TL;DR
The Netherlands blocked IBM spinoff Kyndryl from acquiring Solvinity, the cloud provider that hosts the Dutch digital identity system DigiD. It is the first US acquisition the Dutch Investment Screening Bureau has ever prohibited.
The Dutch government has imposed a “complete prohibition” on the acquisition of Solvinity, a Dutch cloud provider, by Kyndryl, the American IT infrastructure company spun out of IBM in 2021. The deal, valued at roughly €100 million, would have given a US-headquartered firm control over the platform that runs DigiD, the digital identity system used by millions of Dutch residents to access tax, healthcare, pension, and government services.
Willemijn Aerdts, the Dutch minister for the digital economy, announced the decision on Monday in a letter to parliament. The government said the acquisition poses a possible “risk to the public interest” based on the recommendation of the Bureau for Investment Screening, which evaluated the deal under the Netherlands’ foreign investment screening framework.
It is the first time the bureau has blocked a US acquisition since it began operating. The decision was not close. The screening body recommended a full prohibition rather than imposing conditions.
Solvinity does not just host DigiD. The company also operates the infrastructure behind MijnOverheid, the government’s citizen communications portal, and Digipoort, the gateway for business-to-government digital services. Together, these platforms form a core layer of the Netherlands’ public digital infrastructure. Solvinity runs them from a government data centre under strict security requirements.
The concern is the US CLOUD Act. The 2018 law gives American law enforcement and intelligence agencies the authority to compel US-headquartered companies to hand over data stored on their servers anywhere in the world, regardless of the host country’s data protection laws. If Kyndryl owned Solvinity, the Dutch government’s digital identity data would theoretically fall within the reach of US authorities.
Kyndryl told Politico, which first reported the decision, that it was “extremely disappointed.” The company had announced the deal in November 2025 and framed it as a way to expand its sovereign cloud capabilities for regulated European customers. The Dutch competition authority, ACM, cleared the deal on antitrust grounds in February 2026. But the investment screening process, which runs separately, reached a different conclusion.
The decision sits within a broader European push to reduce dependence on American technology providers. Trump-era tariffs and sanctions have accelerated the shift. AWS, Microsoft Azure, and Google Cloud together control more than half of Europe’s cloud market. The European Commission is expected to present its Tech Sovereignty Package on 27 May, a day after the Dutch decision, with proposals that could restrict the use of US cloud platforms for sensitive government data across the EU.
The EU has already begun putting money behind the strategy. Brussels awarded a €180 million sovereign cloud contract to four European provider groups in April, closing a procurement process that will let EU institutions purchase sovereign cloud services for up to six years. One of the four winners, S3NS, is a joint venture between Thales and Google Cloud, underscoring how difficult it is to build genuinely independent infrastructure.
The Netherlands has form on this. In October 2025, the Dutch government invoked a Cold War-era law to seize control of Nexperia, a semiconductor manufacturer owned by China’s Wingtech, citing threats to European economic security. That case involved hardware. The Solvinity block involves data. The principle is the same: the Netherlands is willing to intervene when foreign ownership of critical infrastructure creates a national security risk, regardless of the acquirer’s country of origin.
For Kyndryl, the block is a commercial setback. The company, which reported $15.1 billion in revenue in its most recent fiscal year, has been trying to grow its European cloud and managed services business. Solvinity’s government contracts and security credentials made it an attractive target. Without the deal, Kyndryl loses a foothold in the Dutch public sector.
For the Netherlands, the calculation is that the risk of a US company controlling the platform behind the national digital identity system outweighs the commercial benefits of the acquisition. DigiD is used for everything from filing taxes to accessing medical records. The data it handles is among the most sensitive any government holds. Handing that to a company subject to the CLOUD Act is a risk the Dutch government has decided it will not take.
The decision will be watched across Europe. If the EU’s Tech Sovereignty Package follows through on restricting US cloud platforms for government data, the Dutch block on Kyndryl-Solvinity will look less like an outlier and more like a preview of what is coming for every American technology company doing business with European public institutions.
