While the other answers about Sabre are probably right, I've heard that banks intentionally have stupid password policies to prevent password reuse. If one bank says "no special characters but most contain a number", another says "must contain a special character, but no numbers", and a 3rd says "must contain a number and special character", they can guarantee that if one of the 3 is hacked into it doesn't compromise people with accounts at all 3 (of course ignoring people using "password" with a 1 or ! on the end).