Deferred · new timing by December
Unstructured addresses stop being accepted
CBPR+ — the cross-border payments and reporting rules that correspondent banks settle under — will require structured or hybrid postal addresses. Swift deferred the November cutover on 27 August and will confirm new timing by December. A message carrying a fully free-text address is still rejected by the receiving institution rather than repaired, which makes this an operations problem before it is a technical one, whatever date it lands on.
Whichever side of the problem you are on
The same engine answers all four, and cites the same rules whichever way you reach it.
Payments operations
Find out why a message was returned, and what to change. Every finding names the rule and the exact field, in language you can forward to the team that owns it — not a stack trace.
Engineering
Validate in CI before a message reaches a counterparty. SARIF output lands in code scanning, a language server puts findings in your editor, and an MCP server lets an AI assistant use the same engine.
Compliance and risk
Evidence you can attach to a ticket or an audit: findings as SARIF, an evidence pack naming what was checked and what was not, and a published conformance result you can reproduce.
Fintech and platforms
Generate a valid message before the real data exists, convert between SWIFT MT and ISO 20022 with a report of what changed, and look up any of 2,845 definitions without a licence.
Measured, not asserted
Every figure below comes from a command you can run yourself. Nothing here is a static badge.
4,746
of 4,746 agree with libxml2
The same 1,035 documents accepted and the same 3,711 rejected as the reference implementation, across the whole catalogue. Reproduce it with make differential.
2,845
message definitions, offline
Every published ISO 20022 message across 285 message sets, indexed inside the binary. Search and lookup need no download and no network.
0
bytes of specification content
No schemas, reports or samples are redistributed. A CI gate fails the build if an .xsd, .pdf or .docx ever reaches this site.
0
known vulnerabilities
govulncheck runs on every commit against the dependency graph and the standard library, and fails the build on a finding.
About AskISO
AskISO is a free, open-source toolchain for ISO 20022 financial messaging. It validates, lints and converts payment messages on your own machine, and every finding names the rule, the field and the fix.
Start with a single message
Paste a payment message into the workspace and see what comes back. It recognises the format on its own, then validates the message and explains every result in plain language.
Each finding names three things: the rule that fired, the exact field it points at, and what you should change. That final part matters most, because a finding you cannot act on is really just a finding you have to ask somebody about.
Suppose a creditor IBAN fails its checksum. AskISO never stops at "invalid". It reports that the check digits are incorrect and calculates the appropriate pair for that account number. It also warns you the account number itself may be the underlying mistake.
Look up any message definition
The message reference covers all 2,845 ISO 20022 definitions, including every version of pacs.008, pain.001, camt.053 and the rest, arranged by business area. Each page records which version superseded it and where the Registration Authority publishes the schema.
There is no account to create and nothing to subscribe to.
Take the evidence away with you
Findings rarely stay with whoever discovered them. Export yours as JSON, as SARIF for code scanning, or as a written summary for a ticket or a review.
That pack also records what was not checked. Without a schema installed, "clean" only means that nothing contradicted the message. Those are genuinely different claims, and the difference deserves to be written down.
Why the answers can be trusted
Our validation is checked against somebody else's. AskISO validates ISO 20022 messages with its own implementation of the schema rules. To demonstrate that it agrees with the reference, we ran the entire catalogue through libxml2 as well. Both accept the same 1,035 documents and reject the same 3,711, which is agreement on 4,746 of 4,746. A single command reproduces that result.
Schema validity is only half the question. A perfectly valid message can still be refused by a clearing system. AskISO therefore applies the scheme rules that sit above the schema: CBPR+ requirements, the November 2026 address mandate, enhanced data, and LEI and UETR correctness.
Conversion reports its own losses. MT101, MT103, MT104, MT107, MT202, MT204 and MT940 all convert into their ISO 20022 equivalents and back again. Every conversion includes a fidelity report describing what was mapped, derived, shortened or lost. Conversion between MT and MX genuinely loses detail, and concealing that would help nobody.
Fits wherever you already work
Run it on your own machine as a command line tool. Install it in your editor and it identifies problems while you type. Add it to your build pipeline and a malformed message fails there, rather than reaching a correspondent. Connect it to an AI assistant and that assistant can cite a rule identifier instead of improvising. Or simply use this website, which runs the identical engine inside your browser tab.
No account, no API key, and nothing ever leaves your machine. That is the honest answer to the first question your security team will ask.
Why we publish no schemas ourselves
The Registration Authority publishes ISO 20022 at iso20022.org, free of charge, and we deliberately do not mirror it. You download whichever message sets you need and point AskISO at the folder.
That arrangement benefits you directly. Your schemas remain current, and you validate against the authoritative source instead of a copy of uncertain age. Search, linting, MT conversion, code lookup and message generation all operate with no download whatsoever.
Where AskISO deliberately stops
Some questions have no answer that can be verified, and when we meet one we say so rather than improvise.
MT940 expects a transaction type code, but sometimes no verified mapping exists from the ISO 20022 bank transaction code. AskISO writes NMSC and tells you exactly what was lost. Similarly, camt.110 expects a coded investigation type where MT carries only prose. AskISO uses the proprietary branch and identifies its source, rather than inventing a code.
Guessing would be straightforward. It would also be wrong occasionally, and you would have no reliable way to tell which occasions those were. For a payment instruction, a confident wrong answer costs considerably more than an honest gap.
The same caution applies to what AskISO itself is. It is a tool rather than regulatory advice, so a clean result is never a guarantee that a scheme or a correspondent will accept your message. And it is an independent open-source project, with no affiliation to ISO or to SWIFT.
What it costs, and what it will cost
Nothing, and that is a commitment rather than an introductory stage.
There is no paid tier, no account, no API key and no licence server, and no registration form stands between a visitor and an answer. Because no email address is ever requested, you can paste a message immediately, and you can forward this page to a colleague who can do exactly the same without qualification.
That undertaking extends to the tooling as well as the website. The command line, the libraries and the servers are distributed under Apache-2.0 or MIT, at your option, and that arrangement is permanent rather than provisional.
The reasoning deserves stating plainly. AskISO carries no funding and seeks none; its expenses amount to a domain registration and a maintainer's time. The present objective is that practitioners who handle these messages professionally find the tool genuinely useful and recommend it to one another, and introducing an invoice would obstruct precisely that.
Should an institution eventually require something built exclusively for itself, that would constitute a separate commercial arrangement, and it would alter nothing described above.
Try it with a message of your own
The quickest way to judge any of this is to check a message and read what comes back. Everything runs inside your browser, so nothing is uploaded, and the whole exercise takes about a minute.