That’s inherently blocking pseudo random password generators.

Max length doesn’t bother me if it’s at least 128 characters, but only allowing specific special characters is a sin.

As of last year, Wells Fargo’s passwords were even cause insensitive. Dunno if they’ve fixed it since then, but probably not