if a password expires every year, people are just going to use P@ssword2018, P@ssword2019 and so on...

You require new passwords every year, done Require symbols, done lower and uppercase, done numbers, done