De jure illegal, sure, but we all know it's de facto required for institutions of a certain size. Laws are only as good as the enforcement.