The Royal Bank of Scotland does this too, though they don't enforce crazy long passwords.