Legacy systems. There's almost certainly some ancient backend system that deals with passwords, and can't handle long passwords or certain special characters. I would not assume that bank passwords are being hashed properly.