I know at least one french bank which accepts regular strings as passwords, so it may not be a legal requirement. Which makes it confusing why it's so widespread...