Even if you remove registration from the critical path, you might still need a way for users to become members of your site. This necessity can create a classic usability problem, especially if you require an email address as the userid. However, you should always recommend that they choose a new and different password. Also, in usability testing, I've found that some users expect the system to create the password and then e-mail it to them. You should thus make it explicit that they must create their own while registering or you risk having users either get stuck or close their browser before completing their account set up.
Many websites have harsh requirements for password format.
I suggest that you relax the rules as much as possible. Obviously, a system for trading millions of dollars must be more secure than one that lets people read the daily news. If your rules are too strict, many users will not be able to use names and passwords that make sense to them. This increases the likelihood of users forgetting their login information the next time they visit. Nobody wants to log in again and again.