Clearing and Settlement

SEARCH UNDER Clearing and Settlement

CCASS/3 stands for Central Clearing and Settlement System (also known as CCASS) which is a computerised securities clearing and settlement system developed and operated by Hong Kong Securities Clearing Company Limited (HKSCC).It provides browser based user interface via CCASS/3 Terminal (also known as C3T), straight-through-processing with direct linkage via Participant Gateway (PG) to facilitate CCASS Participants day-to-day operations. Clearing Participants (CPs) can also access risk functions via VaR Platform, which provides tools including Report Access Platform (RAP) and VaR Online to facilitate CPs to conduct risk monitoring and control.

Does C3T, PG, RAP or VaR Online support broad band communication?

Yes. Participants can subscribe to the highest CCASS/3 WAN connection line speed. The network bandwidth can reach up to 2M capacity for the WAN connection.

Are C3T, PG, RAP and VaR Online using the same hardware configuration?

The hardware configuration of C3T, PG, RAP and VaR Online varies, please refer to Technical Guides available in Client Connect (https://connect.hkex.com.hk) for more details.

Can CPs access CCASS, RAP and VaR Online on the same Terminal?

HKSCC CPs should access CCASS, RAP and VaR Online via SDNet, while CPs can only access RAP with designated RAP client workstations by registering the corresponding ip address (es) with HKSCC by submitting the RAP Registration and Maintenance for HKSCC or HKCC/SEOCH or Share Registrar form (eServices: TechS 8) via Client Connect (https://connect.hkex.com.hk/).

What is the backup arrangement for C3T, PG, RAP or VaR Online in the event that either system fails?

For RAP or VaR Online failure, Clearing Participants can rely on CCASS to receive HKSCC notifications, and retrieve CCASS reports for their collateral requirement and payment of risk obligations for funding preparation accordingly.

For C3T or PG failure, participants can utilise the backup center services provided by HKEX in case they cannot access via C3T at their offices. For PG failure, Participants may subscribe for dual PG to improve service availability, or use C3T as a backup for business contingency.

Is there any file format differences between C3T and PG?

Upload/download batch files format for C3T and PG are different. C3T uses the existing text based format while PG uses ISO compliant (or Tag-based) format.

What is the software configuration required for C3T, RAP and VaR Online?

Please note that HKEX will revise the compatible platform for C3T, RAP and VaR Online from time to time, Participants should refer to Technical Guides available in Client Connect (https://connect.hkex.com.hk) for the detailed software configuration.

Can Participants open multiple browsers on the same C3T?

No. Participants should open only one browser on a C3T. If Participants open multiple browsers on the same C3T, these browsers could interfere with each other and cause processing errors.

If a Participant wants to install more than one C3T, are multiple network lines required?

Subject to the line speed, a single network line can support multiple C3Ts. In other words, a Participant can install multiple C3Ts in the same office using the same network line.

Can Participants install non-CCASS/3 related software in C3T?

Participants may install common applications such as MS Word, Excel in C3T provided that the PC meets at least the minimum system configuration to run a C3T. However, Participants are not recommended to install other custom-built applications in C3T.

Can Participants install the C3T in their overseas offices?

Yes, Participants can install the C3T in their overseas offices with HKSCC’s prior written approval. According to General Rules of CCASS (“CCASS Rules”) 3901, any Participant that wishes to install or to access and operate CCASS from a foreign jurisdiction must obtain HKSCC’s prior written approval. Participants should also obtain from a reputable law firm of a foreign jurisdiction a legal opinion issued in favour of HKSCC for the CCASS operation and the placement of the CCASS Terminal in a foreign jurisdiction in accordance with CCASS Rules 3904. For the details of access to CCASS from a foreign jurisdiction, please refer to CCASS Rules Chapter 39 (http://www.hkex.com.hk/-/media/HKEX-Market/Global/Exchange/FAQ/Securities-Market/Clearing-and-Settlement/CCASS-3/Can-Participants-install-the-C3T-in-their-overseas-offices/r39.pdf?la=en).

What is the security measure for Participant to log on CCASS/3, RAP and VaR Online?

Access to CCASS will be authenticated by 2-Factor Authentication (2FA) with regular password and One-Time Password (OTP) generated from the ForgeRock Authenticator App or email; access to RAP will be authenticated by Secure Shell (SSH) private-key authentication; access to VaR Online will be authenticated by 2FA.

What is PG operating hour? Is it different to those for C3T?

CCASS/3 functions available via PG will follow C3T function time schedule as specified in Section 7.2 of CCASS Terminal User Guide for Participants: https://connect.hkex.com.hk

PG Server serves as the message routing conduit between your PSS and CCASS/3 backend. Production PG Server would be located at Participants’ office premises and your operation team should make sure that the PG Server is signed on / off from CCASS/3 when necessary. In general, we suggest PG Server to perform smart card sign on/off on a weekly basis, while PSS should perform daily logon to CCASS through PG-API before submitting transactions.

What is CCASS/3?

CCASS/3 stands for Central Clearing and Settlement System (also known as CCASS) which is a computerised securities clearing and settlement system developed and operated by Hong Kong Securities Clearing Company Limited (HKSCC).It provides browser based user interface via CCASS/3 Terminal (also known as C3T), straight-through-processing with direct linkage via Participant Gateway (PG) to facilitate CCASS Participants day-to-day operations. Clearing Participants (CPs) can also access risk functions via VaR Platform, please refer to the VaR Platform related FAQ for details.

What is C3T?

C3T (CCASS/3 Terminal) uses market standard Internet browser technology where Participants can access CCASS/3 (for services other than VaR Platform reports and functions) using any PC equipped with a support versions of Microsoft Windows and browser.On-line functions are presented in HTML (windows), which provides a more user-friendly interface.

What is PG?

PG is a device which facilitates direct linkage between the Participant Supplied System (PSS), the Participant’s back office system and CCASS/3. Using the PG access mode, CCASS/3 functions are performed by the transmission of standard messages. Transactions input to the PSS can be routed to CCASS/3 directly, without the need to re-input to CCASS/3 via C3T. Since PG supports straight-through-processing from PSS to CCASS/3, it is most useful for high volume data exchange where the same data already exist in PSS.

What is VaR Platform?

VaR Platform is risk engine for risk calculation, which is applicable to HKSCC Clearing Participants (CPs) only. VaR Platform offers risk related tools (1) Report Access Platform (RAP) for retrieval of VaR Platform reports and (2) VaR Online for margin and stress test simulation.

What is SDNet/2?

Securities and Derivatives Network (SDNet) is an integrated Optical Ethernet network infrastructure for supporting HKEX securities and derivatives trading, clearing and settlement, market data services.

What are the considerations for Participants to install PG in addition to C3T?

It very much depends on the operational needs of a Participant.As PG supports straight-through-processing from PSS to CCASS/3 (for services other than VaR Platform reports and functions), it is most useful for high volume data exchange where the same data already exist in PSS. Participants can evaluate their operational needs, the ability to develop and maintain the PG/PSS and the associated capital investment before installing PG.

Are there any restrictions on the number of C3T and PG to be installed in a Participant’s office?

There is no restriction on the number of C3T and PG to be installed in a Participant’s office.

Can a Participant access CCASS/3 by connecting the internal LAN in his office to the CCASS/3 network?

Yes, attaching C3Ts to an internal LAN which has connection with the CCASS/3 network is one way to access CCASS/3. However, Participants electing this access method should be aware of the need to implement Network Address Translation (NAT) when setting up their internal LAN. Each CCASS Participant is pre-assigned a range of IP addresses for defining his own C3Ts. CCASS/3 will validate the IP address when Participants attempt to logon CCASS/3 via C3T. When a Participant set up internal LAN in his office, the internal LAN may carry IP addresses different from the ones pre-assigned by HKSCC. Under such situation, Participant should implement NAT so that CCASS/3 is able to recognise the IP address assigned to the C3T. In addition, the NAT should be a one-to-one mapping of the C3T. That is, IP address of each C3T should be translated to a unique value within the original IP address range. Similarly for Clearing Participants to access RAP, a set of IP addresses should be pre-registered with HKSCC, where RAP will validate the IP addresses when Clearing Participants attempt to logon to RAP.

How can Participants connect to CCASS from their overseas offices?

There are two options to arrange the connection:

1.	Participants can access CCASS from their overseas office by extending their internal network in their Hong Kong office to their overseas office. The network connection arrangement will be transparent to HKEX and Participants may arrange by themselves.
2.	Alternatively, Participants may opt to access CCASS from their overseas office by directly connecting the network of their overseas office to the CCASS Network in Hong Kong. Feasibility of this alternative is subject to the availability of local network carrier in relevant overseas location which has service arrangement with the vendor of SDNet, the service provider of the CCASS Network in Hong Kong. Participants who opt for this alternative should provide detailed address of their overseas office to HKEX. HKEX would forward the case to the vendor of SDNet for checking and the vendor of SDNet would get back to Participants accordingly. Participants should note that they would subject to the charges levied by the overseas carrier if this alternative is elected.

Participants can access CCASS from their overseas office by extending their internal network in their Hong Kong office to their overseas office. The network connection arrangement will be transparent to HKEX and Participants may arrange by themselves.

Alternatively, Participants may opt to access CCASS from their overseas office by directly connecting the network of their overseas office to the CCASS Network in Hong Kong. Feasibility of this alternative is subject to the availability of local network carrier in relevant overseas location which has service arrangement with the vendor of SDNet, the service provider of the CCASS Network in Hong Kong. Participants who opt for this alternative should provide detailed address of their overseas office to HKEX. HKEX would forward the case to the vendor of SDNet for checking and the vendor of SDNet would get back to Participants accordingly. Participants should note that they would subject to the charges levied by the overseas carrier if this alternative is elected.

In either case, Participants need to acquire their own PC which can meet the CCASS Terminal configuration requirements.

How many user account can be issued for each Participant?

It depends on the number of user account each Participant required for operational needs, a one-off fee of HKD250.00 will be levied for each additional user account. Participants can apply for additional user account by submitting the eService Form – DA 4 “CCASS/ CCMS User Account Application Form” in Client Connect through HKEX Access Management Portal (https://connect.hkex.com.hk/).

If an operation user resigns from the company and his job is taken up by another user, is the Participant required to apply for additional user account?

It is not required to apply for additional user account as long as there is sufficient number of users for the Participant, the total number of users for each Participant can be viewed in “User Profile Listing” function in DMS. Participant can use “Delete User Profile” function in DMS to remove the resigned user, and use “Create User Profile” function to create user profile including assigning user ID to the new user.

What user is eligible to access CCASS by 2FA?

For users who have registered the designated email address in their user profile is eligible to access CCASS by 2FA. To register email for users, their DAs should input the email address of the user by “Change User Profile” function in Security Management Functions (DMS); to register email for DAs, Client Connect DAs/ users with EU_UserMaintenance access right should submit eService Form – DA 3 “CCASS/ CCMS Terminal Delegated Administrator Application/ Maintenance Form” in Client Connect through HKEX Access Management Portal (https://connect.hkex.com.hk/).

How to access CCASS with 2FA for first time login?

For first time login, user will have to enter user ID and a OTP received from the user’s registered email, then setup user’s login password. After that, user is required to setup OTP channel (i.e. from mobile application or email) to receive OTP for subsequent login.

How to access CCASS with 2FA for subsequent login?

For subsequent login, user is required to enter (i) User ID, (ii) Password, and (iii) OTP obtained from the registered OTP channel (i.e. mobile application or email).

What is the User ID of the user?

A unique user ID is assigned for each user and DA of a Participant, HKEX shall assign user ID for each DA of the Participant, while DAs shall assign user ID for their users. User ID is a eight-character code, of which the first six characters are identical to the Participant ID.

Can Participants assign operational staff as DA?

For better control purpose, it is recommended not to assign staff who are involving in CCASS operation as DA.

Can a Participant assign more than one checker or maker to handle the DA functions?

Yes. Participants can assign more than one checker or maker as DA according to their internal control requirements.

Will separate set of smartcards be issued to CCASS Terminal DA maker and checker?

Yes, separate set of smartcards will be issued to CCASS Terminal DA makers and checkers. CCASS Terminal DAs cannot perform security management functions with those smartcards issued to other operational staff.

What is the main difference between the functions of a DA maker & a DA checker?

When maintaining (changing/deleting) user profile, a maker inputs the details of the user profile while a checker authorizes the details. Both input and authorization are required when updating a user profile.

In what situation should a CCASS Terminal DA checker use the smartcard to logon CCASS Terminal?

Depending on the administration rights assigned to him, a CCASS Terminal DA checker will use the smartcard to log on CCASS Terminal and enquire user profile, view listings & maintenance report, get authorization code and reset smartcard password.

Is there a transaction limit assigned to each C3T DA?

Transaction limit is not applicable to the C3T DA functions.

If a C3T DA checker wrongly inputs the checker ID three times, will the DA authorization code be revoked?

No. DA authorization code is generated by CCASS/3 and will not be revoked by a C3T DA checker.However, if a C3T DA checker input an incorrect authorization code and attempted to confirm the transaction for three times, relevant C3T DA maker’s account will be disabled.Under such situation, the Participant should apply to HKEX to re-activate the C3T DA maker’s account.

Are C3T DA checkers required to memorize the authorization code?

C3T DA checkers can either memorize the authorization code for convenience purpose or obtain the code via on-line enquiry function whenever needed.

How often will the authorization code be changed for C3T access?

The authorization code will be changed by C3T on the first day of each month.

Are CCASS DAs required to initialize their smartcards?

Yes, all CCASS DA smartcards should be initialized before use.

Can a CCASS DA maker's smartcard remain in the smartcard reader while relevant CCASS DA checker authorizes a transaction?

A CCASS DA maker's smartcard can be remained in the smartcard reader while the checker authorizes a transaction.

If the C3T DA resets the password for a user, is the user concerned required to change the password at the first log-on?

Yes, the user should change the password during the first log-on for maximum protection.

Can user access to CCASS by 2FA if the account is locked?

Access will be locked after 5 consecutive unsuccessful attempts of login within 30 minutes, while 3 consecutive unsuccessful attempts of entering OTP will be counted to 1 unsuccessful attempt of login.

Once the user’s account is locked, he/ she cannot access to CCASS by 2FA. To unlock user’s account, their DAs to perform “Unlock/ Reset OTP Device Registration function” in DMS; to unlock DA’s account, Participant should notify HKEX to perform “Unlock/ Reset OTP Device Registration” for its DA by submitting the eService – DA 3 “CCASS/ CCMS Delegated Administrator Application/ Maintenance Form” in Client Connect through HKEX Access Management Portal (https://connect.hkex.com.hk/).

When a C3T DA set up a user profile, is it compulsory for the C3T DA to input the “enabled date” and “disabled date”?

No, “enable date” and “disabled date” are not compulsory input fields. Input to such data fields is only necessary when a Participant wants to specify an effective date that a user account will be activated or deactivated.

What is BIC used for?

With CCASS/3, when Participants execute CCASS transactions, they can identify themselves by specifying (1) their Participant ID; or (2) their BIC as an alternative. BIC will be applied in two situations in general:

1.	The data field “Sender BIC” in the file header of all upload files serves as an alternative to the “Participant ID” data field.
2.	The data field “Counterparty BIC” in the detailed record of SI/ISI (both on-line screen and upload file) serves as an alternative to the “Counterparty ID” data field.

Should BIC be specified in the file header of all upload files?

BIC will serve as an alternative to Participant ID. In the case of file header, Participants can specify either the Participant ID or the Sender BIC. In the case of SI/ISI detailed transaction, Participants can specify either the Counterparty ID or the Counterparty BIC.

Should all Participants provide their BIC to HKSCC? Can a Participant use his BIC to perform CCASS functions without providing such information to HKSCC?

All Participants are encouraged to provide their BIC to HKSCC. As mentioned earlier, BIC may be used under 2 situations: a Participant can identify himself to CCASS by specifying his BIC, or a Participant can identify his SI/ISI counterparty to CCASS by specifying the BIC. If a Participant does not provide his BIC to HKSCC, he will not be able to use this alternative to perform CCASS functions. Also, his SI/ISI counterparts may fail to input SI/ISI using this alternative, which may in turn affect the matching result.

Will CCASS validate both CCASS Participant ID and BIC?

Participants must input either the Participant ID or the BIC (or both) for CCASS to accept a relevant file/record. And CCASS will validate both the Participant ID and the BIC, if being input. The transaction will be rejected if (1) either Participant ID or BIC is invalid; or (2) they are not referring to the same Participant.

Is it compulsory to specify the ISIN code in the upload files?

No, Participants can specify either the Stock Code or the ISIN (or both) in upload files.

Will there be any validation on both stock and ISIN code if both are input in a transaction?

If both Stock Code and ISIN are input in a transaction, CCASS will validate to ensure that both codes are valid and refer to the same stock. Otherwise, the transaction will be rejected.

When will the uploaded SI / ISI files be validated by CCASS/3?

SI / ISIs files uploaded to CCASS/3 will be validated on an ad hoc basis. Subject to the size of the upload file, Participants will receive their SI / ISI Batch Input Control Reports shortly after they have uploaded their SI / ISI files. The ad hoc validation process will allow more time for Participants to rectify their SI/ISI transactions if necessary.

For SI validation, will CCASS/3 validate a SI if its relevant counterparty is yet to input the opposite SI?

CCASS/3 will validate any SI file uploaded to the system, regardless of whether the relevant counterparty has input an opposite SI or not.

How do Participants verify the correctness of their Back office System (BOS) regarding their upload files and/or report data download files?

Participants should follow the detailed specifications provided by HKEX to develop / modify their BOS for the generation of upload files or the process of report data download files with reference to the specified format. The specified format and samples files are available in HKEX website.

Can Participants use MS Word to read report data file downloaded from C3T or PG?

C3T or PG report data files are pure ASCII files (not MS-word document files). Therefore Participants are recommended to use “Notepad” (Window accessories software) to view and print the report data files instead of using MS word.

What are the clearing and settlement arrangements for Securities Market during Typhoon Signal No. 8 (or above) / Extreme Conditions / Rainstorm Warning?

Please refer to “Severe Weather Arrangement” at HKEX website

For a Business Day(D) which is not being treated as a Settlement Day due to the issuance of Typhoon Signal No 8 (or above) / Extreme Conditions / Black Rainstorm Warning and there is no CCASS service on the day, CNS positions and SIs/ISIs with settlement date set to day D will not be settled on day D. For such affected CNS positions, their settlement day will be automatically deferred to D+1. For such affected SIs/ISIs, while their settlement day will remain unchanged, CCASS will still settle them on day D+1 automatically because CCASS will settle all SIs/ISIs with current day or earlier as their settlement day. Having said that, Clearing Participants (CPs) can opt to amend the settlement day of such affected SIs/ISIs to any date according to their commercial needs.

Example (14 Jul being not treated as a settlement day due to full day typhoon)

Mon	Tue	Wed	Thurs	Fri
12-Jul	13-Jul	14-Jul	15-Jul	16-Jul

Type of trade	Trade Date	Original Settlement Date (SD)	Revised SD	Remark
CNS	12-Jul	14-Jul	CCASS automatically changes SD to 15-Jul	Actual settled on 15-Jul
CNS	13-Jul	15-Jul	CCASS automatically changes SD to 16-Jul	Actual settled on 16-Jul
SI/ISI	12-Jul	14-Jul	CCASS will NOT automatically change SD	Actual settled on 15-Jul
	13-Jul	15-Jul	CCASS will NOT automatically change SD	Actual settled on 15-Jul
	13-Jul	14-Jul	CCASS will NOT automatically change SD but CP can opt to change SD to 16-Jul according to CP’s commercial needs	Actual settled on 16-Jul

Are there any pre-requisites of using Participant Gateway (PG)?

CCASS/3 Terminal (C3T) utilizes an Edge browser to connect to CCASS/3. The PG Server, provided by HKEX, is deployed to the Participant site and is responsible for connecting to CCASS/3. However the Participants must procure the necessary hardware, software, communication interface, and security device to access CCASS/3 via PG. Participants need to develop a Participant Supplied System (PSS) and the interface between their PG/PSS and CCASS/3 based on the Application Program Interface (API) protocol and message standard provided by HKEX. Participants are also required to perform interface test with HKEX to certify their PG access.

For connectivity of PG to CCASS/3, for development environment, PG Participant is required to subscribe a development SDNet link for testing purpose in initial commissioning and for subsequent maintenance; for production environment, Participants can either choose to share C3T link or subscribe a separate link for PG, depending on the projected transaction volume.

Does a move to PG require the replacement of C3T? Is it recommended to use a combination of the two services and if so, why?

Since only settlement related functions can be accessed through PG mode, Participants need to use C3T to support their daily functions such as nominee services etc. Therefore, PG users still need to install C3T.

What is the minimum requirement for any PC being used to support the PG connection? How does this compare with the requirement for C3T?

The Production PG Server is supplied by HKEX while Participants need to prepare their own PC for PG development and end-to-end test. The reference PC requirement for the PG is available via Client Connect (https://connect.hkex.com.hk/). However, the requirement of the PSS is subject to the Participants’ application.

What are the costs for the adoption of PG?

Participants who want to install PG would need to bear the one-time set up cost and recurrent cost. One-time set up costs include the purchase of hardware and software, commissioning, smartcard, and PSS development. Recurrent costs include PG maintenance fee, monthly fee of SDNet development link, and the potential maintenance costs relating to the upgrade of PSS and testing on the PG interface due to modifications in business operations or CCASS/3 functions.

The current fee schedule for PG is set out in CCASS Participant Gateway – Fee which is available in Client Connect (https://connect.hkex.com.hk/)

Can PG be installed on non-Windows platform?

No. PG can only be run on Windows platform as supplied by HKEX.

Since the hardware and software is maintained by HKEX, what administration rights on PG Server do Participants have?

Participants do not have administration rights on PG Server. However, HKEX will obtain Participant’s consensus before making any change on the PG Server.

Do we need separate installation of PG to support each CCASS Participant ID?

Technically, it is possible to use one PG to support more than one Participant. However, in practice, it will require manual operation to log on/off from/to various Participant IDs. This may not be an ideal operational model especially when Participants need to handle critical matters. Alternatively, you can install separate PG to support each of the Participants.

What is the benefit of installing more than one PG?

Participants may need to install 2 PGs for resilience purpose. Both PGs can operate simultaneously.

Can 2 PSS connect to 1 PG?

No. A PG can only be connected to one PSS.

PG communicates with CCASS/3 via Hypertext Transfer Protocol (HTTP) protocol over Secure Sockets Layer (SSL)

a) How is the access to PG controlled?

PSS must be successfully authenticated by PG Server in order to gain the access. Authentication against User ID, password (MD5 hashed) and IP address is done during PSS logon to PG. The PG connects to CCASS/3 using a smartcard and password. Participant must type in the password and perform a logon on before the PSS can login to the PG Server.

b) What is the message protocol to be used to connect with PG? How security issues or concerns may be dealt with?

The PG communicates with CCASS/3 via HTTP protocol over SSL and the PSS communicates to the PG Server using socket over TCP/IP (using the PG-API provided by HKEX). Participants can choose either secured connection (SSL) or normal connection for the connections between PG and PSS.

The PG connects to CCASS/3 using a smartcard and password. Participant must type in the password and perform a logon before the PSS can login to the PG Server. The PG follows the same security level as C3T.

c) Do we need to have SSL certificate key exchange? Could HKEX clarify on SSL portion?

A smartcard issued by HKEX is required to operate PG. Upon user successfully logon PG with the smartcard, SSL session will be established between PG and CCASS/3. This part is done by PG.

d) How is communication between Participants and HKEX conducted via PG?

It is conducted on a request-response basis, i.e. PSS needs to submit a request (input message), and then CCASS/3 response to the request (output message) accordingly. It follows that if a Participant wants to change or cancel an instruction already accepted by CCASS/3, it needs to first send an input message for enquiry of the time stamp of the instruction by specifying the instruction number. CCASS/3 will respond by locating the instruction based on the instruction number specified and return the details of the instruction, including the time stamp via output message. Participant need to send another input message again to make changes/cancel the instruction.

Is there any third party software/application running on the PG Server supplied by HKEX/CCASS?

Yes, apart from the Windows Operating System, IBM Director and Symantec Endpoint Protection are the third party software running on the PG Server. HKEX is the owner of Symantec Endpoint Protection and IBM Director client software.

Is this third party software maintained by HKEX/CCASS or another HK local third party vendor?

As stipulated in the Standard Terms and Conditions of PG, HKEX will provide or procure to provide maintenance services for the PG for these third party software. The maintenance services in respect of the PG (other than the PG Software) shall be provided so long as maintenance services in respect of the PG (other than the PG Software) are provided to HKEX by the relevant manufacturer/supplier(s).

Can the third party vendor login the PG remotely?

Yes, this may be required but not a usual practice. Normally it would be HKEX to login remotely for the following purposes:

- obtain system logs for problem diagnosis

- PG software or third party software upgrade

- virus definition update

Refers to the third party software, what is the deployment method of this software on PG Server? How many software releases are there expected in a year?

For the initial deployment, they are bundled with the delivery of the PG Server to the Participant. For subsequent software maintenance, they may be done remotely by HKEX/third party vendor, or done at Participant’s site, depending on the complexity of the maintenance.

For the frequency of the maintenance, it will depend on the software life cycle of the third party software.

For virus definition update, it will be performed remotely by HKEX monthly, without Participant intervention.

For PG software release, it depends on whether there is any urgent enhancement on PG Server and whether the business enhancement in CCASS/3 will impact PG. The later one will be at most 2 to 3 times a year.

How would a Participants capacity requirements affect the technical set up of PG (in terms of number of PG and line bandwidth)?

Participants can choose a single PG or dual PG configuration. The network bandwidth requirement depends on the data volume of the online messages, file upload and report data file download. Participants can calculate their required bandwidth according to their message volume and the message lengths as specified in the PSS Messaging Specifications.

The minimum bandwidth for a single PG or dual PG configuration is 128K or 256K respectively.

Is there any platform restriction for PSS or any recommendation for PSS platform?

As long as there is a Java Runtime Environment (JRE) in the PSS platform, PG-API libraries supplied by HKEX will be able to run. Participants should use their targeted PSS platform and JRE version in the PG end-to-end test to ensure its compatibility.

Will the PG-API support multiple opened connections to the same PG (i.e. supports multi-threading)?

Yes. PG is designed to accept multiple transactions from PSS. It is the Participant’s decision in application design whether or not to implement multithreading in PSS application. HKEX would provide sample codes for implementing multithreading in PSS application. A PSS thread is blocked until a response is returned from CCASS/3 (via PG).

Will the message be lost when it is successfully sent out from PG to CCASS/3?

PG should be able to route your message to CCASS/3 unless there is network problem between PG and CCASS/3. In case PSS is not sure whether the message is processed by CCASS/3 (e.g. PSS received a time-out instead of a successful return code), PSS should perform enquiry function to check if the submitted message was executed.

What would be the possible reasons if we fail to send out messages to CCASS/3 via PG?

There are two possibilities:

i. PG Server is closed. Your PSS application should not be able to logon PG in this case.

ii. Problems encountered on the network connection between PG and CCASS/3.

For technical enquiries, please contact CCASS Technical Hotline at 2211- 6606. For general enquiries, please contact CCASS Hotline at 2979-7111.

How can we increase the transaction throughput of PG?

The maximum PSS connection to each PG is 6, each each connection on average supports 12 pairs of input and output messages per minute (excluding file upload and report download). PSS can make the maximum number of connections supported by PG in order to obtain the highest throughput. Installing one more PG is one way of increasing the overall throughput. Alternatively, using file transfer to upload a batch of instructions will increase the overall throughput.

If dual PGs configurations are used, which components (PG or PSS) are required to perform load balancing of transactions sent to CCASS/3?

PSS should perform the load balancing in case of dual PGs configurations. (Load balancing is not necessary for single PG configuration.)

Can we run multiple PG instance on the same PG machine & SDNet line?

No, multiple PG instances cannot be run on the same PG machine. For SDNet line it can be shared by multiple PGs if the bandwidth subscribed can support the estimated transaction volume. Participants may also consider subscribing two PGs for resilience purpose and at the same time configure them to be active-active to increase the overall throughput.

What is the maximum throughput of a file based input (both via PG and C3T)?

Currently for SI, ATI, STI and ISI file transfer, each file allows 7002 records at maximum, including 1 header and 1 trailer record. As for the lead time on transmitting and processing the file in PG, please refer to Section 8.7 of “CCASS/3 Messaging Specifications for Participant Supplied System (PSS) Part 1” in Client Connect (https://connect.hkex.com.hk/) for illustration.

PSS communicates to the PG Server using socket over TCP/IP (using the PG-API provided by HKEX)

a) Must PG (PC/Server) be in the same LAN as the PSS Server? Any specific socket must be granted access?

PG Server supports TCP/IP which can be located in different LAN segment as the PSS Server. Make sure the normal and secure port is available if there is any firewall in between.

HKEX has assigned the following port numbers between PSS and PG:

• Secure connection: 4433 for synchronous and 4434 for asynchronous transactions.

• Normal connection: 8080 for synchronous and 8081 for asynchronous transactions.

b) Can we assume that any communication between PSS and PG are securely handled by PG-API call? Does this include the encryption of password into MD5 Hashed (encryption algorithm)?

Secured connection (SSL) can be setup between PSS and PG, with which communication between PSS and PG is secured. Password will be encrypted using MD5.

Which system initiates the communication? Is the message sent by HKEX/CCASS (push) or PG Server (pull) the data from HKEX/CCASS?

For PG logon to CCASS/3, the initiation is from PG Server to CCASS/3. For broadcast message polling, PSS should be the initiating party to subscribe to asynchronous and broadcast messages. Then PG Server will poll CCASS/3 for asynchronous and broadcast message, when there are messages, PG will callback PSS.

For subsequent transactions, the initiation should be PSS. PSS sends request messages to PG via PG-API, and then PG-CCASS/3 will reply message to PSS when the PG-API returns.

Would the PG-API messaging be transactional? (Say supporting JMS)

JMS will not be used. All transactions via PG are supported by PG-API.

What is the security setup recommended for PG installation (e.g. firewall)?

Connection between PG and CCASS/3 is within a closed network (via SDNet). Appropriate security measures will be in-place (e.g., disallowing Participant A accessing Participant B connection point). As for connection between PG and PSS, Participants can choose to implement secured (e.g., SSL) or normal connections provided by PG-API.

Should extra security measure be required, Participants can consider installing a firewall between PG and PSS.

Are the user IDs and user authentication residing on the PG Server?

For PG logon to CCASS/3, the authentication is performed in CCASS/3. For PSS logon PG, the user ID and authentication is performed in PG with encryption.

How does the authentication work with the smartcard and smartcard reader?

A smartcard reader should be installed to each PG Server. PG should logon to CCASS/3 before performing any transaction. To logon, Participant should insert the smartcard into the smartcard reader and input his user password. If the password is correct, CCASS/3 will retrieve and authenticate the certificate stored in the smartcard. Upon successful authentication, PG is logged onto CCASS/3 successfully. In case of fail logon after 3 attempts, the smartcard password will be revoked, then the Delegate Administrator (DA) of the Participant should reset the password via C3T.

How often will the smartcard authentication process take place in a PG operation?

The authentication via smartcard is required when Participants perform logon to CCASS/3 by entering the password. Moreover, the smartcard authentication (or re-entering of password) is required to enable the Administrator Main Window after it is "locked" due to the smartcard was removed from the reader.

Apart from logging on to CCASS/3, is there any other role of the smartcard? Will there be one smartcard for one site, or one per user?

The PG smartcard can be used to logon CCASS/3 as well as to perform the PG Administration functions. A PG smartcard can be used on any PG of the same Participants. Participants should apply PG smartcards according to their operation need.

Are there any audit logs or reports on the PG Server?

Audit logs are available on PG Server.

Do the audit logs on PG Server contain any customer name or customer telephone number or details?

The audit logs records PG events such as PG startup, password validation status, login session status and PG messages for problem diagnosis or audit trail purposes. Access to audit logs is restricted and HKEX will not access them without Participants’ consent. There is no such field as customer name or telephone number in the PG message. However, Participants should pay attention that if they input such information in “Remark” fields, they will be logged.

Should Participants work with their application developer (or software house) to design and develop PSS based on their requirements?

Yes. HKEX will provide necessary technical information for the Participants (or software house) to design and develop PSS based on their requirements.

Is there any certification to use PSS? Is it being certified at Participant level or at software vendor level?

Yes. Certification to PSS is required at Participant level. HKEX will also certify PSS in the perspective of CCASS/3 communication.

How would testing be organized for a potential PG user? Is advance notice required to access the testing environment? What sort of testing environment needs to be configured?

There are several testing requirements before the Participants admit for PG:

• Readiness of PSS: It is assumed that Participants already completed the relevant unit tests on the PSS.

• PG Simulator Test: HKEX will provide a PG simulator (a program) for Participants to test their PSS.

• PG End to End Test: The test will be conducted with PG connection to CCASS/3 testing environment. Participants will need to prepare a Windows-based PC as the PG Server (with software provided by HKEX), and a testing C3T for the result verification.

• PG Connectivity Test: The test is to ensure the production connectivity between PG and CCASS/3 upon PG deployment at the Participant site.

The testing arrangements and schedule needs to be confirmed between HKEX and the Participant.

What is the timeline for PG migration to PG?

It normally takes around 4 months for acquiring PG service. This excludes the PSS development timeline.

Does CCASS/3 have an authorized vendor(s) to assist in the infrastructure cable layout (SDNet) and able to provide consultancy services to Participant’s infrastructure team?

Yes, HKT and HKBNES are the authorized vendors.

Are all C3T functions being supported by PG?

No, PG only supports a subset of functions offered in C3T. For list of functions supported by PG, please refer to Section 8.2 - Summary of PSS Business Transactions to Message Mapping of “CCASS/3 Messaging Specifications for Participant Supplied System (PSS) Part1” in Client Connect (https://connect.hkex.com.hk/).

Is it required to physically login and logout to PG machine on local console?

Physical logon/logoff has to be done on PG console. Alternatively, PG Participants may use remote Keyboard, Video & Mouse (KVM) technology to help manage PG remotely, at the cost of Participants. Physical logon/logoff can be done on weekly basis.

How do Participants remotely monitor the connection status between PG and CCASS/3 (e.g. any heartbeat check)?

Connection status between PG and CCASS/3 will be reflected on the Administrator Main Windows.

What is the business continuity plan in case of unavailability of PG?

Participants shall have their own business continuity plans in place. For reference, PG users may use C3T as contingency measures. CCASS Participants may use the HKSCC’s back-up centre facilities to perform the CCASS/3 functions in the event that their C3T breaks down.

Is there any support to Participants for PSS disaster arrangement?

No. PSS is Participants own back office system. Participant needs to arrange the backup on PSS. However, as for PG, Participants can install standby PG at their back up site. Besides, Participants may use C3T for business continuity in case of PSS failure.

Where can we get the information about PG related message specifications and templates (including upload file and report data download file formats)?

The format of the upload files and report data download files is not identical to those to be uploaded / downloaded via C3T. Please refer to message specifications and templates from “CCASS/3 Messaging Specifications for Participant Supplied System (PSS) Part1” in Client Connect (https://connect.hkex.com.hk/).

Do the Output Messages from the CCASS/3 to PG use standard ISO messages as well?

Yes. Apart from the ISO 15022 messages, there are CCASS/3 user-defined messages that are designed with reference to ISO message format.

Will Participants receive real-time acknowledgement after sending a transaction to CCASS/3 through PG?

Yes. Participants will receive an acknowledgement indicating whether their transaction request was successfully received.

Can we query CNS settlement status via PG and if so, how?

Yes, CNS settlement status can be queried through ‘Enquire Settlement Activity’ (MC555) via PG.

For SI transactions, why confirmation messages (e.g., MT544, MT546) are not used?

In CCASS/3, confirmation messages are supported via enquiry modes instead of a direct confirmation approach as MT544, MT546. Hence, MT544 and MT546 are not used and Participants need to send an enquiry message (MT556 or MT557) to get the SI status.

If we manually upload a SI file via C3T, can we use MC556 or MC557 to enquire?

Yes, you can use MC556 or MC557 to enquire if the file upload is successful and it does not get rejected at CCASS/3 host (after validation run).

If one of the records in the SI upload file (via C3T) is rejected by CCASS/3, will we be able to get this (reject/success) information in the PG reply message?

No, PG users cannot receive the rejection through the reply message. Instead, PG users should check the SI Batch Input Control Report for the status of individual record in the SI file. This report can be downloaded via Report Download function in C3T or PG (MC901, MC902).

After a SI/ISI upload file is being uploaded via PG, how would the file be processed in CCASS/3?

In fact, CCASS/3 handles various upload files in different ways. In the case of SI/ISI, the SI/ISI upload file will be validated and processed by CCASS/3 on a real time basis after a PG sends a SI/ISI upload file. When the SI/ISI upload file processing is completed and the SI/ISI Batch Input Control Report is available, CCASS/3 will send a notification message to PG if the PG users have subscribed the notification message. Other upload files will be handled as scheduled jobs.

What is the page size of SI general enquiry? And how are the SI records related to the MC557?

Currently, the page size is defined as 10, i.e. for each MC557 enquiry message, a maximum of 10 SI records will be returned in MC558. For example, if there are 120 SI records, 12 MC557 message should be submitted and 12 MC558 will be returned containing a total of 120 SI records. In each MC558, there is an indicator showing if more records are available, such that PSS can determine if it should submit MC557 again.

For Cancel SI and Revoke Matched SI messages, do they require both ‘SI input number’ and ‘timestamp’ as the key matching criteria?

Yes, both fields are required. Both SI input number and timestamp can be retrieved through Enquiry SI (Single) (MC556).

Is it possible to utilize the real-time intra-day delivery of settlement instructions (including cancellations) to CCASS/3 and also to receive realtime settlement and status updates on each transaction?

Currently, there are messages MT540-543 for settlement instruction maintenance, e.g. “Input SI” and “Cancel SI”. Since the communication protocol between PG and CCASS/3 is a request-response model, it is not feasible to push any real time settlement and status update. So PG users need to proactively send a SI enquiry instead, or to download the settlement reports via PG to extract the status of the settlement instructions.

Can we download the C3T online report list via PG?

Participants can retrieve the report list via “Enquire Report Master/Availability List” (MC913) in PG if they are available on C3T.

What is VaR Platform?

VaR Platform is a risk engine for risk calculation, which is applicable to HKSCC Clearing Participants (CPs) only. VaR Platform offers risk related tools (1) Report Access Platform (RAP) for retrieval of VaR Platform reports and (2) VaR Online for margin and stress test simulation.

What is Report Access Platform (RAP)?

RAP is a platform for retrieval of VaR Platform reports and data files via secure file transfer protocol (SFTP) facility.

How to get access to RAP?

CPs can apply for a RAP User ID by submitting the RAP Registration and Maintenance for HKSCC or HKCC/SEOCH or Share Registrarform (eService: TechS 8) via Client Connect (https://connect.hkex.com.hk/) with ip addresses of designated workstations; for details please refer to the RAP Technical Guide.

Can CP retrieve Risk Parameter Files (RPF) via RAP?

For CPs who would like to develop their own tools to conduct margin and stress test calculation/simulation, can subscribe to access the optional “RPF folder” for retrieval of RPF by submitting the RAP Registration and Maintenance for HKSCC or HKCC/SEOCH or Share Registrar form (eService: TechS 8) via Client Connect (https://connect.hkex.com.hk/).

CPs should note that due to large file size, retrieval of RPF would require a larger bandwidth, please refer to section 7.1 of the RAP Technical Guide available in Client Connect (https://connect.hkex.com.hk/) for the projected download time under different Securities and Derivatives Network (SDNet) bandwidths.

What is VaR Online?

VaR Online is a browser based tool to facilitate CPs to conduct margin and stress test simulation.

How to gain access to VaR Online?

VaR Online is a browser based tool to facilitate CPs to conduct margin and stress test simulation.

Is there any difference on the login method between VaR Online DA and Business User?

VaR Online DA should access VaR Online DA functions via https://idm.hkexposttrade.com.hk/user-management/; while VaR Online Business User should access VaR Online user functions via https://rmcd.hkexposttrade.com.hk/.

If a user is assigned with both VaR Online DA and Business User roles, only one single login will be required. After successful login VaR Online DA functions via user-management URL, the user can enter VaR Online URL to switch to access user functions without re-login and vice versa.

How to access VaR Online for first time login?

For first time login, user will have to enter user ID and a One-Time Password (OTP) received from the user’s registered email, then setup user’s login password. After that, user will be required to setup channel to obtain OTP by mobile device in the ForgeRock Authenticator App or email, and enter the OTP to login the account.

How to access VaR Online DA functions or user functions for subsequent login?

For subsequent login to VaR Online DA functions or user functions, users will have to provide (1) User ID, (2) Password; and (3) OTP generated from the designated OTP channel (i.e. mobile device or email).

What should I do if my VaR DA and VaR Business User account is locked?

VaR DA or VaR Business User access will be locked after 5 consecutive unsuccessful attempts of login within 30 minutes. An email will be sent to the VaR DA or VaR Business User to notify the account status. To unlock the account:

For VaR DA, should send email to VaRDA_unlock@hkex.com.hk to request for unlock of DA account.
For VaR Business User, should request its VaR DA to unlock the user account.

Can user obtain OTP using the same profile from ForgeRock Authenticator App to login both Client Connect and VaR Online?

Users have to register separate accounts to access Client Connect (https://connect.hkex.com.hk/) and VaR Online; and obtain OTP from the respective user profile to login.

What should I do if my RAP account is locked?

Each RAP User ID will be restricted to a maximum of 5 times sign-on within 5 minutes. The User ID will be locked once it reaches 5 times within 5 minutes and will automatically be unlocked at every 5 minute interval. CPs are reminded to avoid any intensive polling of reports / data files.

For example, if a RAP User ID has signed on more than 5 times between 12:45:10 and 12:47:30, the User ID will be locked at 12:47:31 then unlocked at 12:50:00 automatically.

Where can I get more technical information relating to RAP and VaR Online?

CPs can refer to the technical guide under RAP and VaR Online User Guide available in Client Connect (https://connect.hkex.com.hk/).

Can CPs get a projection of marks and margin report?

CPs should refer to the VaR Platform reports, “MTM and Margin Requirement Report” (RMAMR01 and RMAMR03) for estimates of their end-of-day marks and margin requirement. Please refer to VaR Platform User Guide available in Client Connect (https://connect.hkex.com.hk/) for report availability and details.

How to estimate end-of-day margin requirement via VaR Online?

CPs may simulate the end-of-day margin requirement by using VaR Online, while CPs should note that the positions shown in VaR Online (when setting “Used positions” = “Real-time” under the “SETTINGS” tab) include pending positions from current and previous trading days, as well as due and overdue positions which will be updated from time to time throughout the day. For CPs who want to simulate the requirement that is closer to the final figure, may adjust the positions in VaR Online by excluding due positions on the current day and add Exercised Options Trade (EOT) positions accordingly. CPs may refer to VaR Online User Guide available in Client Connect (https://connect.hkex.com.hk/) for details.

How do CPs locate the actual risk obligation amount to be paid?

After the collateralisation process, CCASS will calculate the actual payment amounts, CPs should refer to the following CCASS reports to fulfil their payment obligations:

Posting / Collateralisation Result Report (intra-day) (CCMPY01)
Posting / Collateralisation Result Report (day-end) (CCMPY02)

When will excess cash collateral be released?

To mitigate potential under-collateralisation risk if an adverse mark-to-market change is observed after the intra-day call, excess cash collateral will NOT be released during intra-day, rather will only be released during day-end CCASS payment process.

What is the relationship between Tier P sub-portfolio risk profile and corresponding margin requirements?

In general, the relationship between Tier P sub-portfolio risk profile and corresponding margin requirements is summarized as follows:

Portfolio	Diversified	Directional	Concentration in Volatile Stocks
Characteristics	Consists of balanced long / short positions or hedged positions (e.g. Structured Products vs underlying hedges, Long ETPs vs Short underlying)	Inclines towards long or short positions	Concentrates in volatile stocks or Structured Products
Margin Requirements	Lower (Portfolio margining)	Higher (Limited netting at portfolio level)	Higher (Higher margin on high volatility instruments)

How can CPs use specific collateral for settlement purpose?

CPs may pledge Specific Stock Collateral (SSC) or Specific Cash Collateral (SCC) to settle transactions by stock or money. For detail of the operation, please refer to CCMS Terminal User Guide section 7.1 Collateral Management Services available in Client Connect (https://connect.hkex.com.hk /).

How can CPs use specific collateral for margining purpose?

CPs may pledge Specific Stock Collateral (SSC) or Specific Cash Collateral (SCC) to cover CNS positions which will be excluded from the marks and margin requirement calculation. If the collateral applied is at Tier P sub-portfolio, the margin requirement can be higher or lower subject to the characteristic of sub-portfolio risk profile after pledged. For details of the relationship between Tier P sub-portfolio risk profile and margin requirement, please refer to the previous FAQ “What is the relationship between Tier P sub-portfolio risk profile and corresponding margin requirements?”.

CPs can also opt to replicate the scenario of SSC or SCC arrangement by using VaR Online to simulate the requirement. Please note that SSC are pledged in CCMS according to corresponding stock code and settlement date while SCC are arranged in CCMS according to corresponding stock code and trade date. All cross-day position netting should be performed after considering SSC / SCC. For more details on covering positions and cross-day position netting, please refer to section 4.3 “Specific Stock / Cash Collateral Position Cover” and section 4.5 “Cross-day Position Netting” of the Initial Margin Calculation Guide available in Client Connect (https://connect.hkex.com.hk/).

What is the deadline for placing specific collateral?

Specific Stock Collateral (SSC)

CPs should arrange SSC before the cut-off time at 11:00 for the intra-day Marks collateralisation and 19:00 for the day-end Marks collateralisation, while SSC inputted after 18:30 is not guaranteed on-hold on the same day.

Specific Cash Collateral (SCC)

CPs should arrange SCC before the cut-off time at 11:45 for CPI payment (subject to CPI setup) and 18:00 for DDI payment.

How to get the latest margin multiplier for Tier N margin rate?

CP should refer to VaR Platform report, “Daily Participant Margin Multiplier Report” (DWH0081C) for their own margin multipliers and the corresponding effective dates, the flat rate margin multiplier takes effect on the next business day after the review date.

How to get the latest Tier N margin rate and Default Fund threshold information?

The latest Tier N margin rate and Default Fund threshold information are available in Clearing – Risk Management section in HKEX website (https://www.hkex.com.hk/Services/Clearing/Securities/Risk-Management?sc_lang=en). Any changes to the above information will be announced via circular.

How do CPs know if they are subject to default fund add-on payment?

HKSCC will notify those CPs who are subject to payment of Default Fund add-on requirements with payment details. Default Fund add-on to be collected will be “Default Fund add-on requirements” shown in MTM and Margin Requirement Report (RMAMR01) minus “Collateral on-hand (OCF)” shown in Special-Use Collateral Balance Report (CCMSU04).

How to locate default fund information?

A monthly Default Fund review will take place at the first business day of each month, subject to ad-hoc review from time to time. Circulars will be issued on the day of Default Fund review (i.e. first business day of the month); while CPs must pay their Default Fund contribution requirements, if any, by 17:45 (via DDI) on the following business day.

CPs can refer to the following reports generated after the Default Fund review and collateralisation for their requirements:

Default Fund Requirement Report (RMADF01) – available around 10:30 via RAP
Statement of Default Fund Contribution (CCMDF02) – available around 12:00 noon via CCASS

CPs should refer to CCASS report “Statement of Default Fund Contribution” (CCMDF02) for their actual contribution requirements, which should be paid by 17:45 (via DDI) on the following business day.

Should Participant apply for Buy-in exemption if an early buy-in order has been arranged for the current day outstanding short position?

Yes. Participant should apply Buy-in exemption via Client Connect as usual. Participant should select Contingency ground under BASIS OF APPLICATION and fill in the REMARK BY PARTICIPANT to explain that an early buy-in order has placed on YYYY-MM-DD to settle the outstanding position.

Should Participant apply for Buy-in exemption if the current day outstanding short position is due to the fact that Participant’s available shares are being used to settle old short position during Batch Settlement Run whereby a buy-in order for settling the old position had been arranged?

Yes, this is a double count scenario. Participant should apply Buy-in exemption via Client Connect as usual. Participant should select Contingency ground under BASIS OF APPLICATION and fill in the REMARK BY PARTICIPANT to explain that the outstanding position quantity is a double count of an old position dated YYYY-MM-DD. Participants are also suggest to settle the current day short position by delivery instruction so as to avoid the shares are being used to settle old short position during batch settlement run.

What is a Settlement Agent (SA)? What is the difference between Settlement Agent and Third Party Clearing (TPC)?

A Settlement Agent is a service provider appointed by a CCASS Participant except Investor Participant (“non-IP Participant”) to access CCASS and conduct settlement and other activities in CCASS on behalf of the Participant without changing the Participant’s principal obligations vis-à-vis HKSCC. The TPC model offers an added option for Exchange Participant who trades on the Stock Exchange of Hong Kong (SEHK) to outsource its clearing functions to General Clearing Participant(s) who provides clearing services to Exchange Participants. Under TPC, an Exchange Participant has NO clearing participantship in CCASS and is referenced as a Non-Clearing Participant (NCP). An Exchange Participant which is an (i) NCP or (ii) a Clearing Participant which is not a China Connect Clearing Participant and which has entered into a Clearing Agreement with a General Clearing Participant for the clearing of its China Connect Securities Trades is referenced as a Non-China Connect Clearing Participant (NCCCP).

A table summarizing the key features of the SA and TPC models is shown below:

Descriptions	SA	TPC
1. Key concept	Allow Exchange Participant to outsource its CCASS operations (administrative functions only) to a Settlement Agent.	Allow Exchange Participant to outsource its CCASS clearing and settlement obligations to designated GCP(s).
2. Role of the service provider	SA is a CCASS account operator who conducts settlement and other activities in CCASS on behalf of the Participant.	GCP takes up the Exchange Trades and/or China Connect Securities Trades executed by its NCP/ NCCCPs and conduct clearing and settlement with HKSCC as principal in GCP’s own CCASS account.
3. Status of the service provider	SA does not need to be a CCASS Participant itself. However, it needs to demonstrate that it has adequate clearing experience and capability.	GCP is a CCASS Clearing Participant who needs to be formally admitted by HKSCC before clearing trades for other Exchange Participants. GCP must be a China Connect Clearing Participant in order to provide clearing and settlement services in respect of China Connect Securities Trades to NCP/ NCCCPs.
4. Participantship	Exchange Participant must be a DCP. SA is not itself a type of CCASS Participant.	For the case of an NCP, the Exchange Participant does not need to be a Clearing Participant. An Exchange Participant who is a Clearing Participant can choose to become an NCCCP and appoint a GCP for clearing of its China Connect Securities Trades. GCP does not need to become an Exchange Participant.

For more details on TPC, please visit the TPC section:http://www.hkex.com.hk/Services/Clearing/Securities/Getting-Started/Third-Party-Clearing-by-HKSCC-General-Clearing-Participants?sc_lang=en.

What factors should a non-IP Participant consider when appointing a Settlement Agent?

The appointment of a Settlement Agent by a non-IP Participant can be regarded as an outsourcing arrangement between the two parties concerned. Non-IP Participants should understand the various implications and obligations to HKSCC related to outsourcing the CCASS function to a third party. The key implications including the control over the outsourced CCASS operations, operational and systemic risks and the associated insurance coverage, as well as the local legal and regulatory requirements if the Settlement Agent is located in a foreign jurisdiction, should be considered and properly addressed beforehand. Non-IP Participants should refer to the “Principles on Outsourcing” issued by the International Organization of Securities Commissions “IOSCO” which can be downloaded from IOSCO’s website at http://www.iosco.org/ (Related link of the document:https://www.iosco.org/library/pubdocs/pdf/IOSCOPD687.pdf).

How to Apply?

A non-IP Participant who is interested in the appointment of a Settlement Agent to carry out CCASS operations on its behalf is required to apply to HKSCC (Related explanatory note and application form can be downloaded at http://www.hkex.com.hk/Services/Clearing/Securities/Getting-Started/Settlement-Agent-and-Access-to-CCASS-from-a-Foreign-Jurisdiction?sc_lang=en). Alternatively, interested non-IP Participant can also make a request to the Clearing Administration & Services, Cash & Derivatives Clearing Operations by mail: 30/F, One Exchange Square, 8 Connaught Place, Central, Hong Kong or by fax: 2590-7000 to obtain the Application Package.

Must a Settlement Agent be a CCASS Participant?

A Settlement Agent may be a non CCASS Participant as long as all the conditions and requirements in relation to appointing a Settlement Agent are met. When considering such application, the Settlement Agent would be assessed as if it were applying to become a CCASS Participant.

Can a non-IP Participant appoints a Settlement Agent, whose operation is located in a foreign jurisdiction?

In general, CCASS can be operated from a foreign jurisdiction, for more details, please refer to CCASS/3 – Frequently Asked Questions at http://www.hkex.com.hk/Global/Exchange/FAQ/Securities-Market/Clearing-and-Settlement/CCASS-3?sc_lang=en.

A non-IP Participant may, subject to HKSCC’s approval, appoint a Settlement Agent who is located in a foreign jurisdiction. Pursuant to CCASS Rule 3904, the non-IP Participant needs to provide a legal opinion confirming that such arrangement will not:

a. subject HKSCC, the Exchange or a recognized exchange controller to any legal, regulatory, reporting, registration or other requirements of the foreign jurisdiction;

b. deem HKSCC, the Exchange or a recognized exchange controller to be carrying on any business in that jurisdiction;

c. have any tax implications on HKSCC , the Exchange or a recognized exchange controller; and

d. affect the right of inspection by HKSCC to books, records or systems relating to CCASS or transactions conducted through CCASS in that jurisdiction.

The legal opinion shall be issued in such form as set out in Rule 3904 of the General Rules of CCASS. The non-IP Participant shall ensure that it complies with all applicable laws, regulations and requirements of the jurisdiction where its and its Settlement Agent’s CCASS Terminals, office premises or operations are located.

What other conditions should a non-IP Participant fulfill in order to obtain approval from HKSCC?

If a non-IP Participant is regulated under the Securities and Futures Ordinance “SFO”, then it should notify the Securities and Futures Commission (“SFC”) of its plan to outsource its operations to a Settlement Agent prior to applying to HKSCC. HKSCC will liaise with the SFC on receipt of an application from a non-IP Participant and obtain SFC’s consent on the outsourcing arrangement before approving the application.

In addition, non-IP Participants should notify HKSCC of any change of particulars arising from the appointment of Settlement Agent according to the existing procedures.

What are the key aspects that SFC would consider when assessing the outsourcing arrangement?

The Participant, which is a licensed corporation or registered institution, must ensure that it will continue to comply with all the requirements as set out in the SFO including but not limited to:

· Client Securities Rules

· Client Money Rules

· Contract Notes, Statements of Account and Receipts Rules

· Keeping of Records Rules

· Accounts and Audit Rules

The Participant should also ensure additional insurance would be taken up to cover the additional risks arisen as a result of the outsourcing arrangement.

The Participant and the Settlement Agent may be required to issue an undertaking to the SFC covering the above. Applicants are advised to contact the SFC direct to determine the SFC’s requirements on the undertaking.

Apart from SFC’s assessment, what are the key aspects that HKSCC would consider when assessing the Settlement Agent application?

When assessing the Settlement Agent application, HKSCC would consider key aspects such as:

· Whether the proposed SA is an existing CCASS participant and if it has a good track record;

· Whether the proposed SA has specified a designated person with adequate qualification to be responsible for ensuring compliance with the CCASS Rules & OP;

· Whether the proposed SA has an adequate operational risk control plan in place.

Is there any contractual relationship between the Settlement Agent and HKSCC?

As mentioned in Q. 1 above, despite the appointment of a Settlement Agent, the Participant’s principal obligation vis-à-vis HKSCC remains unchanged. As such, there is no direct relationship between HKSCC and the Settlement Agent.

What should be included in the service contract between the non-IP Participant and the Settlement Agent?

The business drivers, scope and service requirements of each outsourcing arrangement differ. The service contract should be a commercial agreement between the non-IP Participant and the Settlement Agent. Nonetheless, for regulatory purposes, the non-IP Participant and the Settlement Agent are required to undertake to the SFC that certain clauses have been incorporated in the service agreement. Applicants are advised to contact the SFC direct to determine the SFC’s requirement on the undertaking.

Can a non-IP Participant appoint more than one Settlement Agent?

No. A non-IP Participant is allowed to appoint one Settlement Agent only to operate CCASS on its behalf.

What if a non-IP Participant wants to switch Settlement Agent?

The non-IP Participant is required to submit a cancellation form and make a new application to HKSCC following the standard procedures. The cancellation form can be downloaded at http://www.hkex.com.hk/-/media/HKEX-Market/Services/Clearing/Securities/Getting-Started/Settlement-Agent-and-Access-to-CCASS-from-a-Foreign-Jurisdiction/cancel_form.pdf?la=en). Alternatively, participant can also make a request to the Clearing Administration & Services, Cash & Derivatives Clearing Operations by mail: 30/F, One Exchange Square, 8 Connaught Place, Central, Hong Kong or by fax: 2590-7000 to obtain the cancellation form.

Does a non-IP Participant need to appoint Delegated Administrators and end users after appointing a Settlement Agent?

Yes. The appointment of C3T Delegated Administrators (at least one maker and one checker to maintain user profiles of its end users) and end users (to perform various CCASS functions via C3T) should be authorized by the non-IP Participant.

Can non-IP Participants use their smartcards at CCASS Terminal installed overseas?

Non-IP Participants can use their Delegated Administrator and end user’s account to access CCASS Terminal installed overseas by 2FA or smartcard, while smartcard authentication method will be decommissioned on 4 September 2023 (Monday) tentatively. Depending on the administration rights assigned, Delegated Administrators can create, change, delete user profile and reset smartcard password (if applicable) of end users.

However, Participant should notify HKEX for user profile maintenance as well as reset smartcard password (if applicable) of Delegated Administrators by submitting the eService – DA 3 “CCASS/ CCMS Delegated Administrator Application/ Maintenance Form” in Client Connect through HKEX Access Management Portal (https://connect.hkex.com.hk/).

For technical details related to installing CCASS Terminal overseas, please refer to CCASS – Frequently Asked Questions at http://www.hkex.com.hk/Global/Exchange/FAQ/Securities-Market/Clearing-and-Settlement/CCASS-3?sc_lang=en

Can an Exchange Participant who has appointed a SA become an Non Clearing Participant (NCP)/ Non-China Connect Clearing Participant (NCCCP)?

An Exchange Participant can choose to become an NCP even if it has already appointed a SA. As an NCP is no longer a CCASS Participant, the SA appointment needs to be terminated as well. The Exchange Participant needs to terminate its CCASS Participantship, cancels the appointment of its SA and notifies SEHK of its appointment of any GCP. HKSCC then terminates the Exchange Participant’s CCASS Participantship, cancels its CCASS account and establishes clearing relationship between the Exchange Participant and its newly appointed GCP according to the specified effective date.

For an Exchange Participant who has already appointed a SA for its China Connect Securities Trades, and if subsequently the Exchange Participant wishes to become an NCCCP and appoint a GCP for the clearing of its China Connect Securities Trades, the Exchange Participant’s SA appointment on the China Connect Securities Trades needs to be terminated.

What are the clearing and settlement arrangements during Typhoon Signal No. 8 (or above) / Extreme Conditions / Rainstorm Warning?

Please refer to “Severe Weather Arrangement” at HKEX website

Example (14 Jul being not treated as a settlement day due to full day typhoon)

Mon	Tue	Wed	Thurs	Mon
12-Jul	13-Jul	14-Jul	15-Jul	16-Jul

Type of Trade	Trade Date	Original Settlement Date (SD)	Revised SD	Remark
CNS	12-Jul	14-Jul	CCASS automatically changes SD to 15-Jul	Actual settled on 15-Jul
CNS	13-Jul	15-Jul	CCASS automatically changes SD to 16-Jul	Actual settled on 16-Jul
SI/ISI	12-Jul	14-Jul	CCASS will NOT automatically change SD	Actual settled on 15-Jul
	13-Jul	15-Jul	CCASS will NOT automatically change SD	Actual settled on 15-Jul
	13-Jul	14-Jul	CCASS will NOT automatically change SD but CP can opt to change SD to 16-Jul according to CP’s commercial needs	Actual settled on 16-Jul

What is CCASS/3?

CCASS/3 is a significant technical upgrade of the Central Clearing and Settlement System (CCASS). It employs advanced technology by providing an improved user interface (MS internet Explorer browser) and the introduction of Participant Gateway (PG). Apart from the technology upgrade, new functionalities include new securities management system, Delegated Management System (DMS) and a Common Collateral Management System (CCMS).

What is C3T?

C3T (CCASS/3 Terminal) uses market standard Internet browser technology where Participants can access CCASS/3 using any PC equipped with a support versions of Microsoft Windows and browser. On-line functions are presented in HTML (windows), which provides a more user-friendly interface.

What is PG?

What is SDNet/2?

What are the considerations for Participants to install PG in addition to C3T?

It very much depends on the operational needs of a Participant. As PG supports straight-through-processing from PSS to CCASS/3, it is most useful for high volume data exchange where the same data already exist in PSS. Participants can evaluate their operational needs, the ability to develop and maintain the PG/PSS and the associated capital investment before installing PG.

Are there any restrictions on the number of C3T and PG to be installed in a Participant’s office?

There is no restriction on the number of C3T and PG to be installed in a Participant’s office.

Does C3T or PG support broad band communication?

Yes. Participants can subscribe to the highest CCASS/3 WAN connection line speed. The network bandwidth can reach up to 2M capacity for the WAN connection.

Are both C3T and PG using the same hardware configuration?

In general, they are quite similar, except PG demands higher capacity in terms of CPU, memory and local hard disk requirements.

Can Participants use C3T and PG at the same time?

Yes. Participants can use C3T and PG concurrently with one SDNet link.

What is the backup arrangement for C3T or PG in the event that either C3T or PG fails?

Participants can utilise the backup center services provided by HKEX in case of C3T failure in their offices. For PG failure, Participants may subscribe for dual PG to improve service availability, or use C3T as a backup for business contingency.

Is there any file format differences between C3T and PG?

Upload/download batch files format for C3T and PG are different. C3T uses the existing text based format while PG uses ISO compliant (or Tag-based) format.

What is the software configuration required for C3T?

Please note that HKEX will revise the compatible platform for C3T from time to time, Participants should refer to Section 7.1 of Terminal User Guide at the link https://connect.hkex.com.hk for the detailed C3T software configuration.

Can Participants open multiple browsers on the same C3T?

No. Participants should open only one browser on a C3T. If Participants open multiple browsers on the same C3T, these browsers could interfere with each other and cause processing errors.

If a Participant wants to install more than one C3T, are multiple network lines required?

Subject to the line speed, a single network line can support multiple C3Ts. In other words, a Participant can install multiple C3Ts in the same office using the same network line.

Can Participants install non-CCASS/3 related software in C3T?

Can a Participant access CCASS/3 by connecting the internal LAN in his office to the CCASS/3 network?

Yes, attaching C3Ts to an internal LAN which has connection with the CCASS/3 network is one way to access CCASS/3. However, Participants electing this access method should be aware of the need to implement Network Address Translation (NAT) when setting up their internal LAN. Each CCASS Participant is pre-assigned a range of IP addresses for defining his own C3Ts. CCASS/3 will validate the IP address when Participants attempt to logon CCASS/3 via C3T. When a Participant set up internal LAN in his office, the internal LAN may carry IP addresses different from the ones pre-assigned by CCASS/3. Under such situation, Participant should implement NAT so that CCASS/3 is able to recognise the IP address assigned to the C3T. In addition, the NAT should be a one-to-one mapping of the C3T. That is, IP address of each C3T should be translated to a unique value within the original IP address range.

Can Participants install the C3T in their overseas offices?

Yes, Participants can install the C3T in their overseas offices with HKSCC’s prior written approval. According to General Rules of CCASS (“CCASS Rules”) 3901, any Participant that wishes to install or to access and operate CCASS from a foreign jurisdiction must obtain HKSCC’s prior written approval. And Participants should obtain from a reputable law firm of a foreign jurisdiction a legal opinion issued in favour of HKSCC for the CCASS operation and the placement of the CCASS Terminal in a foreign jurisdiction in accordance with CCASS Rules 3904. For the details of access to CCASS from a foreign jurisdiction, please refer to CCASS Rules Chapter 39 (http://www.hkex.com.hk/-/media/HKEX-Market/Global/Exchange/FAQ/Securities-Market/Clearing-and-Settlement/CCASS-3/Can-Participants-install-the-C3T-in-their-overseas-offices/r39.pdf?la=en).

How can Participants connect to CCASS/3 from their overseas offices?

There are two options to arrange the connection:

1.	Participants can access CCASS/3 from their overseas office by extending their internal network in their Hong Kong office to their overseas office. The network connection arrangement will be transparent to HKEX and Participants may arrange by themselves.
2.	Alternatively, Participants may opt to access CCASS/3 from their overseas office by directly connecting the network of their overseas office to the CCASS/3 Network in Hong Kong. Feasibility of this alternative is subject to the availability of local network carrier in relevant overseas location which has service arrangement with the vendor of SDNet, the service provider of the CCASS/3 Network in Hong Kong. Participants who opt for this alternative should provide detailed address of their overseas office to HKEX. HKEX would forward the case to the vendor of SDNet for checking and the vendor of SDNet would get back to Participants accordingly. Participants should note that they would subject to the charges levied by the overseas carrier if this alternative is elected.

Participants can access CCASS/3 from their overseas office by extending their internal network in their Hong Kong office to their overseas office. The network connection arrangement will be transparent to HKEX and Participants may arrange by themselves.

Alternatively, Participants may opt to access CCASS/3 from their overseas office by directly connecting the network of their overseas office to the CCASS/3 Network in Hong Kong. Feasibility of this alternative is subject to the availability of local network carrier in relevant overseas location which has service arrangement with the vendor of SDNet, the service provider of the CCASS/3 Network in Hong Kong. Participants who opt for this alternative should provide detailed address of their overseas office to HKEX. HKEX would forward the case to the vendor of SDNet for checking and the vendor of SDNet would get back to Participants accordingly. Participants should note that they would subject to the charges levied by the overseas carrier if this alternative is elected.

In either case, Participants need to acquire their own PC which can meet the C3T configuration requirements. Participants can acquire smartcard readers and smartcards from HKEX for their C3T and operation staff in overseas office. Participants should note that HKEX would not provide any on-site support for the C3T installed in their overseas offices and Participants would need to perform C3T commissioning themselves.

What is the security measure for Participant to log on CCASS/3?

Access to CCASS/3 will be authenticated by a smartcard as the security token using a digital certificate.

How many smartcards will be issued to each Participant?

It depends on the number of users of each Participant. In general, one smartcard will be issued to one user.

Can a Participant use the same smartcard to access different C3T?

Yes. Participants can use the same smartcard to access different C3T installed in their offices.

Can Participants install the smartcard reader in a slim PC or is the smartcard reader an external device?

The smartcard reader is an external device.

Is smartcard reader required for all C3Ts?

Yes. Each C3T should be attached with a smartcard reader as the security device for Participants to access CCASS/3 using smartcard.

Can a Participant assign a single user as a Delegated Administrator (DA) handling both the maker and checker functions?