麦肯锡-银行数字孪生：非金融风险管理的未来 The banks digital twin The future of nonfinancial risk management

October2026

Mckunsey

&company

Risk&ResilienceandFinancialServicesPractices

Thebank’sdigitaltwin:

Thefutureofnonfinancialriskmanagement

Theriskfunction’sfundamentalpurposehasnotchanged,butthenatureoftherisks,thepaceatwhichtheymaterialize,andthetoolsavailableto

managethemhave.

byAnkeRaufuss,BjörnNilsson,andLauraWebanck

withAndrewMargrave

Nonfinancialrisk(NFR)hasalwaysbeendifficulttomanagewell.Unlikecreditormarketrisk,itresistsneatquantification,spansorganizationalsilos,andoftenmaterializesinwaysnosingle

functionwasdesignedtoanticipate.Thetypicalresponsehasbeenmorecontrols,moreheadcount,andmoregovernancelayers.Thisresponsehasnotkeptpace.

Theinstitutionsmakingthemostprogresspointtowardadestinationthatwouldbea

fundamentallydifferentmodelformanagingnonfinancialrisk:alivedigitaltwinofthebank’soperations,connectingprocesses,technology,vendors,andcontrolsintoaunifiedstructurethatmakesriskvisible,testable,andsubjecttocontinuousmonitoring.

Inthisarticle,welookatwhatalivedigitaltwinmakespossiblefornonfinancialrisk

management,whatbankingcanlearnfromotherhigh-stakesindustriesthathavealreadysolvedversionsofthisproblem,thesevendecisionsitchangesforchiefriskofficers,andhow

institutionscanbeginbuildingtowarditwithoutwaitingforperfectdataoracompletedtechnologytransformation.

Thescaleoftheproblem

Thescaleofnonfinancialriskscontinuestogrow.Institutionsarefacingrisksthatescalate

withinminutesorhoursinsteadofdaysorweeks.Inadditiontohistoricalissueslikeflawedtechupdates(boththosepushedbycriticalthirdpartiesandwithininstitutionsthemselves),weare

seeingnewtypesoffraud,moneylaundering,andvulnerabilityexploitationatpacesthatareonetotwoordersofmagnitudefasterthaninthepast.

Institutionsneedtomanageriskatspeedandrequirean“always-on”platformtomakethatpossible—onethatprovidesbothinstantlyqueryableinformationandtrigger-basedalertsforspikesinactivityormoneymovementthatcouldbeasignofanunfoldingriskevent.More

peoplealonecannotsolvethisproblem.

McKinsey’sGlobalRiskProductivityBenchmarkshowsthatoperational-riskfull-timeequivalent(FTE)headcountgrewby11percentperannumbetween2020and2023.Yetthefunction,

whichexpandedfasterthanotherrisktypes,performsworstonproductivity:Only4percentofrespondentsinour2026CROFlashSurveyof23leadingglobalinstitutionsreportoperationalriskexceedingitsproductivitytarget,comparedwith22percentforcreditrisk,whichreducedFTEintensityby7percentannuallyoverthesameperiod(Exhibit1).

Theproblemisnotgettinganybetter.Ecosysteminterdependencieshavemultipliedsharply:58percentofinstitutionsreportonlymoderatevisibilityintoembeddedsoftwarecomponent

dependencies,meaningmostcannotmaptheirfullexposuretoasinglecriticalvendor,whichisexactlythegapthatvendordependencymapping,asafirstdigital-twinusecase,ispositioned

toclose(Exhibit2).Someregulatorsaremovingtoclosethatgapdirectly:TheUK’sFinancial

ConductAuthoritynowrequiresfirmstomapandtestdependenciesacrosscriticalthirdparties.1

1Policystatement26/2:Operationalincidentandthirdpartyreporting,FinancialConductAuthority,March2026.

Thebank’sdigitaltwin:Thefutureofnonfinancialriskmanagement2

Thebank’sdigitaltwin:Thefutureofnonfinancialriskmanagement3

Whatotherindustriescanteachbankingaboutresilience

Threeindustryexamplesdrawdirectparallelstobanking,includingmining,nuclearpower,andaviation.Eachcontinuallymanagessystematicriskacrossinterconnectedsystemsunder

conditionswherethecostoffailureismeasurednotindollarsbutinlives.

Miningandheavyindustry:Operationaldigitaltwinsinpractice

Energy,mining,andheavymanufacturinghavedevelopedsophisticatedriskmanagement

frameworkspreciselybecausethemagnitudeofacatastrophiceventdemandsit.InAustralian

miningoperations,safetycultureisbuiltupontheassumptionthatcomplexsystemswillfailin

unexpectedways,andthatresiliencecomesfromunderstandingfailuremodesbeforethey

occur,notmerelyfromcontrollingknownhazards.Miningoperatorshavebuiltoperationaldigitaltwinsthatserveaslive,queryablemodelsofmineoperationsandmaintenancesystems,

enablingthemtosimulatetheeffectsofequipmentfailures,scheduledisruptions,ordemandshocksbeforemakingchangestothephysicalsystems.Theabilitytoevaluateoperational

decisionsinasimulatedenvironmentbeforeexecutingthemhasmateriallyreducedboth

unplanneddowntimeandincidentrates.Thesamelogicappliestobankingoperations.Beforepushingacore-systemupgrade,rotatingacriticalthird-partyvendor,orrollingoutanew

paymentrail,abankcouldrunthechangethroughadigitaltwinofitstechnologystack,

transactionflows,andcontrolenvironmentfirst,surfacinghowafailurewouldcascadethroughprocesses,customerchannels,andreportingbeforeitevertouchesproduction.

Nuclearpower:Learningfromnearmisses

Oneofnuclearpowergeneration’ssignaturecontributionstoriskmanagementisthesystematictreatmentofnearmissesandweaksignals.Anomaliesaredocumented,analyzed,andsentbackintooperatingprocedureswiththeassumptionthatanearmissisanearhit.Thesameprincipleextendstomodeling:Alargeelectricutilityusessimulationagentstobuilddigitalinstancesofitsinfrastructureacrossnuclearfuelsites,modelinghowoperationalriskspropagatebeforethey

materialize.Thisisthesamelogicabankingdigitaltwinwouldapplytointerconnected

processes,vendors,andcontrolstoclosethegapbetweenknowingwherethird-partyexposuresitsandhavingtestedaresponseforit.

Aviation:Systematiclearningandsimulation-basedtraining

Aviationhaslessonsinitssystematicapproachtolearningfromoperationaldata,gatheringdatafromeveryflight,investingafternearmisses(notjustaccidents),andcontinuouslyupdating

practices.Butequallyrelevantforbankingiswhathappensinthesimulator.Pilotsareroutinelyexposedtoemergencyscenariostheymayneverencounterinthenormalcourseofflying,

buildingthejudgmentandcrisisresponsecapabilitythatcannotbeacquiredthroughnormalflighthoursalone.

AsAItakesonanincreasingshareofanalyticalandjunior-leveltasks,riskprofessionalswill

havefeweropportunitiestodevelopjudgmentthroughdirectexperience.Thelearning-by-doingpathwayisnarrowing:Therewillbefewerpeopleonriskteamswhohavebuiltacreditmemo,

Thebank’sdigitaltwin:Thefutureofnonfinancialriskmanagement4

runanonboardingorthird-partydiligence,ordraftedarisk-and-controlself-assessment

(RCSA)fromscratch.Simulation-basedtrainingenvironments,builtonthesamedigital-twininfrastructure,canexposebankersandriskprofessionalstostressscenariosthatnormal

operationswouldrarelyproduce,buildingthecrisisjudgmentthatnoamountofroutineworkcansubstituteandidentifyingtheareaswherebusinessandriskprofessionalsmayhavegapsforfurthertraining,learning,andreinforcement.

Anewperspectiveonriskmanagement

It’snolongerenoughforbankstosimplyidentifyandcontrolstand-alonerisks.Control-centricapproachesgenerateriskinventoriesandreports,buttheyoftendon’trevealhowriskspreadsthroughinterconnectedsystems,howabankwouldperformunderstress,orhowquicklyit

wouldrecover.Banksneedresilience:theabilitytorespondwithconfidenceinacrisis,prioritizewhatmustbeprotected,andemergestrongeraftereachevent.Buildingadigitaltwincangiveriskfunctionsthetoolsandinformationtodothat.

Banksmaysoonoperatefull-scaledigitaltwinsoftheirbalancesheetsandcriticaloperations,monitoringbothfinancialandoperationalresiliencecontinuouslyandapplyingriskappetite

moredynamicallytomakefaster,better-informeddecisions.

Adigitaltwinofabank’soperationsexpandswhatriskmanagementcandeliver.Itprovidesalive,up-to-datereadonwhereriskisconcentratingandwhichdependenciesarethemost

fragile.Italsoenablesfaster,enterprise-wideissue-and-incidentresponsethroughan

automatedread-acrosscapabilitythatflagsanalogousexposuresthemomentaproblem

surfacesanywhereintheinstitution.Finally,itsupportstargeted,root-cause-focusedactionthataddressestheunderlyingdriverofariskratherthanjustitssurfacemanifestation.

Thedigitaltwinchangessevencoredecisionseverychiefriskofficer(CRO)makes:

—Always-onriskassessment:Movefrompoint-in-timerisk-and-controlself-assessments,

refreshedonceayearandoutofdatealmostimmediately,toamodelinwhichcontrolsandrisksarerescoredcontinuouslyasprocessesrun,sotheviewofriskisalwayscurrentratherthanastalesnapshot.

—Connectedriskintelligence:Replaceriskdatafragmentedacrosssiloedtoolsand

spreadsheetswithrisks,controls,issues,andincidentslinkedinonelivemodel,givingeverystakeholderasingle,connectedviewofexposureinsteadofreconcilingconflictingreportsfromdifferentsystems.

—Scenarioanalysisandstresstesting:Simulatethecascadingimpactofavendorfailure,

majorcyberevent,orsignificantregulatorychangebeforeitoccurs.Understandingthe

second-andthird-ordereffectsofacriticalvendorgoingofflinetypicallyrequiresweeksof

Thebank’sdigitaltwin:Thefutureofnonfinancialriskmanagement5

manualanalysistoday.Adigitaltwincanreducesingle-scenariopropagationanalysisto

minutes.Broaderarchitecturalassessments,suchasmodelingafull-payment-processing

chain,havebeendemonstratedinunder48hoursforearlyadoptersofdigital-twin-like

capabilities.Thisenablesashiftfromperiodicanalysistocontinuousoperationalawareness.

—Read-acrossandroot-causeidentification:Whenanissuesurfacesinonepartofthe

institution,instantlyidentifyallanalogousexposureselsewhereandtracetotheunderlyingrootcause.Today,institutionslargelyhandleissuesoneatatime;acontrolfailureinone

businesslinemayindicateidenticalexposureacrossdozensofothercontextsthatgoundetecteduntiltheproblemrecurs.

—Concentrationriskandnth-partydependencymapping:Revealhiddensinglepointsof

failurethatmanualassessmentsmiss.Thedigitaltwinmaps

nth-partydependencies

,tracingcriticalbusinessservicesthroughtheirfulltechnologyvendorchains,andsurfaces

concentrationsautomaticallyandcontinuously.

—Automatedchangeimpactassessment:Whenachangeoccurs,forexample,asystem

upgrade,vendorcontractamendment,ororganizationalrestructuring,traceitsfull

downstreameffectacrosstheinstitutioninnearrealtime.Workthattodaytakesmonthsofmanualimpactanalysiscanberesolvedinhoursordays.

—Earlywarningandcontinuousmonitoring:Captureweaksignalsandemergingpatterns

continuously,feedingthemintotherisksystemandtriggeringescalationtoaccountable

humandecision-makersbeforesituationsdeteriorate.Theurgencybehindthiscapabilityisconcrete:Ourflashsurveyfoundthateveryinstitutionsurveyedhasmobilizedaformal

responsetosystemiclargelanguagemodelandagenticAIrisks.While73percentreport

combiningimmediatecontainmentactionswithalong-termtransformationprogram,only14percentreporthavingadvancedcontrols,suchasredteamingormodeltesting,inplace.

Governanceintentisrunningsignificantlyaheadofoperationalpreparednessand

continuousmonitoringinfrastructure.Theearly-warninglayerofthedigitaltwinisthemechanismdesignedtoclosethatgap.

Tounderstandtheadvantagesofthedigitaltwin,considerthetypicalretailloanorigination

process.Anagentcontinuouslymonitorscontrolhealth,third-partystatus,andprocess

performanceateverystage,includingmodelingtheend-to-endapplicationprocess,knowyourcustomer(KYC),identityverification,creditassessment,underwriting,documentationand

disbursement,andmonitoringandservicing.Whenanincomevalidationcontrolfails,anagentcouldblocktheaffecteddisbursement,tightenthevalidationruleanditsdatasources,pauseautomaticapprovalsfortheaffectedsegment,rerunapplicationsalreadyprocessed,andnotifytheriskandbusinessowners—allwithoutahumanhavingtoinitiatethecheck.

Whatmakesthisoperationalisthetriggerarchitecturethatkeepsthetwincurrentand

proactive.Whenacontrolfailsinternally,thetwincouldtracetheexposureacrossprocessesthatsharethesamecontrolordependency.Whenapeerinstitutionisfinedforasanctions

Thebank’sdigitaltwin:Thefutureofnonfinancialriskmanagement6

failure,thetwinmapswhetherthesamevendor,processdesign,orcontrolgapexists,and

surfacesittotheaccountableownertogetaheadofregulatoryscrutiny.Whenacritical

vendor’screditratingisdowngraded,oraneweventisdisclosedagainstsoftwareembeddedinthebank’sinfrastructure,thetwinquantifiestheoperationalexposureinrealtime.Withoutthisintegrationbetweensignalandmodel,continuousmonitoringremainsanalertingsystemratherthananoperationalintelligencecapability.

Takentogether,thesesevencapabilitieschangetheCRO’soperatingpostureinaspecificway.Mostriskfunctionstodaymanagebackward,reviewingwhathasoccurredandassessing

whethercontrolsareoperatingeffectively.ThedigitaltwinenablestheCROtomanageforward,seeingtheinstitution’scurrentexposureprofile,testingitagainstemergingscenarios,and

interveningbeforeincidentscompound.Thatshiftfromretrospectiveassurancetoprospectivedecisionsupportiswhatpositionstheriskfunctionasasubstantiveinputtostrategicand

operationalchoices,ratherthanagovernancelayerthatfollowsthem.

Howbankscanestablishadigitaltwin

Thepathwaytoadigitaltwindoesnotrequirestartingfromnothingorwaitingforperfectdata

oracompletedtechnologytransformationprogram.Buildingtowardthismodelisitselfaforcingmechanismforsimplification:Theprocessofmappingprocesses,systems,vendors,and

controlsendtoendrevealsthecomplexitythathasaccumulatedovertheyearsandcreatesboththemandateandtheroadmaptoaddressit.

AlargeNorthAmericanbankundertookavendordependencymappinginitiativeandfound

morethan200previouslyunidentifiedconcentrationsofrisks,includinginstancesinwhichasingletechnologyproviderwasembeddedasacriticaldependenceinmorethan30business-criticalprocesses.

2

Theexercise,initiallyscopedasaregulatorycomplianceeffort,becamethefoundationforabroaderoperational-resiliencecapability:adynamiccriticalservicemodel

updatedcontinuouslyratherthanonanannualassessmentcycle.

Earlyadopterspilotingdigital-twinapproachesinpaymentsoperationshavereportedthat

modelingpayment-processingarchitecturescanreducetimetoconductchangeimpact

assessmentsfrommonthsofmanualmappingtounder48hours

3

—ashiftthatreflectsthe

differencebetweenperiodicanalysisandcontinuousoperationalawareness.Italsoenablestheinstitutiontodefineandoperationalizeaminimumviablebusinessmodelforpayments,

specifyingwhichservicesmustbemaintainedatdefinedlevelsundervariousstress

scenarios—anapproachthathadpreviouslyexistedonlyasaconceptualprinciplewithoutoperationalgrounding.

AgenticAIsystemswillplayanincreasinglysignificantroleinthisarchitecture,butitshouldbeappliedselectively.Themonitoringcapabilityrunsalongamaturityspectrum,whereatthe

foundation,rules-basedthresholdsanddeterministicautomationprovidecontinuous

surveillancethatbankscandeploytoday.Patternrecognitionandanomalydetectionadd

2BasedonMcKinseyclientexperience;figuresareillustrativeofresultsobservedtodateandarenotderivedfromourflashsurvey.

3BasedonMcKinseyclientexperience;figuresareillustrativeofresultsobservedtodateandarenotderivedfromsurveyresults.

Thebank’sdigitaltwin:Thefutureofnonfinancialriskmanagement7

intelligence.Forexample,whatisdistinctlyagentic(anddistinctlyharder)istheautonomous

multistepreasoningillustratedintheloanoriginationexample:notjustdetectingthatacontrolhasfailed,butdecidingtoblock,tighten,pause,rerun,andescalatewithouthumaninitiation

(andtrigger-basedhumanoversightandapprovalasneeded).

Ourflashsurveyshowsthatscaling,notadoption,isnowthedefiningchallenge:50percentofinstitutionsarescalingAIacrossmultipleriskdomains,upfrom15percentin2024,and64

percentsaythatmorethan60percentoftheirriskstaffactivelyuseAIinday-to-daywork.

AgenticAIspecificallyremainsonematuritytierbehind,with64percentatproofofconceptandfewerthan10percentscalingacrossmultipledomains.Thedesignprinciplegoesbeyond

conventionalhuman-in-the-loop;itisaboutdirectescalationtotheaccountableleader,thepersonwhowillowntheconsequences,withtherightcontextforaction.

Thebusinesscaseforestablishingadigitaltwin

Thecaseforbuildingthesecapabilitiesextendsbeyondcomplianceandlossprevention.The

targetstateisariskfunctionbuiltonthreeinterconnectedelements:acontinuouslyupdated

operationalmodelconnectingprocess,system,vendor,andcontrolinformation;ananalyticsandsimulationlayerthatrunsscenariosagainsttherealarchitecture;andadecisionsupportlayer

thatroutesintelligencetodecision-makerswithcontextforaction.

Inpractice,thatoperationalmodelbecomesaprocessbackbonethatconnectsthebank’s

existingriskprograms—suchasthird-partyrisk,cyberrisk,modelriskmanagement,issuesandevents,controlsmonitoring,andoperationalresilience—intoasingleliveviewratherthananewprogramlayeredontopofthem.

Therealpayoffisinfourareas:

—Commercialacceleration:Betteroperationalunderstandingenablesfasterproductlaunchesandmoreconfidentmarketentry.Riskimplicationsofanewproductormarketcanbe

modeledbeforelaunchratherthandiscoveredafterward.Ourresearchfoundthat96

percentofinstitutionsselectedAIforriskproductivityastheirtopinvestmentpriorityoverthenextthreeyears,reflectingrecognitionthatthecurrentmodelcannotmeetcommercialdemandswithoutAI-drivenacceleration.

—Simplificationdividend:Mappingprocesses,systems,vendors,andcontrolsend-to-endrevealsthearchitecturalcomplexityandprocesssprawlthathaveaccumulatedforyears,creatingboththemandateandroadmaptoaddressthem.

—Scalability:Becausetheunderlyingmodelscaleswiththeinstitutionratherthanwithheadcount,thesameinfrastructurethatsupportstoday’sriskfootprintabsorbstomorrow’s

growth.Credibleoperationalresilienceisalsoanincreasinglyvisiblecompetitive

Thebank’sdigitaltwin:Thefutureofnonfinancialriskmanagement8

differentiator,reflectedinstrongregulatoryrelationshipsandclientconfidence.

—Talentattraction:Thetalentprofileisshiftingas60percentofinstitutionsanticipateamovetowarddata-andtechnology-orientedrolesorwholesalereskilling.Thedigitaltwinenablesmoresophisticated,analyticallydemandingriskwork,improvingthecareerpropositionfor

quantitativetalentatatimewhenthefunctionmustcompetefordatascientistsandengineers.

Thereareseveralactionsbankscantaketogeneratevaluefromadigitaltwin—withouthavingtoundergoafulltransformationoftheriskfunction.

First,pilotdigital-twinusecasesonthehighest-impactprocesses.Criticalvendormappingandpayment-processingresiliencearestrongcandidatesasbothareanalyticallytractable,carry

clearregulatoryrelevance,andgenerateimmediatevaluewhilebuildingtheunderlyingdataandmodelinginfrastructure.Thegoalofaninitialpilotisnotcomprehensivecoverage;rather,itistoestablishtheproofofconceptandsurfacethedataandprocessgapsthatmorecomplete

modelswillneedtoaddress.ManyinstitutionsfindthenaturalanchorforthisworkistheRCSA.Stitchingtogethertheprocess,risk,andcontrolontologythatalreadyunderpinstheRCSA

createsthebackboneonwhichtherestofthedigitaltwinbuilds.AIcanelevateitimmediatelyatanystageofmaturity,pressuretestingtheunderlyingtaxonomyforinstitutionsstillbuildingthefoundation,actingasanobjectivechallengerforthosewithanRCSAthatisn’tyetfitfor

purpose,andmakingitdynamicandcontinuouslyupdatedforthosereadyforreal-timeinsight.

Second,buildthelearningsystemnow.Establishingstructuredmechanismstocapturenear

missesandweaksignals,investigatethemsystematically,andfeedinsightsbackintopracticesdoesnotrequiresophisticatedtechnology.Itrequires