Banks are sadly frequently too slow moving and bureaucratic to keep up with the rest of the world, and often don't have any good infosec people.

Case in point - I recently found myself (very reluctantly and under severe protest) patching an AES library to talk to a major bank's SFTP-based file transfer service, as they're still using a mode that's been broken since 2008. No-one at said bank was able to comprehend why this was a problem.