December 26, 2000 **Conditional Approval #438**

### January 2001

Mr. R. Gregory Barton

The Vanguard Group

Post Office Box 2600

Valley Forge, Pennsylvania 19482-2600

Re: Application by the Vanguard Group, Inc. ("Vanguard") to charter a
national CEBA trust

bank with the title of Vanguard National Trust Company, National
Association, Valley

Forge, Pennsylvania

CAIS Control Number 2000-NE-01-0023

Dear Mr. Barton:

The Comptroller of the Currency ("OCC") has reviewed your application to
establish a new national CEBA trust bank with the title of Vanguard
National Trust Company, National Association ("Bank"). On December 26,
2000, after a thorough evaluation of all data available to the OCC, we
found that your proposal met the requirements for preliminary
conditional approval.

This approval is granted based on a thorough review of all information
available, including the representations and commitments made in the
application and by the proposed Bank's representatives. We also made our
decision to grant preliminary conditional approval with the
understanding that the proposed national bank will apply for membership
in the Federal Reserve System and will not be FDIC-insured.

This charter approval is subject to the following conditions:

1\. The Bank shall be limited to those activities described in the
application and conducted in

accordance with the representations made in the application.

2\. The Bank's initial Tier 1 capital, net of all organizational and
pre-opening expenses shall

be no less than \$2 million.

3\. At all times, the Bank shall maintain a minimum of \$2 million in
Tier 1 capital, and also

> shall maintain at all times capital that meets or exceeds the levels
> required under 12 C.F.R. 3 for an adequately capitalized bank.

4\. The Bank and Vanguard must enter into a written binding agreement
setting forth

> Vanguard's obligations to provide capital maintenance and liquidity
> support to the Bank, if and when necessary. The terms and provisions
> of this capital and liquidity maintenance agreement must be acceptable
> to the Bank and the OCC, and shall include a provision for collateral
> to support those obligations, if required by the OCC.

5\. The Bank shall obtain prior approval from the OCC's New York Field
Office before any

> significant deviation or change from the proposed operating plan
> occurs during the Bank's first three years of operation. The Bank must
> notify the New York Field Office at least sixty (60) days prior to any
> proposed significant deviation or change.

6\. The Bank, Vanguard, and the Vanguard Group of Investment Companies,
upon request

> by the OCC, shall provide the OCC access to, permit the OCC to
> examine, and provide the OCC with copies of all books and records,
> audit reports, and electronic records that accurately reflect the
> information in the books and records of the Bank, and any other
> information of, or concerning the Bank.

7\. All transactions between the Bank and any affiliates, domestic or
foreign, shall be

> conducted subject to the applicable provisions of 12 U.S.C. § 371c and
> c-1, or other applicable Federal law. The Board of Directors of the
> Bank annually shall review and approve the service agreements and any
> other transactions with domestic and foreign affiliates, including in
> particular any cost allocation, fee-sharing or tax-sharing provisions
> in such agreements or other transactions.

8\. The Bank must notify all potential vendors in writing of the OCC's
examination and

> regulatory authority under 12 U.S.C. § 1867(c). All final vendor
> contracts must stipulate that the performance of services provided by
> the vendors to the Bank is subject to the OCC's examination and
> regulatory authority. The provisions of 12 C.F.R. 9 would be
> applicable to any fiduciary activities contracted out to vendors.

Please be advised that the conditions of this approval are conditions
\"imposed in writing by the agency in connection with the granting of
any application or other request\" within the meaning of 12 U.S.C. §
1818 and, as such, are enforceable under 12 U.S.C. § 1818.

Please refer to the \"Corporate Organization\" booklet (enclosed) in the
*Comptroller's Corporate Manual* for the instructions on organizing the
Bank. The booklet contains all of the steps you must take to receive
your charter. As detailed in the booklet, you may establish the
corporate existence of and begin organizing the Bank as soon as you
adopt and forward acceptable Articles of Association and the
Organization Certificate to this office. As a \"body corporate\" or
legal entity, you may begin taking those steps necessary for obtaining
final approval, but you may not begin the business of banking until you
fulfill all requirements for a bank in organization and you are granted
final approval by the OCC.

Enclosed are standard requirements that must be met before the Bank will
be allowed to commence business. Management must ensure that the
applicable policies and procedures are established and adopted by the
board of directors before the Bank begins operation. Applicable standard
requirements also must be satisfied before the Bank will be allowed to
commence business. In addition to the standard requirements, the Bank
must meet the following requirements prior to opening:

1\. The Bank must submit to the OCC for review and approval a complete
description of

> the Bank's final information systems and operations architecture as
> well as the information systems risk assessment and management plan.
> This should include a schematic drawing and discussion of the
> following items:

vendors and vendor contracts; vendor management policy; security
policies;

security mechanisms; security testing plans; customer, vendor, and
employee

authentication; personnel; business resumption plans; internal controls;
and

internal audit plans.

2\. The Bank must have performed an independent security review and test
of its electronic

> banking platform. The scope of the review should encompass all access
> points, including the Internet, Intranet, or remote access. The Bank
> must have this review performed regardless of whether the platform is
> operated in-house or by one or more third-party service providers. If
> the Bank outsources the technology platform, it can rely upon testing
> performed for the service provider to the extent that it satisfies the
> scope and requirements listed herein. The review must be conducted by
> an objective, qualified, independent source (\"Reviewer\"). The scope
> must cover the adequacy of physical and logical protection against
> unauthorized internal and external access including individual
> penetration attempts, computer viruses, denial of service, and other
> forms of electronic access. By written report, the Reviewer must
> confirm that the security measures, including the firewall, have been
> satisfactorily implemented and tested. The report must critique the
> effectiveness of security policies and controls and confirm, with
> reasonable certainty, that unauthorized internal or external data and
> network access or access attempts will be detected and recorded. As
> part of its decision to grant final charter approval, the OCC will
> consider the results of the report as well as any subsequent actions
> by the Bank or service provider to implement any recommendations or to
> remedy any noted security or control deficiencies.

In addition, the Bank must comply with the OCC's regulation on Privacy
of Consumer Financial Information and the privacy requirements of the
Gramm-Leach-Bliley Act of 1999 ("GLBA"). Prior to or on the effective
date of the privacy provisions of GLBA, the Bank must disclose its
privacy policies and practices to its customers.

Please be aware that the trust officers and staff should become
thoroughly familiar with \"Fiduciary Powers of National Banks and
Collective Investments\" at 12 C.F.R. 9 and 12 C.F.R. 5.26. Management
is reminded that 12 C.F.R. 5.26 requires a national bank which already
has approval to engage in fiduciary activities to provide written notice
to the OCC when commencing fiduciary activities in a new state. Also, in
addition to the independent annual audit requirement referenced in the
standard requirements, the Bank will need to develop and implement a
fiduciary audit program as required by 12 C.F.R. 9.

The OCC poses no objection to the following persons serving as executive
officers and directors as proposed in the application.

John J. Brennan President/CEO/COB

R. Gregory Barton Director/SVP/General Counsel

Michael S. Miller Director/SVP

James H. Gately Director/SVP

F. William McNabb III Director/SVP

Ralph K. Packard Director/CFO

Raymond J. Klapinsky Director/SVP/Secretary

Ian A. MacKinnon Director/SVP

George U. Sauter Director/SVP

Richard D. Carpenter Treasurer

Richard W. Stevens SVP

Jack G. Brod SVP

Joseph F. Dietrick SVP

Donald R. Williams Trust Officer

Not all background checks requested by the OCC have been received yet.
Although we have decided not to delay action pending receipt of those
responses, the OCC may consider remedies available to it if adverse or
previously withheld information is received.

You are reminded that additional executive officers are subject to the
OCC's [prior]{.underline} review and clearance. Also, for a period of
two years after the Bank has opened for business, the OCC must review
and have no objection to any new executive officer or director prior to
that person assuming such position.

The OCC will send to you under separate cover an appropriate set of OCC
handbooks, manuals, issuances, and selected other publications.

Please direct any questions concerning this preliminary conditional
approval to Senior Licensing Analyst Sandya Reddy in the Northeastern
District Office at (212) 790-4055, or to me at (202) 874-5060.

Sincerely,

**-signed-**

Robert A. Sihler

Senior Licensing Analyst

Licensing Department

Enclosures: \"Corporate Organization\" Booklet

#### Minimum Policies and Procedures

> Standard Requirements