Post cover image

October 9, 2026

Who’s Who in Banking: CIF, GCIF, Account Numbers and IBAN Explained

Who’s Who in Banking: CIF, GCIF, Account Numbers and IBAN Explained

By Syed Hanzala Hussain

4 min read

Never Tested a Banking Application. Now You Know How to. (Part 1 of 4)

📚 Part 1 of 4. This is the starting point, so you don't need to read anything first. Part 2 covers transfers and SWIFT, Part 3 covers corporate banking and CMS, and Part 4 shows how banking apps work and how to test them.

🏦 Your first banking project.

The documentation says: "Test the transfer module. Inputs: CIF, account number, IBAN."

Everyone nods. You nod too. Inside, you're thinking: "Which one is the customer? Which one is the account? And why are there two account numbers?"

Let's fix that, starting from zero. ☕ About 5 minutes.

🧱 Level 0: What a bank actually keeps

A bank keeps two kinds of records:

  1. Who you are (the customer)
  2. What you have (the accounts)

Almost every banking term is about one of these, or about the link between them.

Imagine a vault full of lockers 🔐:

  • You are the customer.
  • Each locker is an account.
  • The number on the locker is the account number.
  • A person with a key who doesn't own the locker is a signatory.

Keep this picture. We'll build on it.

👤 Step 1: The customer record

CIF (Customer Information File)

The CIF is the bank's record of one customer. It holds the name, ID documents, address, phone and KYC details. Every customer gets a number for this record, called the CIF number (some banks say customer ID or customer number).

One CIF links to many accounts:

CIF 1004567  (Sara Khan)
 ├─ Savings account
 ├─ Current account
 └─ Fixed deposit

GCIF (Group or Global CIF)

A GCIF ties together several CIFs that belong to the same person or group. For example:

  • Sara's personal CIF
  • The CIF of the company Sara owns
  • Her family trust's CIF

All three roll up under one GCIF. 🔗 The name and exact meaning vary by bank, so check your client's term.

Why banks do this: to see a customer's total relationship: combined balances, loans and risk limits.

KYC (Know Your Customer): the identity checks the bank does before and during the relationship. KYC status often decides what a customer is allowed to do.

💼 Step 2: The account

An account is a record of money between the customer and the bank. Common types:

  • Savings: earns interest
  • Current / checking: daily payments
  • Fixed / term deposit: money locked for a period
  • Loan: the customer owes the bank
  • Multi-currency: a separate balance per currency

Account number

The account number identifies one account at one bank. It's printed on statements and shared to receive money. So it's not a secret and not a permission.

And here's a fun thing most people don't know. 👇

🔍 Many account numbers have a pattern inside them

In some banks, the account number is built from parts. Example (fictional):

021004567019
02 | 1004567 | 019

✂️ Remove the first 2 and the last 3 digits. The 7 digits in the middle are the CIF number: 1004567.

So in that layout, an account number can lead you straight back to the customer. 😮

Careful: the layout differs by bank. What the first 2 and last 3 digits mean depends on the bank (often something like a branch or product code and a sequence). Always confirm with your client.

🌍 Step 3: The IBAN

What is an IBAN?

The IBAN (International Bank Account Number) is the international wrapper around the account number. It lets banks in different countries identify an account in the same format.

How an IBAN is built

A UAE IBAN is 23 characters (fictional example):

AE07 033 1234567890123456
 │    │         │
 │    │         └─ account number (16 digits)
 │    └─────────── bank code (3 digits)
 └──────────────── country code + 2 check digits
  • AE is the country (UAE).
  • 07 are the two check digits.
  • 033 is the bank code: it identifies the bank inside that country.
  • The last 16 digits are the account number, often the bank's account number padded with leading zeros.

Other countries use different lengths and layouts, but the idea is the same.

Three IBAN facts almost nobody tells you

  1. 🔢 The check digits only catch typos. They're calculated with a formula called MOD-97. A valid-looking IBAN does not prove the account exists or belongs to the person you typed.
  2. 🏦 The bank code is not the SWIFT/BIC. The bank code is a local number inside the IBAN. The BIC is used for international messaging (Part 2).
  3. 🔁 IBAN = country + check digits + bank code + account number. The account number is inside the IBAN. Take it out and you're back to the same account number.

🧩 How it all connects

GCIF (the group)
 └─ CIF 1004567 (one customer)
     └─ Account number 021004567019
         └─ IBAN AE07 033 0000 0021 0045 6701 9   ← same account, wrapped for international use

(The IBAN above is illustrative only.)

🔑 Step 4: Who may do what

  • Account holder: the owner. A joint account has two or more.
  • Mandate: the rule for how a joint account is operated. Either or survivor means any one holder can act. Both to sign means all must approve.
  • Signatory: someone allowed to operate an account without owning it, sometimes with a limit. A company finance manager is a common example.
  • Beneficiary: the person being paid. Customers save beneficiaries like a contacts list.

And account statuses that quietly change what an account can do:

  • Active: normal.
  • Dormant: unused for a long time, so it may need reactivation.
  • Debit freeze: money can come in, nothing goes out.
  • Lien: part of the balance is blocked (for example, against a loan), so the available balance is lower than the ledger balance.
  • Closed: no longer usable.

🔍 Tester's notes

  • Does the server check that the account belongs to the logged-in customer, or does it just trust the number?
  • If account numbers contain the CIF, are they guessable? Is ownership still enforced?
  • Does a frozen or dormant account refuse payments in every channel and API?
  • Does a "both to sign" account really need both signatures on the server?
  • Can a user reach data from a linked CIF (GCIF) they shouldn't see?
  • Is an IBAN accepted without checking that the account exists?

⚡ Cheat sheet

  • CIF: the bank's record of one customer
  • GCIF: links several CIFs of the same person or group
  • Account number: identifies one account (not a secret)
  • IBAN: country + check digits + bank code + account number
  • Bank code: local bank identifier inside the IBAN
  • Mandate: who must sign on a joint account
  • Signatory: can act on an account without owning it
  • Lien / debit freeze: blocks part or all of the money
  • KYC: the bank's identity checks

⏭️ Next up

You now know who's who. In Part 2 we follow the money: transfers, what SWIFT actually is, and why $1,000 can arrive as $965.

Examples are fictional and for authorized testing only. Account number layouts, GCIF naming and IBAN formats vary by bank and country, so verify with your client's documentation.

Which banking term confused you most? Tell me below. 👇

Hanzala Hussain

Linkedin — Follow: https://www.linkedin.com/in/ghostbalde/

Syed Hanzala Hussain