When creating new account it accepts password outside password policy scope
Did You know that if You will specify password with more than 20 characters during account creation, You will not get error to input less. But then You will not be able to login until You reset with password which will match the policy.