My dayjob in the banking industry is strictly NIST SP 800-63B compliant for all systems we control.

Our industry partners, who are mostly large banks, have idiotic make-work policies. Some are just plain made up without justification by an internal auditor who thinks they’re smart. More than one even consider usernames to be secrets and one threatened to bail on a contract when our apps began displaying the username on-screen and in audit reports.

Microsoft, for one.

https://practical365.com/security/microsoft-recommending-non...