payments.
• OSCAMPS collections. The Banque de France’s cartographie des moyens de paiement and fraud collections are now half-yearly; the cheque security-framework survey remains annual. Operational contacts are declared inside the collection itself.
• SURFI — the ACPR prudential and statistical returns.
• TRACFIN reporting through ERMES, and conduct and complaints reporting to the ACPR.
• CESOP, once the cross-border payee threshold is met.

All of the Banque de France collections above arrive through ONEGATE, and accreditation there is granted per collection and declarant pair — so “we have a ONEGATE account” is not the same as being able to file.

8. Three scenarios

Scenario 1 — the generator that passed every test. A firm builds IBAN generation against an open-source library, tests a thousand generated IBANs, and every one validates. First production file to a French corporate is rejected wholesale. Facts to rule: the library implements the ISO modulo-97 check only; the clé RIB is a separate computation over the BBAN components, and letters in the account number must be substituted before it runs. What the team does: implement the clé RIB explicitly, and build the test set from account numbers containing letters rather than from the numeric happy path.

Scenario 2 — the branch that scoped only ACPR reporting. A passported EMI opens a French branch, issues IBANs and plans SURFI. Facts to rule: FICOBA is a tax-code obligation triggered per account and reaching cross-border operations with French residents; the RPC is a Banque de France statistical obligation triggered by holding the resident client’s account. Neither sits in the ACPR return catalogue. What the compliance officer does: build the reporting inventory from the account lifecycle outward rather than from the supervisor inward — every account opened creates a FICOBA event, and every cross-border payment creates an RPC data point.

Scenario 3 — the guichet codes nobody planned. A firm allocates guichet codes sequentially as products launch, ending with a dozen codes and no rule linking them to anything. Facts to rule: the guichet code is allocated by the institution, and CIB plus guichet is what identifies a branch to the rest of the market and in the FIB. What the team does: fix a documented allocation scheme up front — by product line, by entity, or by segment — and declare it consistently, because the structure is visible externally and is the kind of thing an inspection asks about.

9. Internal IBAN-generator rules

• Validate at both levels: IBAN modulo 97, and clé RIB over the BBAN components
• Handle alphabetic account numbers explicitly — positions 15–25 are alphanumeric even if you allocate numerically
• Fix a deliberate guichet-code allocation scheme and document it
• Avoid allocating IBANs that resemble well-known public-sector accounts, to prevent misdirected payments
• Keep the CIB, the BIC and the FIB entry consistent — a mismatch between them is a routing failure, not a cosmetic one

10. Passporting in vs. domestic licence

An EMI or payment institution authorised in another member state can issue French IBANs after establishing a French branch or, in defined cases, on a freedom-of-services basis with IBAN-issuance permission — see our branch versus freedom of services piece. The obligations above do not track the establishment route neatly: FICOBA follows the customer’s French residence, and the RPC follows whoever holds the account. Choosing the lighter passporting route reduces the supervisory footprint, not the French data-reporting one.

11. What to do, today

• Confirm your route: direct ACPR authorisation, branch passport-in, or freedom of services with IBAN-issuance permission.
• Implement and test the clé RIB separately from the IBAN check, using account numbers that contain letters.
• Apply for the BIC alongside the ACPR file, not after grant.
• Fix a documented guichet-code allocation scheme before the first account is opened.
• Obtain an ICS if you intend to collect by direct debit.
• Build the FICOBA feed around three events — open, modify, close — not around account creation alone.
• Scope the Banque de France statistical collections (RPC, CRC, OSCAMPS) alongside the ACPR returns, and request ONEGATE accreditation per collection and declarant pair.
• Check that the responsible-officer data in REGAFI is correct before 31 December, since that is the position the Bank’s collections work from.

Related: RPC, CRT and CRC — French balance-of-payments returns · FICOBA · How to launch Dutch IBANs · How to issue Spanish IBANs · EMI licence in France · FCC and FNCI — the French cheque registers · FICP — the French credit-incident register