My (new) bank USAA has some password policy which I forget, but I vaguely remember the green bar growing longer as I typed in my proposed password.

To log in to the site I have to supply my login/password, then on the next page my 4 digit pin, then on the next page the answer to one of three rotating security questions.

On the phone app, after the phone was authenticated the first time, I only have to enter my 4 digit pin to access my account. IIRC, that policy is at my option.

I'm not sure if that's all a good thing, or theater, but that's what they have.

My credit union used to have a similar, although not as bad, password policy. I believe password length had to be between 8 and 10 alphanumeric characters, and then there were other crazy rules that reduced the entropy of passwords further. I think there had to be at least 3 numbers in the password and it couldn't start with a number.

It took them years before they finally listened to reason and allowed you to have a stronger password