The site does not allow the following characters: = ?<> ( ) ‘ " / \ &
It also limits maximum password length to 20 characters.
This makes me suspicious that they might be being stored in plain text and inputs aren't being sanitized properly. Is there any other reason for this type of restriction?
I don't think this is a duplicate of Why Disallow Special Characters In a Password? because this is a rather new website that doesn't (to my knowledge) need to integrate with any old financial systems.