Is the validation done using Javascript? I have used a credit union that used to do that until they merged with another credit union and switched to a new system. Password requirements were limited to 0-9, maximum of six digits. However, if you bypassed their client-side validation logic, you could use any password you wanted.