Turns out it was ten. Ten characters protecting my sensitive personal banking information. Upon e-mailing, they said they're going to be bumping it to 20.
Ran into a problem a few months ago where I changed my password successfully on the front-end, but one-or-many backend syncing operations mangled the new password by dropping the last n characters on the floor. So when I logged into the front end, it would look like everything was fine until I tried to perform some kind of operation. At which point it promptly threw up all over itself.
Left me in a completely non-working state for a few days. Didn't help that I'm basically the only admin for said system.