The admin GUI allows creation of groups with '&' in the name but then won't let you delete them showing error:
"Failed to find com.atlassian.crowd.integration.model.RemoteGroup DirectoryID: 5963778 and name: POMG Strategy "
where group name is 'POMG Strategy & Planning'