I was finishing off a custom membership provider as part of a migration of code, and one of the requirements was to ensure that the login password in the membership provider matched the password strength requirements of the customers LDAP directory.  PasswordStrengthRegularExpression was the obvious way to do it.

After fussing around and trying to test it, I finally downloaded the SqlMembershipProvider source code, and found the missing part.

Override the OnValidatingPassword event, and use that event to validate the strength of the password

1. Validate MinRequiredPasswordLength
2. Validate MinRequiredNonAlphanumericCharacters
3. Validate PasswordStrengthRegularExpression.   (voila)

It's a pity, the sample ODBCMembershipProvider doesn't actually mention in the MSDN documentation that this should occur.