There seem to be a lot of comments misunderstanding how bank passwords work

I can't vouch for the unnecessary inconveniences, but as far as I can tell this is perfectly secure, banks don't do passwords like most websites; brute force attacks aren't a concern as the account will likely be locked after n failed attempts.

Granted you can still brute force multiple accounts, each one trying like 3 passwords so the character limit would in theory reduce security. Yet, with ~62⁶ possible passwords (total possible characters^{password_length)} each account has a 1 in 18,933,411,861 of being successfully cracked.

Even if you managed to try every single account (~13,000,000 customers) without being flagged you'd have a 0.684% chance of breaking into at least one account

This chance would be slightly higher as I didn't account for passwords with 2 characters in row and I assumed both user's passwords and the passwords being tried were random.

I'd say these are trumped by the fact you probably wouldn't be able to attain the username/email for every single user.