I did say - it depends. It depends on the validation required. I also try to prevent users committing a validation offence in the first place - less irritating to the user so as others have said, better on a form
For example if a string is restricted to 10, 25, 50 chars, whatever I set that in the table - but I also include code in a form to prevent users from entering more than the maximum number of characters rather than validation saying 'you've entered too many characters'. I use the change event
Same applies to the other data types
Passwords may be set for a minimum number of chars - and perhaps other criteria such as number of upper/lower/numeric chars. This could be done in a table as a validation rule but easier to do in a form - I sometimes use formatting - simplistically background starts off red and gets lighter as each condition is met - again triggered by the change event
I can handle dates by using my own calendar form where I can restrict the date range that can be chosen - but I also include the validation in the table if appropriate.
Rather than looping through the controls, you can loop through the form recordset to look at the field properties (dao access only) - me.recordset.fields("myField").validationrule