Most financial services companies that I've come across who make use of this kind of system are encrypting the password using a Hardware Security Module ("HSM").
In this kind of system the password is symetrically encrypted with a key held in the HSM, and then stored on disk. The application will then pass the encrypted password and the individual characters into the HSM which will decrypt the password, make the comparison with the supplied characters and return a true/false answer to the application.
The security of this kind of system relies on the intended properties of the HSM which should be resistent to tampering and which run a very limited number of functions to reduce attack surface.
Also in this kind of situation key management is obviously very important as compromise of the key would allow for easy access to all customer passwords. This tends to lead to split authority and key parts being stored in safes, as a backup for the HSM.