Banking passwords are always fun. Mine has to be changed every 30 days, cannot be same as last 3, must contain at least one number, special character, capital, lowercase. I essentially end up where i have to store password in plain text (!) in a password protected file. ridiculous but there is no way around it. People really have go understand that such things don't help at all, they increase user frustration if anything.
I have never understood the number/uppercase requirement, if someone somehow put a key logger it won't matter or if some one is using brute force, it wont matter either.
Second, the mixed case alphanumeric definitely aids against brute force attacks, particularly in the case of an online attack (for an offline attack, there are probably hundreds of thousands of attempts per second so the only effective protection is a slow hashing function that limits attack speed)
Except whereas those rules sound like they would enhance your personal security, following these rules work against it ("must be exactly 8 characters"?!)
I have never understood the number/uppercase requirement, if someone somehow put a key logger it won't matter or if some one is using brute force, it wont matter either.