They should've given at least 3 month notice in advance for such a drastic change that could potentially get someone locked out.
Absolutely. Their Lawyer/Risk/Compliance person probably just noticed and went "oh fuck". With the short timeline they gave vs. compliance effect date, I hope it means they will have all hands on deck to support and work around the inevitable lockouts next month.
Did that weird worm seriously win again?!