Complex password rules haven’t been shown to improve security in any way. They have been proven to torpedo security, e.g. they make people forget so they do blatantly-insecure things like writing passwords down or relying more frequently on things that reduce account security like having to reset the password entirely through simple E-mails or codes, etc.
And speaking of banks, I am livid that so many of my financial accounts essentially require absolutely terrible passwords. A lot of them don’t support E-mail for log-in either.
Meanwhile, your basic “correct horse battery staple” [1] works pretty well.