ISO 3166 is the standard published by the International Organization for Standardization (ISO) that defines codes for the names of countries, dependent territories and their principal subdivisions. Its best-known product is the two-letter country code, such as DE for Germany or JP for Japan. The standard does not define what a country is; it assigns codes to names taken from United Nations sources so that computer systems and organisations refer to the same place in the same way.
The codes are part of the plumbing of international finance. They appear in bank account numbers, bank identifiers, payment messages, card transaction data, customer records and sanctions lists. Several other standards are built on them, including ISO 4217 for currencies. A payment system that misreads a country code can route a payment wrongly or miss a compliance check, so the standard matters well beyond its apparent simplicity.
The three parts of the standard
- ISO 3166-1 lists countries and territories and gives each three codes: a two-letter code (alpha-2), a three-letter code (alpha-3) and a three-digit numeric code. The United States is US, USA and 840; India is IN, IND and 356.
- ISO 3166-2 gives codes to subdivisions such as states, provinces and regions. Each code is the country's alpha-2 code, a hyphen and up to three further characters: US-CA for California, CA-ON for Ontario.
- ISO 3166-3 records codes for country names that have been withdrawn since the standard was first published in 1974, using four-letter codes, for example for the former Czechoslovakia.
The alpha-2 code is by far the most widely used. The numeric code is identical to the one assigned by the United Nations Statistics Division and has the advantage of being independent of any alphabet, which is why it appears in card messages.
Maintenance and special codes
The list is kept up to date by the ISO 3166 Maintenance Agency, based at ISO in Geneva. It adds, changes or withdraws codes when a country is created, dissolved or renamed, taking the names from the United Nations. Withdrawn alpha-2 codes are not reassigned for many years, to avoid confusing old data with new.
Some codes sit outside the official list. A block is set aside for user-assigned codes that the agency will never allocate, including the range XA to XZ. Financial systems use XK for Kosovo on this basis. Others are exceptionally reserved at the request of an organisation: EU for the European Union and UK for the United Kingdom, whose official code is GB. Systems that validate country fields strictly against the official list have to allow for these cases.
Use in payments and banking
The alpha-2 code is embedded in the main international identifiers. An IBAN begins with the two-letter code of the country where the account is held, which also determines the length and structure of the rest of the number. Positions five and six of a Business Identifier Code, the code many people call a SWIFT code, are the country code of the institution. Postal addresses in ISO 20022 payment messages carry the country as an alpha-2 code in a dedicated field, and the move to structured addresses makes that field mandatory for many payment types.
Card systems prefer the numeric form. ISO 8583 messages carry the acquirer's and merchant's country as three-digit codes, and the country of the issuer is held against each bank identification number. Comparing the two tells a processor whether a transaction is domestic or cross-border, which affects interchange, scheme fees and whether the cardholder is offered currency conversion.
The first two letters of most currency codes are the country's alpha-2 code: US gives USD, JP gives JPY, GB gives GBP. The Legal Entity Identifier reference data records each entity's country and subdivision using ISO 3166 codes, and tax reporting regimes use the codes to identify jurisdictions of residence.
Use in compliance and risk
Country codes are central to financial crime controls. During know your customer checks, a firm records nationality, country of residence and country of incorporation as coded values so that risk rules can be applied consistently. High-risk jurisdiction lists, such as those published by the Financial Action Task Force, are loaded into monitoring systems as sets of country codes. Sanctions screening tools block or flag payments whose originator, beneficiary or bank is located in an embargoed country.
Subdivision codes matter here as well, because some sanctions apply to regions within a country and not to the country as a whole. Fraud systems compare the country derived from a geolocation check with the card's issuing country and the delivery address. Rules on data residency are also commonly configured by country code.
Practical pitfalls
Most problems arise from mixing formats or from stale reference data. A system expecting alpha-2 codes will reject GBR, and a numeric code stored as a number loses its leading zeros, turning 036 for Australia into 36. Country lists copied into software years ago may lack newer entries or still contain withdrawn ones. A territory may have its own code although it is not a sovereign state, so nationality and location are not the same field. And the codes say nothing about currency, language or legal status: a firm that needs those facts must hold them separately.