My german bank Haspa has a limit of 12. My guess for the reason -- apart from "we didn't have any problems, yet" -- is that part of the relevant infrastructure is ancient and uses a hardcoded max length...