CCASS/3

SEARCH UNDER CCASS/3

CCASS/3 stands for Central Clearing and Settlement System (also known as CCASS) which is a computerised securities clearing and settlement system developed and operated by Hong Kong Securities Clearing Company Limited (HKSCC).It provides browser based user interface via CCASS/3 Terminal (also known as C3T), straight-through-processing with direct linkage via Participant Gateway (PG) to facilitate CCASS Participants day-to-day operations. Clearing Participants (CPs) can also access risk functions via VaR Platform, please refer to the VaR Platform related FAQ for details.

What is C3T?

C3T (CCASS/3 Terminal) uses market standard Internet browser technology where Participants can access CCASS/3 (for services other than VaR Platform reports and functions) using any PC equipped with a support versions of Microsoft Windows and browser.On-line functions are presented in HTML (windows), which provides a more user-friendly interface.

What is PG?

PG is a device which facilitates direct linkage between the Participant Supplied System (PSS), the Participant’s back office system and CCASS/3. Using the PG access mode, CCASS/3 functions are performed by the transmission of standard messages. Transactions input to the PSS can be routed to CCASS/3 directly, without the need to re-input to CCASS/3 via C3T. Since PG supports straight-through-processing from PSS to CCASS/3, it is most useful for high volume data exchange where the same data already exist in PSS.

What is VaR Platform?

VaR Platform is risk engine for risk calculation, which is applicable to HKSCC Clearing Participants (CPs) only. VaR Platform offers risk related tools (1) Report Access Platform (RAP) for retrieval of VaR Platform reports and (2) VaR Online for margin and stress test simulation.

What is SDNet/2?

Securities and Derivatives Network (SDNet) is an integrated Optical Ethernet network infrastructure for supporting HKEX securities and derivatives trading, clearing and settlement, market data services.

What are the considerations for Participants to install PG in addition to C3T?

It very much depends on the operational needs of a Participant.As PG supports straight-through-processing from PSS to CCASS/3 (for services other than VaR Platform reports and functions), it is most useful for high volume data exchange where the same data already exist in PSS. Participants can evaluate their operational needs, the ability to develop and maintain the PG/PSS and the associated capital investment before installing PG.

Are there any restrictions on the number of C3T and PG to be installed in a Participant’s office?

There is no restriction on the number of C3T and PG to be installed in a Participant’s office.

Can a Participant access CCASS/3 by connecting the internal LAN in his office to the CCASS/3 network?

Yes, attaching C3Ts to an internal LAN which has connection with the CCASS/3 network is one way to access CCASS/3. However, Participants electing this access method should be aware of the need to implement Network Address Translation (NAT) when setting up their internal LAN. Each CCASS Participant is pre-assigned a range of IP addresses for defining his own C3Ts. CCASS/3 will validate the IP address when Participants attempt to logon CCASS/3 via C3T. When a Participant set up internal LAN in his office, the internal LAN may carry IP addresses different from the ones pre-assigned by HKSCC. Under such situation, Participant should implement NAT so that CCASS/3 is able to recognise the IP address assigned to the C3T. In addition, the NAT should be a one-to-one mapping of the C3T. That is, IP address of each C3T should be translated to a unique value within the original IP address range. Similarly for Clearing Participants to access RAP, a set of IP addresses should be pre-registered with HKSCC, where RAP will validate the IP addresses when Clearing Participants attempt to logon to RAP.

How can Participants connect to CCASS from their overseas offices?

There are two options to arrange the connection:

1.	Participants can access CCASS from their overseas office by extending their internal network in their Hong Kong office to their overseas office. The network connection arrangement will be transparent to HKEX and Participants may arrange by themselves.
2.	Alternatively, Participants may opt to access CCASS from their overseas office by directly connecting the network of their overseas office to the CCASS Network in Hong Kong. Feasibility of this alternative is subject to the availability of local network carrier in relevant overseas location which has service arrangement with the vendor of SDNet, the service provider of the CCASS Network in Hong Kong. Participants who opt for this alternative should provide detailed address of their overseas office to HKEX. HKEX would forward the case to the vendor of SDNet for checking and the vendor of SDNet would get back to Participants accordingly. Participants should note that they would subject to the charges levied by the overseas carrier if this alternative is elected.

Participants can access CCASS from their overseas office by extending their internal network in their Hong Kong office to their overseas office. The network connection arrangement will be transparent to HKEX and Participants may arrange by themselves.

Alternatively, Participants may opt to access CCASS from their overseas office by directly connecting the network of their overseas office to the CCASS Network in Hong Kong. Feasibility of this alternative is subject to the availability of local network carrier in relevant overseas location which has service arrangement with the vendor of SDNet, the service provider of the CCASS Network in Hong Kong. Participants who opt for this alternative should provide detailed address of their overseas office to HKEX. HKEX would forward the case to the vendor of SDNet for checking and the vendor of SDNet would get back to Participants accordingly. Participants should note that they would subject to the charges levied by the overseas carrier if this alternative is elected.

In either case, Participants need to acquire their own PC which can meet the CCASS Terminal configuration requirements.

How many user account can be issued for each Participant?

It depends on the number of user account each Participant required for operational needs, a one-off fee of HKD250.00 will be levied for each additional user account. Participants can apply for additional user account by submitting the eService Form – DA 4 “CCASS/ CCMS User Account Application Form” in Client Connect through HKEX Access Management Portal (https://connect.hkex.com.hk/).

If an operation user resigns from the company and his job is taken up by another user, is the Participant required to apply for additional user account?

It is not required to apply for additional user account as long as there is sufficient number of users for the Participant, the total number of users for each Participant can be viewed in “User Profile Listing” function in DMS. Participant can use “Delete User Profile” function in DMS to remove the resigned user, and use “Create User Profile” function to create user profile including assigning user ID to the new user.

What user is eligible to access CCASS by 2FA?

For users who have registered the designated email address in their user profile is eligible to access CCASS by 2FA. To register email for users, their DAs should input the email address of the user by “Change User Profile” function in Security Management Functions (DMS); to register email for DAs, Client Connect DAs/ users with EU_UserMaintenance access right should submit eService Form – DA 3 “CCASS/ CCMS Terminal Delegated Administrator Application/ Maintenance Form” in Client Connect through HKEX Access Management Portal (https://connect.hkex.com.hk/).

How to access CCASS with 2FA for first time login?

For first time login, user will have to enter user ID and a OTP received from the user’s registered email, then setup user’s login password. After that, user is required to setup OTP channel (i.e. from mobile application or email) to receive OTP for subsequent login.

How to access CCASS with 2FA for subsequent login?

For subsequent login, user is required to enter (i) User ID, (ii) Password, and (iii) OTP obtained from the registered OTP channel (i.e. mobile application or email).

What is the User ID of the user?

A unique user ID is assigned for each user and DA of a Participant, HKEX shall assign user ID for each DA of the Participant, while DAs shall assign user ID for their users. User ID is a eight-character code, of which the first six characters are identical to the Participant ID.

Can Participants assign operational staff as DA?

For better control purpose, it is recommended not to assign staff who are involving in CCASS operation as DA.

Can a Participant assign more than one checker or maker to handle the DA functions?

Yes. Participants can assign more than one checker or maker as DA according to their internal control requirements.

What is the main difference between the functions of a DA maker & a DA checker?

When maintaining (changing/deleting) user profile, a maker inputs the details of the user profile while a checker authorizes the details. Both input and authorization are required when updating a user profile.

Is there a transaction limit assigned to each C3T DA?

Transaction limit is not applicable to the C3T DA functions.

If a C3T DA checker wrongly inputs the checker ID three times, will the DA authorization code be revoked?

No. DA authorization code is generated by CCASS/3 and will not be revoked by a C3T DA checker.However, if a C3T DA checker input an incorrect authorization code and attempted to confirm the transaction for three times, relevant C3T DA maker’s account will be disabled.Under such situation, the Participant should apply to HKEX to re-activate the C3T DA maker’s account.

Are C3T DA checkers required to memorize the authorization code?

C3T DA checkers can either memorize the authorization code for convenience purpose or obtain the code via on-line enquiry function whenever needed.

How often will the authorization code be changed for C3T access?

The authorization code will be changed by C3T on the first day of each month.

If the C3T DA resets the password for a user, is the user concerned required to change the password at the first log-on?

Yes, the user should change the password during the first log-on for maximum protection.

Can user access to CCASS by 2FA if the account is locked?

Access will be locked after 5 consecutive unsuccessful attempts of login within 30 minutes, while 3 consecutive unsuccessful attempts of entering OTP will be counted to 1 unsuccessful attempt of login.

Once the user’s account is locked, he/ she cannot access to CCASS by 2FA. To unlock user’s account, their DAs to perform “Unlock/ Reset OTP Device Registration function” in DMS; to unlock DA’s account, Participant should notify HKEX to perform “Unlock/ Reset OTP Device Registration” for its DA by submitting the eService – DA 3 “CCASS/ CCMS Delegated Administrator Application/ Maintenance Form” in Client Connect through HKEX Access Management Portal (https://connect.hkex.com.hk/).

When a C3T DA set up a user profile, is it compulsory for the C3T DA to input the “enabled date” and “disabled date”?

No, “enable date” and “disabled date” are not compulsory input fields. Input to such data fields is only necessary when a Participant wants to specify an effective date that a user account will be activated or deactivated.

What is BIC used for?

With CCASS/3, when Participants execute CCASS transactions, they can identify themselves by specifying (1) their Participant ID; or (2) their BIC as an alternative. BIC will be applied in two situations in general:

1.	The data field “Sender BIC” in the file header of all upload files serves as an alternative to the “Participant ID” data field.
2.	The data field “Counterparty BIC” in the detailed record of SI/ISI (both on-line screen and upload file) serves as an alternative to the “Counterparty ID” data field.

Should BIC be specified in the file header of all upload files?

BIC will serve as an alternative to Participant ID. In the case of file header, Participants can specify either the Participant ID or the Sender BIC. In the case of SI/ISI detailed transaction, Participants can specify either the Counterparty ID or the Counterparty BIC.

Should all Participants provide their BIC to HKSCC? Can a Participant use his BIC to perform CCASS functions without providing such information to HKSCC?

All Participants are encouraged to provide their BIC to HKSCC. As mentioned earlier, BIC may be used under 2 situations: a Participant can identify himself to CCASS by specifying his BIC, or a Participant can identify his SI/ISI counterparty to CCASS by specifying the BIC. If a Participant does not provide his BIC to HKSCC, he will not be able to use this alternative to perform CCASS functions. Also, his SI/ISI counterparts may fail to input SI/ISI using this alternative, which may in turn affect the matching result.

Will CCASS validate both CCASS Participant ID and BIC?

Participants must input either the Participant ID or the BIC (or both) for CCASS to accept a relevant file/record. And CCASS will validate both the Participant ID and the BIC, if being input. The transaction will be rejected if (1) either Participant ID or BIC is invalid; or (2) they are not referring to the same Participant.

Is it compulsory to specify the ISIN code in the upload files?

No, Participants can specify either the Stock Code or the ISIN (or both) in upload files.

Will there be any validation on both stock and ISIN code if both are input in a transaction?

If both Stock Code and ISIN are input in a transaction, CCASS will validate to ensure that both codes are valid and refer to the same stock. Otherwise, the transaction will be rejected.

When will the uploaded SI / ISI files be validated by CCASS/3?

SI / ISIs files uploaded to CCASS/3 will be validated on an ad hoc basis. Subject to the size of the upload file, Participants will receive their SI / ISI Batch Input Control Reports shortly after they have uploaded their SI / ISI files. The ad hoc validation process will allow more time for Participants to rectify their SI/ISI transactions if necessary.

For SI validation, will CCASS/3 validate a SI if its relevant counterparty is yet to input the opposite SI?

CCASS/3 will validate any SI file uploaded to the system, regardless of whether the relevant counterparty has input an opposite SI or not.

How do Participants verify the correctness of their Back office System (BOS) regarding their upload files and/or report data download files?

Participants should follow the detailed specifications provided by HKEX to develop / modify their BOS for the generation of upload files or the process of report data download files with reference to the specified format. The specified format and samples files are available in HKEX website.

Can Participants use MS Word to read report data file downloaded from C3T or PG?

C3T or PG report data files are pure ASCII files (not MS-word document files). Therefore Participants are recommended to use “Notepad” (Window accessories software) to view and print the report data files instead of using MS word.