Custom password rules needed for previously used passwords & expiration

Hi Community Members,

Our team has just developed some custom password features so that we meet the company's password complexity guidelines. Thus far, we have been able to ensure that the below points are taken care of:

Has minimum of eight (8) characters
Has an uppercase and a lowercase letter
Has at least one (1) number
Has at least one special character

However, there are two remaining rules we are looking to also meet:

All user passwords expire after ninety (90) days
Users prevented from choosing ten (10) previously used passwords

Does anyone know the best approach to make sure we are compliant with those remaining (2) items?