I disagree with the premise of your question. I think your bank's scheme is likely more secure than allowing users to choose their own passwords.
One thing we know with great confidence is that a lot of users choose poor passwords. For instance, one recent study found that if the attacker is rate-limited to 10 guesses at the password per account, then the attacker can expect to break about 1% of accounts. These numbers appear to be pretty robust across a broad range of different kinds of password-protected systems. Therefore, any system that allows users to select their own passwords will have poor security for a significant fraction of the user population.
In contrast, your bank generates the password for you. This avoids the problems of user-generated passwords. A random 8-digit password has about 26.6 bits of entropy. That's not too shabby. For instance, if the attacker is rate-limited to 10 password guesses per account, then with your bank's scheme, the attacker can expect to break about 0.00001% of accounts. That is a significant improvement over user-generated passwords.
In contrast, password complexity policies are fragile. They help users avoid some bad passwords, but many other bad passwords are often accepted. Fundamentally, because the password policy checker has no visibility into how you chose your password, and because the how is the important part for calculating entropy, they are limited in their usefulness. For many sites, these limitations are acceptable, but I can understand why a banking site might want to do better.
One possible concern with your bank's scheme is that, if they don't implement any rate-limiting on password guessing, then an attacker who keeps trying all possible 8-digit passwords may eventually be able to guess your password. If the attacker can automate this process and try 10 passwords/second, then it should take about 115 days to exhaust the space. However, this kind of attack is easy to defend against: the bank can simply count the number of failed attempts at guessing the password and rate-limit guesses or impose some other defense against automated password-guessing.
Bottom line: Your bank's approach is actually more reasonable than it may seem. On the whole, it is probably more secure than allowing users to choose their own passwords -- especially if the bank applies good mechanisms to rate-limit password-guessing attacks.