That's nothing. One of the largest banks in North America (BMO), limited passwords to 6 characters. Worse, for compatibility with telephone banking the characters were mapped to digits. That means there were only 1,000,000 possible unique passwords! They have 12,000,000 customers!

They only just changed to complex passwords this year.