I would cite an attempt to reduce customer service related issues. 

The larger and more complex passwords are, the higher the likelihood for the customer to enter an invalid password, get locked out and then contact customer service tying up that individual's time. 

It is amazing how many people are unable to accurately type a normal weak password, let alone a password that is a few characters longer or had to have an extra character or 2 injected for complexity. 

Possibly OT but, lengthy passwords are not necessarily a guaranteed true security measure since passwords are straight-out stolen on a fairly common basis nowadays. 

Failed login attempts and Tracking geo-distance from normal login usage is far more accurate metric. if an IP belonging to a known high hacking/attack profile country logs into an American bank and that login has never been used from that location before..... 

A lot of high profile places such as SF/banks generally have a very low failed login attempts count with resulting system-wide lockdowns. Some such as SF go as far as doing individual IP allocation, which means you can't log in from a new IP address without authorizing it.