docs: protect client funds from unauthorized contractor custody

[zolotokrylin]

Summary

• Adds a Fund Handling section to STANDARD_TERMS.md:
  • Contractors must not hold, control, or disburse client funds under any circumstances
  • Any such request from a client must be declined and reported to an Authorised Issuer immediately
  • Contractor is responsible for investigation and remediation costs if a loss results from a breach
• Updates CHANGELOG.md with a v1.2.0 entry

Background

Motivated by holdex/hr-internal#782, where a community manager operated a client's hot wallet for ~10 months without any policy in place. Legal review concluded that while the activity is currently in a regulatory grey area in HK, the SFC/FSTB are expanding the VA custody and dealing licensing regime in 2026. A flat prohibition is the correct position given Holdex has no infrastructure to comply with the incoming regime.

Next steps after merge

• Tag v1.2.0
• Publish a GitHub release
• Email all active contractors with 14-day notice per the Updates section

Test plan

• Review wording for consistency with the rest of the Standard Terms
• Confirm all internal links and anchors resolve (lint will catch this)

Summary by CodeRabbit

• Documentation
  • Added a Fund Handling clause: contractors must not hold, control, or disburse client funds; any such request must be declined and immediately reported to an Authorised Issuer
  • Contractors now bear full losses and reasonable investigation/remediation costs for breaches of this clause
  • Updated Indemnification: liability cap no longer applies to breaches of the Fund Handling clause

[coderabbitai]

Walkthrough

Adds a Fund Handling clause to CHANGELOG.md and STANDARD_TERMS.md prohibiting Contractors from holding, controlling, or disbursing client funds, requiring declination and immediate notification to an Authorised Issuer, and making the Contractor liable for full losses plus investigation/remediation costs; expands Indemnification liability-cap exceptions to include breaches of this clause.

Changes

Cohort / File(s)	Summary
Changelog & Terms CHANGELOG.md, STANDARD_TERMS.md	Added a new "Fund Handling" section prohibiting Contractors from holding/controlling/disbursing client funds; requires declining client requests and notifying an Authorised Issuer immediately. Contractor liable for full fund losses and reasonable investigation/remediation costs.
Indemnification Update STANDARD_TERMS.md	Expanded the Liability Cap exceptions so liability is uncapped for breaches of the new Fund Handling section (in addition to willful misconduct/gross negligence).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• docs: view updated terms #2 — Modifies STANDARD_TERMS.md Indemnification/liability-cap area; related to expansion of uncapped exceptions.

Suggested reviewers

• markholdex

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title accurately captures the main change: adding a Fund Handling section that prohibits contractors from holding client funds.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch update/fund-handling-policy

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[holdex]

Time Submission Status

Member	Status	Time	Action	Last Update
zolotokrylin	✅ Submitted	1h	Update time	Apr 15, 2026, 10:31 AM
markholdex	✅ Submitted	20min	Update time	Apr 15, 2026, 10:31 AM

---

You can submit time with the command. Example:

@holdex pr submit-time 15m

See available commands to help comply with our Guidelines.

[zolotokrylin]

@holdex pr submit-time 1h 15m

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@STANDARD_TERMS.md`:
- Around line 258-261: Summary: The "Incident Costs" clause currently ties
fund-loss recovery to "Indemnification" which may be limited by the "Liability
Cap" unless gross negligence/willful misconduct is proven; add an explicit
carve-out so fund-loss indemnification is not capped. Fix: amend the "Incident
Costs" paragraph (the clause labeled "Incident Costs") to state that losses of
client funds resulting from the Contractor's breach are recoverable in full and
are not subject to the "Liability Cap" (or only subject to the cap except for
losses caused by gross negligence/willful misconduct), and/or add a
corresponding exception in the "Liability Cap" clause to explicitly exclude
fund-handling losses from the cap; ensure references to "Indemnification",
"Liability Cap", and "gross negligence/willful misconduct" are updated to
reflect the carve-out so readers can locate and verify the change.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f9f92bb9-a76c-48e9-8dcc-ebefa0e71340

📥 Commits

Reviewing files that changed from the base of the PR and between e9ec4b1 and ea77057.

📒 Files selected for processing (2)

• CHANGELOG.md
• STANDARD_TERMS.md

[markholdex]

@holdex pr submit-time 20m