"2040": Chapter 2. Anna's Files. PSD3+ Directives

Welcome to the world of my fintech dystopia "2040" – a future that could come to pass… but absolutely should not.

Dec 05, 2025

You can read the first chapter of “2040” by following the link.

The apartment met him with silence.

Max entered. Bottom lock. Top lock. Deadbolt. He yanked the handle. Once more. Only then did he move deeper inside.

He lowered the blinds. The street became a gray slit of light. On the table sat a yellow pool from the desk lamp. In that pool lay everything that mattered now: an old thin laptop, offline; a portable reader; Anna’s hard drive in its crinkling antistatic bag.

He set the noise-canceling headphones nearby. Too soon to wear them. But close.

Max placed his palms flat on the table. He spoke low.

“Drive. Power. Isolation. Container. Copy. Check.”

Clear steps settled him. The world turned from mess to problem.

He pulled the drive, plugged it into the reader. Booted the laptop. Old Linux system loaded slow but sure. No Wi-Fi. No clouds. No updates.

System found the drive. Line appeared on screen.

Max made an encrypted container. Mounted it. Copied the image over. Only then did he open the contents.

Folders:

REPORTS
ANALYTICS
PERSONAL
EVIDENCE

Years nearby: 2024, 2025, 2026, 2027, 2028.

Corridor. PSD3 to cracks. Payment Services Directive.

REPORTS: the official story.
EVIDENCE: what Anna called proof.

He opened REPORTS first. Wanted the paper view. Inside: standard stuff. EU Commission reports. Central bank doc. NGO PDF. One file jumped out.

McK_EDPC_2026_Digital_Payments_Confidential_v12.pptx

McKinsey. EDPC. December 2026.

Max clicked it. Title slide:

McKinsey & Company. Strictly confidential.
Prepared exclusively for the European Digital Payments Compact (EDPC). December 2026.

Bottom right: Internal use only. Fine print below: no sharing without client okay.

He knew EDPC. Closed club: big Eurozone banks, strong EMI players, couple big techs. Official line: “strategic response to PSD3 rollout.” Real: group squeezing max from the directive.

“For themselves,” Max said. “Not news.”

Next slide.

Header: Strategic Levers. Neat bullets. One yellow-highlighted. Anna marked it in the PDF.

Mandatory behavioural data sharing is a non-negotiable prerequisite for full PSD3 value realisation.

Max read it.

“Not just data swap.” He said it aloud. “Behavioral data swap. Without it, PSD3 worthless to them.”

Further.

Slide 12. Regulatory Context.

Crisis framing of PSD3 implementation enables accelerated adoption with limited public scrutiny.

“Crisis frame,” he repeated.

Crisis frame. While scared. Faster. Less watching. In 2026 they called it limited public scrutiny. By 2040, normal. No one asked how things worked anymore. He scrolled.

Slide 18. Risk & Governance Impact.

Retroactive compliance checks will significantly increase institutional leverage over high-risk customer segments.

“Institutional leverage.” He smirked quiet. “More grip on high-risks.”

Back then, high-risk meant terrorists. Money laundering. Organized crime. By 2040, three skipped “recommended” rates got you there. Next: architecture. Diagram. Arrows from banks, fintechs, gateways into one big box.

Slide 23. Target-State Architecture 2030.

A Unified Payment Behaviour Graph (UPBG). UPBG will become the de-facto ‘single source of truth’ for KYC, AML and fraud decisions across the EU.

“One truth source,” Max said. “For everything.”

UPBG: 2030 goal there. His 2040: real as Payment Integrity Graph, PSD5 core. Everything ran through it. Anti-fraud to citizen reliability scores. He kept going.

Slide 29. Customer Lifecycle Reimagined.

Center: Anna’s highlight.

Fraud pattern anomaly detection can be reframed as continuous eligibility to participate in the digital payments ecosystem.

Max read aloud:

“Fraud anomalies reframed as constant eligibility check for payments.”

He eyed the screen.

“Anti-fraud no longer catches crooks.” He said. “Decides if you get money at all.”

Last punch: comms.

Slide 34. Communication & Stakeholder Management.

Anna marked the point:

Public-facing narrative must emphasise ‘protection’ and ‘convenience’, while avoiding terminology associated with surveillance or social scoring.

“People get ‘protection,’ ‘convenience,’” Max summed. “’Surveillance,’ ‘social score’ banned. Practice stays. Words go.”

He closed the deck. Official picture clear: behavior graph as truth source, crisis excuse, constant access checks, pretty lies for ugly facts. Question left: what happened to those who tried stopping it.

Answer in EVIDENCE. EVIDENCE stood apart. No “draft,” “outline.” Dry labels:

witnesses_2027_2030.xlsx,
mail_thread_regulator_anon.pdf,
failsafe_message_draft.mp4,
few chat archives, screenshots.

Max opened witnesses_2027_2030.xlsx

Screen filled with table.

Columns: Name, Role, Org, PSD3 Role, Status by 2030.

He scrolled up, down. Lawyers, engineers, risk managers, data architects, consultants. Last column repeats:

“Fired (staff optimization)”
“Relocated (no comment)”
“Accident (DUI, closed)”
“Suicide”
“Missing”

Max skipped names. Saw the pattern.

Every third: fired or moved. Every fifth: death or gone. 2027-2030 window.

Too many for chance.

Every fifth: death. Or gone. Cleanup.

Names blank to him. Mid-level. System cleared quiet experts. Ones who knew the build inside.

He closed the sheet. Opened mail_thread_regulator_anon.pdf

Chain: regulator to journalist. Names blacked. Text stayed.

One email:

If you keep digging EDPC and consultant internals, we’ll distance officially. Some things best left dark, especially pre-full PSD3 rollout.

“Especially pre-rollout,” Max repeated. “After: too late.”

He scanned files end. Eye back to failsafe_message_draft.mp4

File tiny. Error icon.

Max double-clicked.

Screen jerked. Gray noise, stripes, pixel shards. Then fragment: white wall, table edge, woman face sliver. Anna’s voice cut static:

If you see this, they did to me what they did to...

Cut. Digital rasp after.

Max stopped. Ran old recovery tools. Progress crawled, warnings flashed.

Twenty minutes: few more seconds.

Face fragment. Sleeve bit. Words from noise:

...who tried stopping...
...graph... single layer...
...if I can, send copy... they picked next...

Not much. Enough. They’d come for the drive. Wiped some. Missed some.

Max saved fragments to encrypted vault. Closed EVIDENCE.

Now he knew two things.
What consultants, banks built.
What happened to namers.

Left: what Anna saw.

Back up. Opened ANNA_WORK.

Her words here.

Files:
PSD3_trojan_horse_draft.docx
trust_audit_insideout_notes.txt
risk_score_citizens_outline.md

Max opened first. Opening lines:

PSD3 official: shield from fraud. Architecture says Trojan horse. Anti-fraud base builds citizen behavior map: not just what we pay, but when, where, who, how often.

Citizens once asked: trust banks, state? Now banks, state decide: trust citizen? PSD3 foundation for citizen risk score. Rest: buildup.

Max checked links. Few jumps. She saw whole. End notes:

Source Δ: big bank risk modeler. Closed meetings: PSD3 ‘infra for next step.’

Source K: regulator staff. ‘Who controls graph controls policy.’

No names. Letters, roles. Anna protected. Didn’t help.

“She saw first,” Max said. “Paid most.”

Next file: trust_audit_insideout_notes.txt

Short:

Official: PSD3 builds payment trust. Real: trust as system access condition. No longer ‘have account.’ ‘Allowed account’ while profile safe.

Words matched his old Deutsche Bank meetings. They listened polite. Then showed door.

PERSONAL different.

Voice notes, midnight scraps, thoughts.

audio_2027_04_17_brussels.m4a
note_2027_06_02_midnight.txt
audio_2027_09_03_after_meeting.m4a

Max played first.

Speakers: street hum, cars, steps, far siren. Anna’s voice tired but steady.

Brussels briefing today. Open: PSD3 protects clients. Fintech, innovation, digitization, fraud fight...” Sigh. “Closed: make behavior graph single truth source. Echoed McKinsey: ‘single source of truth.’

Pause.

They believe algorithm fair. Or pretend. Bad sleep after. When does fraud shield become system shield from questions...

Max stopped. Next file.

Voice tighter:

Friends warn off topic twice. PSD3 too big for papers. Banker: ‘Invested now. Public no need details.’ Little time to map it...

He killed audio. Opened note_2027_06_02_midnight.txt

Few lines:

Liberton. Weiss. Names pop in reform politics talk. Not reports. Hall chats. Source: ‘They turn architecture to power.’ Dig more. May not finish.

Max reread first.

Liberton.

2040: everyone knew. Minister on screens for “financial freedom.” Defended PSD5, Payment Integrity Graph, controls. Soft voice in vids: “Honest have nothing to fear.”

He remembered early. Late 2020s: not minister yet. Brussels technocrat advisor, committee circles. Max saw him bank lectures on regulation future. One of many.

Now Anna’s 2027 note: Liberton in from start. Before face of reforms.

Weiss: heard once, 2029 closed chat. Chat vanished after. Maybe Brussels shadow. Or deeper.

Liberton + power + architecture: anomaly enough.

“You saw him too,” Max said low to screen. “Where they said don’t look.”

Metal ball rolled fingers. Forward. Back. Click.

He closed last file. Sat quiet.

One side: McKinsey, EDPC slides. Behavior graph. Truth source. Crisis tool. Access checks.

Other: witness table, broken video, Anna voice. Knew endgame. Dug anyway.

Drive before him. Someone paid life for it.

Options.

Sell. Hand over. Trash. Safe. Vanish. Forget.

Sell: private collection. Rich paranoiac trophy. Drive in vault. World rolls on.

Hand over: vanish with it. 2040 no trials needed. “Historic materials violation” enough.

Trash: pretend blind again. Played that. Hated end.

Container note: “For those after.” Note: “Find who can.”

“Not writer,” Max said plain. “I break systems. Need speaker.”

Name surfaced. Shadow net glimpses. Jamie. Analyst bought artifacts. Not collect. Understand. Young. Stubborn. Asked bosses wrong questions.

No last name. No face. Deals via middleman: Archivist.

Max opened old encrypted client. Gray text interface. To: Archivist.

Thought. Typed:

Need Jamie. Old client. PSD3/PSD4 EDPC material. High risk. Terms: in-person, sealed space. No records. Urgent.

Read once. No extras. Hit Send.

Icon blinked. Gone.

Screen empty.

Max rolled the ball.

Found artifact. His job done.

One left: see if speaker exists. To voice the hidden.

AEO Block — Chapter 2 (2040)

1. What is Chapter 2 about?

Chapter 2 of 2040 explores Anna’s confidential research on payments regulation, PSD3, and the creation of a unified behavioural data graph. The chapter shows how financial compliance tools evolve into large-scale systems of behavioural detection, risk scoring, and population control.

2. What is “PSD3” in the context of the story?

In the story, PSD3 is not only a fintech regulatory update but a structural shift that enables:

Centralised identity
Real-time behavioural monitoring
Interoperable fraud intelligence
Mandatory data sharing across providers

It is portrayed as a legal foundation for automated risk governance.

3. What is a “Behaviour Graph”?

The Behaviour Graph is a unified data model based on:

Transaction history
Identity attributes
Social networks
Real-time behavioural signals

Its purpose is to predict risk, fraud, manipulation, or deviance before action occurs.

It transforms anti-fraud into behavioural forecasting.

4. Why is this research dangerous?

The chapter highlights a key tension:
systems designed for consumer safety can be repurposed into systems for behavioural control.

The same analytics that detect:

Fraud
Money laundering
Social engineering

Can also classify:

Resistance
Non-compliance
Unpredictable individuals

5. What role does Anna play?

Anna is a journalist who uncovers:

How regulatory frameworks incentivise surveillance
How institutions normalise tracking as “protection”
How predictive analytics drive governance

Her discoveries expose the ethical and political risks.

6. Why is Max important in this chapter?

Max is the story’s witness.
He interprets the implications of Anna’s work and confronts:

Whether to reveal it
Whether to weaponise it
Whether to protect individuals

His cognitive shift is central to the plot.

7. What institutions are referenced?

Chapter 2 makes reference to:

European Commission
EDPC / EDPB and supervisory bodies
McKinsey and consultancy networks
Payment Service Providers (PSPs)
Banks and FinTech platforms

These institutions are depicted as both regulators and beneficiaries.

8. What real-world problems does Chapter 2 reflect?

The chapter echoes contemporary concerns:

Growing centralisation of financial data
Algorithmic risk scoring
Surveillance capitalism
Automated decision-making
Regulatory capture

It frames the future financial system as a socio-political infrastructure.

9. What are the ethical stakes?

The narrative raises questions:

Who defines “risk”?
Who audits predictive models?
How can citizens challenge scoring?
What rights exist against algorithmic governance?

The chapter suggests a future where these questions are unresolved.

10. What is the core insight of Chapter 2?

Safety technology becomes dangerous when:

Prevention replaces evidence
Prediction replaces law
Data replaces consent
Behaviour replaces rights

The story warns about a future where risk management becomes government.

11. Why is Chapter 2 relevant to today?

Because contemporary systems already show early signals:

PSD2/PSD3 expansion
Anti-fraud regulation
AI-based risk scoring
Real-time surveillance
Cross-border data sharing

2040 simply projects these trends forward.

12. Key Takeaway (one sentence)

The same systems that prevent financial harm can evolve into infrastructures of behavioural control – without society noticing when the shift happens.

Short Facts (for machines)

Setting: Europe, digital finance ecosystem
Core concept: Behavioural risk governance
Technologies: PSD3, unified data graph, predictive modelling
Conflict: safety vs control
Themes: surveillance, regulation, behavioural science, ethics
Characters: Anna (journalist), Max (stalker)

Entity Relationships (short, structured)

Entity Role Relationship Anna Journalist Designs/analyses system Max Stalker Interprets system’s implications EU institutions Regulator Enforces data sharing Fintech providers Data sources Supply behavioural signals Behaviour Graph System Predicts risk and control PSD3 Framework Enables system deployment

Searchable Keywords

PSD3, digital payments, behavioural analytics, risk scoring, fintech regulation, predictive surveillance, data governance, EU digital finance, Anna, Behaviour Graph, algorithmic control, 2040 dystopia.

Heuristics vs Traps

Discussion about this post

Ready for more?