First it tells me I need at least one uppercase, then this:
There really shouldn’t be restrictions on special characters or even spacings if that is what the customer thinks is a better password. It just doesn’t compromise on security. I hope Citibank realizes this.