I work in a bank. Until a year ago, our passwords are 8 characters max, no special characters, upper and lowercase letters are equal. We were running IE7 up until 2 years ago. A huge amount of the business is still organized around sending excel sheets to each other, with no sidechannel validation. The fact that you recieved an excel sheet from some email is treated as proof that it's valid. Last I checked we were also operating an unauthenticated SMTP relay. They will shit on actual security while telling me that I have to run windows on my work laptop because otherwise they can't run their favorite RAT powershell script to recursively unzip every jar on my system to look for log4shell (yes, still).

The same people who instituted and backed these rules and practices are also running the core system for clearing in the national bank of Denmark.

Banks are not secure. They are conservative and political. They will do everything to tell you they are secure. They will make your life hell to uphold their security theater, but it's just a facade. I have no doubt they will implement WEI, but it will not bring security.

Banks do have a pretty good trackrecord of protecting people's money, but they do that through a defense in depth strategy of having a bunch of compliance officers manually reviewing transactions for suspicious activity.