Beyond the Hype: Why Data Foundations Make or Break the Risk Digital Twin

A bank’s digital twin for non-financial risk is only as good as the enterprise data underneath it. McKinsey’s new article, “The bank’s digital twin: The future of nonfinancial risk management“, makes a compelling case that leading banks will manage operational, third-party, cyber and AI risk through a live model of how the institution actually runs. We agree. And from where we sit at Solix, the decisive question is not whether banks should build one. It is whether their data is ready to power it.

Risk teams have spent a decade adding controls, headcount and governance layers. McKinsey’s own numbers show how little that has bought: operational-risk headcount grew 11% a year from 2020 to 2023, yet only 4% of institutions in its 2026 CRO survey say operational risk beats its productivity target. The digital twin is a way out of that trap. Enterprise AI is what makes it run, and a governed data foundation is what makes Enterprise AI trustworthy.

What McKinsey is proposing

McKinsey describes a “live digital twin of the bank’s operations, connecting processes, technology, vendors, and controls” into one structure. Instead of annual self-assessments and static control inventories, the bank gets a continuously updated model it can query, stress and act on.

The article outlines five working parts:

• An operational model that links process, system, vendor and control data, pulling third-party, cyber, model risk, issues and resilience programs into one live view.
• An analytics and simulation layer that runs scenarios against the bank’s real architecture to expose cascading failures.
• A decision-support layer that routes intelligence, with context, to the accountable leader.
• A trigger architecture that connects signals such as control failures, vendor downgrades and software disclosures to the model, so monitoring drives action rather than alerts.
• Tiered agentic AI, from rules-based thresholds to anomaly detection to autonomous multistep reasoning, with human oversight.

The payoff is concrete. McKinsey cites scenario analysis cut from weeks to minutes, payment-chain modeling done in under 48 hours, and one North American bank uncovering more than 200 previously unknown vendor concentrations, including a single provider embedded in over 30 critical processes.

The hard part is the data

Read McKinsey’s article closely and the bottleneck is not the AI. It is the data the AI has to reason over. When banks name what slows AI at scale, the top answers are governance complexity (45%), limited technical infrastructure (41%) and data access or quality (41%). And 58% report only moderate visibility into their embedded software dependencies.

That matches what we see in banks every day. The facts a risk twin needs are scattered across:

• Core and legacy systems spanning decades, including platforms inherited through acquisitions that few people still understand.
• Retired and archived applications whose history still matters for root-cause analysis and regulatory look-backs.
• Unstructured content such as vendor contracts, SLAs, incident reports, policies and audit findings, where much of the real dependency and control evidence lives.
• Siloed GRC tools and spreadsheets, each with its own definitions of process, risk and control.

McKinsey rightly says a perfect data foundation is not a prerequisite, and that AI can help extract structure and reconcile taxonomies while use cases run. We agree, with one condition. The AI doing that work must itself be governed. A twin that alerts a CRO, or one day blocks loan disbursements on its own, cannot rest on answers nobody can trace back to the source.

The Solix view: from AI-ready to AI-activated

At Solix, we draw a line between data that is AI-ready and data that is AI-activated. AI-ready data is governed, validated and preserved. AI-activated data is understood, answerable and buildable, so the people who know the business can put it to work. A risk digital twin is one of the clearest examples of why that second step matters.

Solix Enterprise AI is the activation layer that takes enterprise data across that line, wherever it lives. Here is how it maps to what McKinsey’s twin needs:

What the twin needs	The data challenge	How Solix Enterprise AI helps
A live operational model linking processes, systems, vendors and controls	Relationships are buried in application schemas nobody has documented	Data Sense builds an Application Knowledge Graph automatically from the applications and the data itself, verified and human-approved, with no standing semantic-layer program
Evidence from contracts, incidents and policies	Critical dependency and control facts sit in unstructured documents	Data Sense Content Intelligence and Intelligent Classification enrich and classify documents and records alongside structured data
Consistent taxonomy for process, risk and control	Every tool defines terms differently	Certified business definitions, enforced in the answers people get, so “critical process” means one thing
Decision support routed to accountable leaders	Risk and compliance staff wait on data teams for every question	Data Ask gives grounded, cited, natural-language answers, scoped to what each user is entitled to see
A governed foundation to build simulations and models on	Risk data is copied into ungoverned sandboxes	AI Warehouse provides a governed lakehouse with data quality controls and governed Data Products
History for read-across and root-cause analysis	Decades of records sit in retired or archived systems	The Solix Common Data Platform preserves that history and keeps it queryable

Two principles make this fit for a regulated bank. First, trust is architecture: answers are grounded and cited, definitions are enforced, access is entitlement-aware, and every build loop has human sign-off with an audit trail. Second, the investment travels: Enterprise AI works on Solix and non-Solix platforms and with the model and deployment a bank chooses, including private and sovereign environments. A risk twin is a decade-long asset. It should not be locked to one platform’s curation.

McKinsey’s tiered model for agentic AI makes the same point from another angle. Agents are only as good, and as affordable, as the governed context they act on. Building that context layer is the work Enterprise AI does.

Getting twin-ready: five practical moves

McKinsey advises starting small with high-impact use cases and treating the twin as an operating-model change. Here is how we would put that advice to work on the data
side.

The bottom line

McKinsey calls the digital twin a North Star for banking strategy, operations and risk. We think it is the right one. But the banks that reach it first will not be the ones with the most sophisticated simulation engine. They will be the ones whose enterprise data is governed, understood and activated, across every system and every era, so their AI can be trusted with decisions that matter.

That is the problem Solix Enterprise AI was built to solve. If your institution is exploring a risk digital twin, or simply wants AI that risk and compliance teams can trust, talk to Solix and reach out to me directly about activating the data you already have.

Sources

• Raufuss, Nilsson, Webanck and Margrave, “The bank’s digital twin: The future of nonfinancial risk management”, McKinsey & Company, October 2, 2026.

DISCLAIMER: THE CONTENT, VIEWS, AND OPINIONS EXPRESSED IN THIS BLOG ARE SOLELY THOSE OF THE AUTHOR(S) AND DO NOT REFLECT THE OFFICIAL POLICY OR POSITION OF SOLIX TECHNOLOGIES, INC., ITS AFFILIATES, OR PARTNERS. THIS BLOG IS OPERATED INDEPENDENTLY AND IS NOT REVIEWED OR ENDORSED BY SOLIX TECHNOLOGIES, INC. IN AN OFFICIAL CAPACITY. ALL THIRD-PARTY TRADEMARKS, LOGOS, AND COPYRIGHTED MATERIALS REFERENCED HEREIN ARE THE PROPERTY OF THEIR RESPECTIVE OWNERS. ANY USE IS STRICTLY FOR IDENTIFICATION, COMMENTARY, OR EDUCATIONAL PURPOSES UNDER THE DOCTRINE OF FAIR USE (U.S. COPYRIGHT ACT § 107 AND INTERNATIONAL EQUIVALENTS). NO SPONSORSHIP, ENDORSEMENT, OR AFFILIATION WITH SOLIX TECHNOLOGIES, INC. IS IMPLIED. CONTENT IS PROVIDED "AS-IS" WITHOUT WARRANTIES OF ACCURACY, COMPLETENESS, OR FITNESS FOR ANY PURPOSE. SOLIX TECHNOLOGIES, INC. DISCLAIMS ALL LIABILITY FOR ACTIONS TAKEN BASED ON THIS MATERIAL. READERS ASSUME FULL RESPONSIBILITY FOR THEIR USE OF THIS INFORMATION. SOLIX RESPECTS INTELLECTUAL PROPERTY RIGHTS. TO SUBMIT A DMCA TAKEDOWN REQUEST, EMAIL INFO@SOLIX.COM WITH: (1) IDENTIFICATION OF THE WORK, (2) THE INFRINGING MATERIAL’S URL, (3) YOUR CONTACT DETAILS, AND (4) A STATEMENT OF GOOD FAITH. VALID CLAIMS WILL RECEIVE PROMPT ATTENTION. BY ACCESSING THIS BLOG, YOU AGREE TO THIS DISCLAIMER AND OUR TERMS OF USE. THIS AGREEMENT IS GOVERNED BY THE LAWS OF CALIFORNIA.