> ## Documentation Index
> Fetch the complete documentation index at: https://developer.tazapay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Field Validation Updates

**Release Date:** March 24, 2026 (Tentative)

**Release Type:** Enhancement · Breaking Change

<Warning>
  **Action Required**

  Stricter field validation will be enforced across core APIs from March 24, 2026. Review the rules below and update your integration before the release date to avoid rejected requests.
</Warning>

These changes improve data integrity and reduce downstream payment failures by aligning validation logic with international banking and postal standards.

## 1. Banking Identifier Validation

**Applies to:**

* `POST /v3/beneficiary`
* `PUT /v3/beneficiary/{id}`
* `POST /v3/payout`

<Info>
  **Auto-Sanitization**

  All banking identifier inputs are automatically sanitized before validation — spaces and hyphens are stripped and values are uppercased.
</Info>

### `account_number`

* **Length:** 4–34 characters
* **Pattern:** `^[A-Z0-9]{4,34}$`
* **Example:** `00123456789`

### `iban`

* **Length:** 15–34 characters
* **Pattern:** `^[A-Z]{2}[0-9]{2}[A-Z0-9]{11,30}$`
* **Structure:**
  * Characters 1–2 — Country code (ISO 3166-1 alpha-2)
  * Characters 3–4 — Check digits
  * Characters 5–34 — BBAN (Basic Bank Account Number)
* **Additional rules:**
  * Country code must be valid ISO 3166-1 alpha-2, not prohibited by the Tazapay
  * Country code must match the destination country
  * Country-specific length checks are enforced (e.g., DE = 22, GB = 22, FR = 27)
  * Check digits are validated using the [Mod-97-10 checksum algorithm](/api-reference/appendix/iban-checksum-validation) — remainder must equal 1
* **Example:** `GB29NWBK60161331926819`

### `swift_code`

* **Length:** 8 or 11 characters
* **Pattern:** `^[A-Z]{4}[A-Z]{2}[A-Z0-9]{2}([A-Z0-9]{3})?$`
* **Structure:**
  * Characters 1–4 — Bank code (A–Z)
  * Characters 5–6 — Country code (ISO 3166-1 alpha-2)
  * Characters 7–8 — Location code
  * Characters 9–11 — Branch code (optional, alphanumeric)
* **Additional rules:**
  * Country code must be valid and not prohibited by the Tazapay
  * Location code `00` is rejected (reserved for test BICs)
* **Example:** `DEUTDEDBXXX`

### `ifsc_code`

* **Length:** Exactly 11 characters
* **Pattern:** `^[A-Z]{4}0[A-Z0-9]{6}$`
* **Structure:**
  * Characters 1–4 — Bank code (A–Z)
  * Character 5 — Reserved, must be literal `0`
  * Characters 6–11 — Branch code (alphanumeric)
* **Example:** `HDFC0004832`

### `aba_code`

* **Length:** Exactly 9 digits
* **Pattern:** `^[0-9]{9}$`
* **First 2 digits must fall within:** 00–12, 21–32, 61–72, or 80
* **Checksum:** Validated using the [ABA 3-7-1 checksum algorithm](/api-reference/appendix/aba-routing-number-validation) — result must be divisible by 10 (modulo 10 = 0)
* **Example:** `021000021`

### `sort_code`

* **Length:** Exactly 6 digits
* **Pattern:** `^[0-9]{6}$`
* **Example:** `608371`

### `bsb_code`

* **Length:** Exactly 6 digits
* **Pattern:** `^[0-9]{6}$`
* **Example:** `063000`

### `bank_code`

* **Length:** 3 digits (COMPE) or 8 digits (ISPB)
* **Pattern:** `^([0-9]{3}|[0-9]{8})$`
* **Applicability:** Brazil (BR) only
* **Example:** `00000341`

## 2. Address, Postal Code & Phone Validation

**Applies to:**

* `POST /v3/beneficiary`
* `PUT /v3/beneficiary/{id}`
* `POST /v3/customer`
* `PUT /v3/customer`
* `POST /v3/customer/{customer_id}/{address_type}`
* `POST /v3/checkout`

### Address Text Fields — `line1`, `line2`, `city`, `state`

The following special characters are **not permitted** in address text fields:

```
< > { } | \ ^ ` =
```

<Info>
  **Note**

  These fields are optional. Validation applies only when a value is provided.
</Info>

### `postal_code`

* **Length:** 3–12 characters
* **Pattern:** `^[A-Za-z0-9 -]+$`
* **Allowed characters:** A–Z, a–z, 0–9, spaces, hyphens (-)
* Must contain at least one alphanumeric character. Values with only spaces or symbols are rejected.
* **Example:** `94105-1234`

### `calling_code` + `number` (Phone)

* `calling_code` and `number` must always be provided **together**. Supplying only one returns a validation error.
* `calling_code` must begin with `+` followed by a valid country dialing code (e.g., `+1`, `+65`)
* **Combined digit length** excluding the `+`: 7–15 digits (E.164 standard)

**Valid examples:**

| calling\_code | number       |
| ------------- | ------------ |
| `+65`         | `91234567`   |
| `+1`          | `2025550123` |

## 3. Name Field Validation

**Applies to:**

* `POST /v3/entity`
* `PUT /v3/entity/{entity_id}`

### `name`

* **Allowed characters:** A–Z, a–z, 0–9, spaces, `&`, `,`, `.`, `-`
* **Pattern:** `^[a-zA-Z0-9][a-zA-Z0-9 &,.-]*$`
* **Examples:** `ABC Trading, Ltd.`, `Smith & Sons`

## Relevant Links

1. [Beneficiary API Documentation](/api-reference/tazapay-api/beneficiary)
2. [Create Payout API Documentation](/api-reference/tazapay-api/create-payout)
3. [Customer API Documentation](/api-reference/tazapay-api/user)
4. [Entity API Documentation](/api-reference/tazapay-api/entity)
5. [Checkout API Documentation](/api-reference/tazapay-api/checkout)