Edit: @[email protected] solved it. It says “one special character”. Not “at least one”.

  • OTP for 2FA has just started becoming common here (US) within the last decade I think. Each bank has its own separate app and many banks seem to limit password lengths to less than other websites.