You can use ClaimsTransformations component with LookupValue transformation of B2C custom polices to enable and validate the custom banned password list. If the LookupValue transformation matches up with any one of the InputParameters, then the policy will return a claim with bannedPassword as true else it will return false.
You can find complete implementation in GitHub repository over here.