**Conditional Approval #659**

**November 2004**

October 15, 2004 By facscimile: 301.229.2443

and regular mail.

David Baris, Esq

Partner

Kennedy, Baris & Lundy

4701 Sangamore Road, Suite P 15

Bethesda, MD 20816

Re: OAKAR-- Transaction by WashingtonFirst Bank, ("WFB "), Washington,
D.C., to purchase certain assets and assume certain liabilities of the
Washington, D.C. branch of Greater Atlantic Bank, ("GAB"), Reston,
Virginia

Control No.: 2004-NE-02-0038 Charter No.: 24464

Dear Mr. Baris:

[]{.mark}

This is to inform you that today, the Office of the Comptroller of the
Currency ("OCC")

granted conditional approval to WFB's proposal to purchase certain
assets and assume certain liabilities of the 1025 Connecticut Avenue
Branch of Greater Atlantic Bank located in Washington, D.C.

This conditional approval is granted based on a thorough review of all
information available, including commitments and representations made in
the application, by representatives of the bank, in the merger
agreement, or in any subsequent correspondence.

Upon H.R. 3797 (\"2004 District of Columbia Omnibus Authorization Act\")
becoming law, OCC jurisdiction over WFB terminates, including OCC
jurisdiction to grant final approval of this application. 

This conditional approval is subject to the following conditions:

\(1\) The Bank will maintain Tier 1 capital of eight percent (8%) for
the first three (3)

years of operation.

(2) For a period of two years after the Bank has opened for business,
    the OCC must review and express no supervisory objection to any new
    executive officer or director prior to that person assuming such
    position. The proposed individual may not assume the position until
    the OCC has issued a letter of no supervisory objection. The Bank
    agrees that the OCC's review under this Article is not subject to
    the thirty (30) day review period imposed by 12 U.S.C. § 1831i.
    However, the OCC will process all such notices in a timely manner.

(3) The Bank's financial statements shall be prepared on an accrual
    basis according to

> generally accepted accounting principles.

\(4\) The Board shall maintain safety and soundness policies and
procedures acceptable to the OCC, and ensure Bank adherence to them. On
a regular basis, the Board shall review these policies and procedures
and shall make changes, as warranted, to address any deficiencies noted
in the review and to ensure that the Bank continues to operate in a safe
and sound manner. The Bank shall provide the OCC with a copy of the
revised policies and procedures.

(5) If the bank has not already done so, the Bank shall comply with each
    paragraph below.

    a.  The Bank shall submit to the OCC a complete description of the
        Bank's

final information systems and operations architecture, and the
information systems risk assessment and management plan for review and
determination of supervisory non-objection. This description shall
include, at a minimum, a schematic drawing and a discussion of:

(i) third-party service provider due diligence and contracts;

> \(ii\) electronic banking security mechanisms and policies;
>
> \(iii\) information systems personnel;
>
> \(iv\) internal controls;
>
> \(v\) audit plans; and
>
> \(vi\) operating policies and procedures, including, but not limited
> to:
>
> \(1\) management of third-party service providers:
>
> \(2\) web linking;
>
> \(3\) customer authentication and verification; and
>
> \(4\) business resumption contingency plans.

a.  The Bank shall have performed an independent security review and
    test of its electronic banking platform. The Bank shall have this
    review performed regardless of whether the platform is operated
    in-house or by one or more third-party service providers. If the
    Bank outsources the technology platform, it can rely on testing
    performed for the service provider to the extent that it satisfies
    the scope and requirements listed herein. The review must be
    conducted by an objective, qualified independent source
    ("Reviewer"). The scope of the review shall address, at a minimum,
    the following:

```{=html}
<!-- -->
```
(i) all access points, including the Internet, Intranet, or remote
    access; and

> \(ii\) the adequacy of physical and logical protection against
>
> unauthorized access including individual penetration attempts;
> computer viruses; denial of service; and other forms of electronic
> access.

The Reviewer must complete a written report in which it is confirmed
that the security measures, including the firewall, have been
satisfactorily implemented and tested.

a.  The Board shall establish and thereafter ensure Bank adherence to a
    security program that complies with the "Interagency Guidelines
    Establishing Standards for Safeguarding Customer Information," 12
    C.F.R. 30, Appendix B.

```{=html}
<!-- -->
```
(6) Within 30 days of this approval, the bank must submit to the OCC a
    business plan acceptable to the OCC. After acceptance by the OCC,
    the Bank (i) shall give the OCC at least sixty (60) days prior
    written notice of the Bank's intent to significantly deviate or
    change from its business plan or operations and (ii) shall obtain
    the OCC's written determination of no objection before the Bank
    engages in any significant deviation or change from its business
    plan or operations.[^1] The OCC may impose additional conditions it
    deems appropriate in a written determination of no objection to the
    Bank's notice. For the first three (3) years of operation, the Bank
    must also provide a copy of such notice to the FDIC.

These conditions are conditions "imposed in writing by the agency in
connection with the granting of any application or other request" within
the meaning of 12 U.S.C. § 1818. As such, these conditions are
enforceable under 12 U.S.C. § 1818.

This Office must be advised in writing 10 days in advance of the desired
effective date for the transaction so that the OCC may issue the
necessary certification letter. The effective date must follow the
applicable Department of Justice injunction period and any other
required regulatory approval.

The OCC will issue a letter certifying consummation of the transaction
when we have received:

1)  A Secretary's Certificate for both banks, certifying that a majority
    of the board of directors approved the transaction, if not
    previously provided.

2)  An executed purchase and assumption agreement, if not previously
    provided.

If the purchase and assumption is not consummated within one year from
the conditional approval date, the approval shall automatically
terminate, unless the OCC grants an extension of the time period.

This conditional approval, and the activities and communications by OCC
employees in connection with the filing, do not constitute a contract,
express or implied, or any other obligation binding upon the OCC, the
U.S., any agency or entity of the U.S., or any officer or employee of
the U.S., and do not affect the ability of the OCC to exercise its
supervisory, regulatory and examination authorities under applicable law
and regulations. The foregoing may not be waived or modified by any
employee or agent of the OCC or the U.S.

If you have any questions, please contact me at 212-790-4055.

Sincerely,

/s/ Anthony P. DosSantos

Anthony P. DosSantos

Licensing Manager

[^1]: If such deviation is the subject of an application filed with the
    OCC, the OCC does not require any further notice to the supervisory
    office.