# O

+-----------------------------------------------------------------------+
| ## Comptroller of the Currency                                        |
|                                                                       |
| > Administrator of National Banks                                     |
+-----------------------------------------------------------------------+

Southeastern District

Marquis One Tower, Suite 600

245 Peachtree Center Ave., NE

Atlanta, Georgia 30303

September 13, 2002 **Conditional Approval #550**

#### October 2002

Mr. Guy D. Colado

Spokesperson

Commerce National Bank of Florida (Proposed Charter)

1201 South Orlando Avenue, Suite 370

Winter Park, Florida 32789

Re: Application for a de novo Charter

Commerce National Bank of Florida (Proposed Charter), Winter Park,
Florida

Control No. 2002-SE-01-0006

Dear Mr. Colado:

The Office of the Comptroller of the Currency (OCC) has reviewed your
application to establish a new national bank with the title of
**Commerce National Bank of Florida**. On this date we found that your
proposal met the requirements for preliminary conditional approval.

This conditional approval is granted based on a thorough review of all
information available, including the representations and commitments
made in the application and by the proposed bank's representatives. We
also made our decision to grant preliminary conditional approval with
the understanding that the proposed national bank will apply for
membership in the Federal Reserve System and obtain FDIC insurance.

This preliminary conditional approval is subject to the following two
conditions:

1)  The bank: (i) shall give the North Florida Field Office
    (Jacksonville) at least sixty (60) days prior written notice of the
    bank's intent to significantly deviate or change from its business
    plan or operations[^1] and obtain the OCC's nonobjection before any
    significant deviation or change occurs and (ii) shall obtain the
    OCC's written determination of no objection before the bank engages
    in any significant deviation or change from its business plan or
    operations. For the first three years of operations, the bank also
    must also provide a copy of such written notice to the FDIC's
    Atlanta Regional Supervisory Office.

Mr. Guy Colado

September 13, 2002

Page 2

2)  The bank shall, if required by the Assistant Deputy Comptroller,
    North Florida Field Office, establish a single Chief Financial
    Officer (CFO) position and hire a qualified individual satisfactory
    to the OCC to fill the position.

These conditions of approval are "imposed in writing by the agency in
connection with the granting of any application or other request" within
the meaning of 12 USC 1818. As such, these conditions are enforceable
under 12 USC 1818.

We have no objection to your plans for managing the bank's operations.
In order to control risks with the CFO arrangement we impose the
following requirements, which will be reviewed during the preopening
examination.

1)  The bank\'s Internal Control Policy and Procedures shall
    specifically address effective controls necessary to minimize risk
    from the proposed shared CFO function.

2)  The Board of Directors shall adopt an internal and external audit
    program that provides adequate coverage, including frequency and
    scope of activities, to assess internal control risk directly
    associated with the shared CFO function.

The OCC has granted preliminary conditional approval only. Final
approval will not be granted until and unless the Federal Reserve Board
acts favorably on your application with them to acquire this new bank.
You must furnish the OCC's Southeastern District Office with a copy of
all related filings to the Federal Reserve, including registration
material.

Until final approval is granted, the OCC has the right to alter,
suspend, or revoke preliminary approval should any interim development
be deemed by the OCC to warrant such action.

The bank's initial paid-in capital, net of organizational and preopening
expenses, shall be no less than \$6,500,000. The manner in which capital
is raised must not deviate from that described in the operating plan
without prior OCC notification. If the capital for the new bank is not
raised within 12 months or if the new bank is not opened for business
within 18 months from the preliminary conditional approval date, the OCC
will withdraw approval. The OCC is opposed to granting extensions,
except under the most extenuating circumstances and when the OCC
determines that the delay is beyond the applicant's control. The
organizers are expected to proceed diligently, consistent with their
application, for the bank to open for business as soon as possible.

Please refer to the "Corporate Organization" booklet (enclosed) of the
*Comptroller's* *Corporate Manual* for the instructions on organizing
your bank. The booklet contains all of the steps you must take to
receive your charter. As detailed in the booklet, you may establish the
corporate

Mr. Guy Colado

September 13, 2002

Page 3

existence of and begin organizing the bank as soon as you adopt and
forward acceptable Articles of Association and the Organization
Certificate to this office. As a "body corporate" or legal entity, you
may begin taking those steps necessary for obtaining final approval, but
you may not begin the business of banking until you fulfill all
requirements for a bank in organization and you are granted final
approval by the OCC.

After reading the instructions for the organization of a new national
bank, it is suggested that the spokesperson or a designated
correspondent visit the District Office to discuss the organizing
process. We feel such a visit can save time and prevent some of the
pitfalls that have delayed or prevented other banks from opening.

Enclosed are standard requirements that must be met before the bank will
be allowed to commence business. Management must ensure that the
applicable policies and procedures are established and adopted by the
board of directors before the bank begins operation.

This Office has no objection to the following persons serving as
executive officers and directors as proposed in the application and as
indicated below. Additional executive officers and directors are subject
to the [prior]{.underline} review and clearance of the OCC.

> [NAME]{.underline} [POSITION]{.underline}
>
> Guy D. Colado President/CEO and Director
>
> Russell Barkett Director
>
> Francis William Bryan Director
>
> Ray D. Colado Director
>
> Jennifer Ann France Director
>
> Mary L. Demetree Director
>
> Jane H. Louttit Director

You are also reminded that for a period of two years after the bank has
opened for business, the OCC must review and have no objection to any
new executive officer or director prior to that person assuming such
position.

The OCC will send to you under separate cover an appropriate set of OCC
handbooks, manuals, issuances, and selected other publications.

In addition to the Standard Requirements for all new national banks, the
following requirements must be satisfied prior to the bank's request for
a preopening examination and before the OCC will grant final charter
approval:

Mr. Guy Colado

September 13, 2002

Page 4

1)  The bank must submit to the North Florida Field Office for review
    and approval a complete description of the bank's final information
    systems and operations architecture as well as the information
    systems risk assessment and management plan. This should include a
    schematic drawing and discussion of the following items:

Vendor due diligence and contracts; electronic banking security
mechanisms and policies; information systems personnel; internal
controls; audit plans; and operating policies and procedures, including,
but not limited to, vendor management, weblinking, customer
authentication and verification, and business resumption contingency
plans.

2)  The bank must have performed an independent security review and test
    of its electronic banking platform. The bank must have this review
    performed regardless of whether the platform is operated in-house or
    by one or more third-party service providers. If the bank outsources
    the technology platform, it can rely on testing performed for the
    service provider to the extent that it satisfies the scope and
    requirements listed herein. The review must be conducted by an
    objective, qualified independent source (Reviewer). The scope should
    cover:

-   All access points, including the Internet, Intranet, or remote
    access.

```{=html}
<!-- -->
```
-   The adequacy of physical and logical protection against unauthorized
    access including individual penetration attempts, computer viruses,
    denial of service, and other forms of electronic access.

    By written report, the Reviewer must confirm that the security
    measures, including the firewall, have been satisfactorily
    implemented and tested. For additional guidance, see "The Internet
    and the National Bank Charter" booklet of the *Comptroller's
    Corporate Manual*, pages 37-38, 74-75. The booklet may be found at
    the Publications section of the OCC's web site: www.occ.treas.gov.

3)  The bank must have a security program in place that complies with
    the "Interagency Guidelines Establishing Standards for Safeguarding
    Customer Information" specified at 12 C.F.R. 30, Appendix B.

This preliminary conditional approval, and the activities and
communications by OCC employees in connection with the filing, do not
constitute a contract, express or implied, or any other obligation
binding upon the OCC, the United States, any agency or entity of the
United States, or any officer or employee of the United States, and do
not affect the ability of the OCC to exercise its supervisory,
regulatory and examination authorities under applicable law and
regulations. The foregoing may not be waived or modified by any employee
or agent of the OCC or the United States.

Mr. Guy Colado

September 13, 2002

Page 5

Any questions concerning this preliminary conditional approval should be
directed to Licensing Analyst Valerie Richards at (404) 588-4525.

Sincerely,

**-signed-**

John O. Stein, II

Licensing Manager

Enclosures: Standard Requirements

> Minimum Policies and Procedures

[^1]: ^1^ If such deviation is the subject of an application filed with
    the OCC, no separate notice to the supervisory office is required.