Introduction

For correspondent banking and payments teams, the first due-diligence question has a well-established reference. Swift's ISO 9362 directory of Business Identifier Codes (BICs) tells you which institution sits behind a code. But many of the counterparties that banks onboard, monitor and pay are not banks. They are payment and e-money institutions, crypto-asset service providers and money service businesses—and very few of them hold a BIC.

Of the 44,161 payment, crypto and money service firms on the 22 regulator registers we track, 963 (2.2%) hold a BIC, as at 25 September 2026. For the other 43,198, a BIC lookup returns nothing. The answer to "who is this firm, and who supervises it?" sits on a regulator's register instead—one of dozens, each with its own format, vocabulary and update cycle.

That is why we built the Elucidate Bank & Firm Directory. It puts both populations in one place: 79,666 active institutions in 231 countries and territories, of which 36,468 hold a BIC and 43,198 do not.

The firms a BIC directory cannot see

A BIC identifies where a payment is routed. Most non-bank payment firms have no such code: they reach the financial system through a bank's accounts, often as nested or indirect participants. Yet the obligation to identify them is well defined:

  • Licensing is the global standard. FATF Recommendation 14 requires countries to ensure that providers of money or value transfer services are licensed or registered.
  • US banks are expected to confirm it. The 2005 interagency guidance on banking money services businesses sets minimum expectations, including confirming the customer's FinCEN registration, if required, and its compliance with state or local licensing requirements.
  • EU crypto-asset services now need an authorisation. The last MiCA transitional periods ended on 1 July 2026. As ESMA reminded the market, a crypto-asset service provider without MiCA authorisation can no longer serve EU clients. The list that counts is now ESMA's register, and it changes with every authorisation and withdrawal.

Each of those checks points to a different register, in a different format—bulk files, search portals, in one case a monthly PDF—and with different words for the same concept. None of them links to the BIC directory. Confirming that a Canadian remitter is registered, and that it is the same legal entity as a BIC holder, is done by hand, one register at a time.

The result? Identification—the step that should be the cheapest part of due diligence—becomes one of the most manual.

The cost is not only operational. The Financial Stability Board's 2018 stocktake found that banks ended relationships with remittance providers partly because of the sector's perceived AML/CFT risk, and because its supervision ranged from active and effective to absent. When a bank cannot easily see whether a firm is supervised, exiting is the simplest response. De-risking does not remove the risk. It relocates it.

The data: Swift's BIC directory, GLEIF and 22 regulator registers

Every value in the directory comes from a public source, and every page shows the date of the data behind it. The figures here come from the current snapshot: BIC data as at 23 September 2026, registers retrieved on 24–25 September 2026 and GLEIF relationships as at 25 September 2026.

Institutions that hold a BIC

The base register is Swift's ISO 9362 directory: 110,180 BIC codes, belonging to 36,468 institutions. Every other source is joined to it on an identifier, not a name: the BIC-to-LEI relationship files that Swift and the Global Legal Entity Identifier Foundation (GLEIF) publish, the ECB and Financial Stability Board bank lists, the OFAC and EU sanctions lists, payment-scheme registers and national bank-code directories for 24 countries.

Institutions on a tracked register

The firm side is the new work. We fetch 22 registers, published by 13 public authorities and covering 37 countries:

The largest register, FinCEN's, lists 31,128 money service businesses: 39% of all institutions in the directory. Of these, 24,624 list cheque cashing among their activities, many of them retail outlets rather than payment firms. That one register shapes every headline total, so the directory also reports its figures outside the United States. There, 73% of institutions hold a BIC (32,518 of 44,643).

How the records are standardised and linked

Putting 22 registers next to the BIC directory is the easy part. Making them comparable is the work. Five rules shape the result.

1. One institution, counted once. An institution is either a BIC8 in Swift's directory or a firm on a tracked register that holds no BIC. When a register firm and a BIC holder are the same legal entity, the firm's licences appear on the BIC holder's page; 897 institutions hold both. A search for the FCA reference number 900507, for example, opens the page of Wise Payments Limited, where that licence sits next to the institution's BIC.

2. Identifiers before names. A register record joins an institution that holds a BIC only through a shared Legal Entity Identifier (LEI), never by name alone. To find that LEI, register firms are matched to GLEIF's Golden Copy files: through the LEI the register gives, a UK company number, or an exact normalised name in the same country. The address breaks ties. Where a match is unclear, the field is left blank. A missing link is easier to correct than a wrong one.

3. One taxonomy. Registers describe the same activity in different words: an "authorised payment institution" in London, a "major payment institution" in Singapore, a "money transmitter" on FinCEN's list. Each firm is given a type from its licence—payments and e-money, crypto, or money service business—and a regulation level: a prudential licence, a small-firm registration or an AML registration only.

The distinction matters. Of the 44,095 institutions on a tracked register, 39,967 (91%) appear only as registered with an anti-money-laundering supervisor, with no prudential licence on the registers we track. Outside the United States, the share is 68%. Some US firms also hold state money-transmitter licences, which the directory does not track yet. Either way, a registration is not an authorisation.

4. Each source is read on its own terms. HMRC's register has one row per premises—Post Office Ltd alone has 6,693—so rows are collapsed to one per registration. The EBA records a firm's history as a sequence of authorisation and withdrawal dates, so current status is read from the whole sequence, not from the latest field.

5. Nothing is deleted. Licences are cancelled, withdrawn, revoked or allowed to expire. A firm that its register lists as inactive, or that disappears from a register that lists only current firms, stays in the directory, marked inactive—8,470 institutions in the current snapshot. Each refresh is compared with the last, and every change is logged. A register that was not refreshed cannot lose entries, and one that would lose more than 10% of its firms in a single run is held back for review.

GLEIF's parent records then connect the two populations: 121 of the 1,133 corporate groups in the directory combine institutions that hold a BIC with institutions that do not. PayPal has 11 institutions in the directory, five of them without a BIC; Western Union has 15, four without. A view built on BICs alone shows only part of each group.

What the directory does not show

A dataset is only safe to rely on when its limits are stated next to it. These are the directory's.

  • Identification, not assessment. A BIC or a licence identifies an institution. Nothing in the directory is a judgement of its financial crime risk.
  • Absence is not evidence. A firm missing from the tracked registers is not necessarily unregulated. Most banks are licensed by national supervisors whose registers are not tracked yet. Nor are US state money-transmitter licences or the DFSA's register in the Dubai International Financial Centre.
  • Sanctions matches cover BIC holders only. Listings are matched on the BIC and on the LEI mapped to it. Institutions without a BIC are not screened, and a missing match never means that no listing applies. Always screen against the official lists.
  • LEI coverage is uneven. An LEI is mapped for 55% of the institutions that hold a BIC (20,116 of 36,468), against 7% of those that do not (2,885 of 43,198). The two rates come from different methods, so they are not directly comparable.

Why the directory has to be current

An identification layer is only as good as its date. The fact that matters most in counterparty due diligence—whether a firm is licensed today—is also the fact that changes most often.

The registers that publish ended licences show how often licences end. FINTRAC's registry lists more money services businesses whose registration has expired, ceased or been revoked (4,379) than active ones (4,047). On the FCA's register of payment institutions, cancelled and revoked firms outnumber active ones by more than two to one (2,031 against 888). On the EBA's register, 2,019 firms have been withdrawn, against 2,334 that are active.

The sources change daily. Between two EBA register files published eight hours apart, on 24 and 25 September 2026, two French firms appeared: an e-money institution and a payment institution, both authorised that week. Swift's directory moves too. In the 12 months to 23 September 2026, 2,628 BIC codes were registered, and 40% of all BIC codes were last updated in 2024 or later.

That is why the directory is built as a pipeline, not a publication. Each refresh downloads every source again and rebuilds every page from the new files. Every page shows the date of each source next to its data, so a reader can see how current a fact is before citing it in a due-diligence file.

Why it is open to everyone

Identification is a shared problem: every bank, payment firm and auditor checking the same counterparty repeats the same lookups. A network problem needs a network solution—one common reference that every party can check, cite and correct.

The directory is therefore public, with no login. Search by name, BIC, LEI or licence number, or browse by country, register or corporate group. Every page has a Markdown version, and a JSON search API serves the same data to internal tools and AI agents (see For agents). Errors are corrected at the source—by Swift, GLEIF or the regulator—so the fix reaches every user of that data.

Where Elucidate can help

The directory answers the first question in counterparty due diligence: who is this institution, and who supervises it? It deliberately stops there. A BIC or a licence identifies an institution; it does not assess it.

Assessment is the job of the Elucidate FinCrime Index (EFI): an independent, data-driven score of the financial crime risk of banks, built for correspondent banking and counterparty due diligence. Elucidate's AI management system is certified to ISO/IEC 42001, the international standard for managing AI responsibly. The directory tells you who a counterparty is. The EFI measures how much financial crime risk it carries, on the same basis for every bank. To see how the two fit your onboarding and review cycle, talk to our team.

Conclusion

The financial system's reference data was built for banks. Many of the institutions that move money are not banks, and nearly all of them hold no BIC. The data to identify them was always public. It was never in one place.

Linked by identifiers, sourced and dated, one directory turns identification from a search across dozens of registers into a single lookup. Keeping it current is what makes that lookup safe to rely on.

We look forward to comments and suggestions, and to continuing the discussion.

Institutions in this article