> Why are financial institution so _bad_ at password policies?

Legacy code written quickly in 1998 and not replaced yet?