Where does SQL Server store the SA password and SQL Server password policy?
The sa user is a SQL Server login and its password is encrypted and stored in the DMV sys.sql_logins (Database Management View) in the master database.
Reference: sys.sql_logins (Transact-SQL)
You might notice that these views can only be found in the following branch:
Server | Databases | master | Views | System Views | .... 

The DMVs reference some system base tables, which can be accessed (but shouldn't):
Reference: System Base Tables
The policy you are looking for is built in to the code of SQL Server and is set per default for each new account. When creating a SQL Server Login you can decide to turn off the defaults:

To enforce password policy options for complexity and enforcement, select Enforce password policy. For more information, see Password Policy. This is a default option when SQL Server authentication is selected.

... via CHECK_POLICY=OFF. See the full syntax:
CREATE LOGIN login_name { WITH &lt;option_list1&gt; | FROM &lt;sources&gt; }  

&lt;option_list1&gt; ::=   
    PASSWORD = { 'password' | hashed_password HASHED } [ MUST_CHANGE ]  
    [ , &lt;option_list2&gt; [ ,... ] ]  

&lt;option_list2&gt; ::=    
    SID = sid  
    | DEFAULT_DATABASE = database      
    | DEFAULT_LANGUAGE = language  
    | CHECK_EXPIRATION = { ON | OFF}  
    | CHECK_POLICY = { ON | OFF}  
    | CREDENTIAL = credential_name   

&lt;sources&gt; ::=  
    WINDOWS [ WITH &lt;windows_options&gt;[ ,... ] ]  
    | CERTIFICATE certname  
    | ASYMMETRIC KEY asym_key_name  

&lt;windows_options&gt; ::=        
    DEFAULT_DATABASE = database  
    | DEFAULT_LANGUAGE = language  

Reference: CREATE LOGIN (Transact-SQL)
If the SQL Server is a member of a Windows Domain, then it will retrieve the password policy from Active Directory. Otherwise the defaults are:

Password complexity policies are designed to deter brute force attacks by increasing the number of possible passwords. When password complexity policy is enforced, new passwords must meet the following guidelines:

The password does not contain the account name of the user.
The password is at least eight characters long.
The password contains characters from three of the following four categories:
- Latin uppercase letters (A through Z)
- Latin lowercase letters (a through z)
- Base 10 digits (0 through 9)
- Non-alphanumeric characters such as: exclamation point (!), dollar sign ($), number sign (#), or percent (%).
Passwords can be up to 128 characters long. You should use passwords that are as long and complex as possible.


Reference: Password Policy