IBAN validation trips people up because it looks like it should be a length check plus a regex, and it's neither. Here's the actual structure, in the order you should check it.
1. Length and country format. Every IBAN starts with a 2-letter ISO country code and 2 check digits, followed by a country-specific BBAN whose length is fixed per country — Germany is always 22 characters, the Netherlands 18, Malta 31. A string can be the right shape (letters-then-digits) and still be the wrong length for the country it claims to be from.
2. The mod-97 checksum (ISO 7064). This is the part people get wrong or skip:
function isValidIBAN(iban) {
const clean = iban.replace(/\s+/g, "").toUpperCase();
