This may be an aggregation / third party security requirement on their part.  This is not unusual.