TL;DR
The Netherlands prevented Kyndryl, a spin-off of IBM, from acquiring Solvinity, the cloud provider that hosts the Dutch digital identity system DigiD. It is the first US acquisition that the Dutch Investment Assessment Office has banned.
The Dutch government has imposed a “complete ban” on the acquisition of Solvinity, a Dutch cloud provider, by Kyndryl, the US IT infrastructure company spun off from IBM in 2021. The deal, valued at around €100 million, would have given a US-based company control of the platform that runs DigiD, the digital identity system used by millions of Dutch residents to access tax, healthcare, pension and government services.
Willemijn Aerdts, Dutch digital economy minister, announced the decision on Monday in a letter to parliament. The government said the acquisition poses a possible “risk to the public interest” based on the recommendation of the Investment Assessment Office, which assessed the deal under the Netherlands’ foreign investment assessment framework.
It is the first time the office has blocked a US acquisition since it began operations. The decision was not closed. The watchdog recommended an outright ban rather than imposing conditions.
Solvinity doesn’t just host DigiD. The company also operates the infrastructure behind MijnOverheid, the government’s citizen communications portal, and Digipoort, the gateway for business-to-government digital services. Together, these platforms form a core layer of the Netherlands’ public digital infrastructure. Solvinity runs them from a government data center under strict security requirements.
The concern is the US CLOUD Act. The 2018 law gives US intelligence and law enforcement agencies the authority to compel US-based companies to hand over data stored on their servers anywhere in the world, regardless of the host country’s data protection laws. If Kyndryl owned Solvinity, the Dutch government’s digital identity data would theoretically be accessible to US authorities.
Kyndryl told Politico, which first reported the decision, that he was “extremely disappointed.” The company had announced the agreement in November 2025 and presented it as a way to expand your sovereign cloud capabilities for regulated European clients. The Dutch competition authority, ACM, cleared the deal on antitrust grounds in February 2026. But the investment selection process, which is carried out separately, reached a different conclusion.
The decision is part of a broader European push to reduce dependence on American technology suppliers. Trump-era tariffs and sanctions They have accelerated the change. AWS, Microsoft Azure and Google Cloud together control more than half of the cloud market in Europe. The European Commission is expected to present its Technology Sovereignty Package on May 27, a day after the Dutch decision, with proposals that could restrict the use of US cloud platforms for sensitive government data across the EU.
The EU has already started allocating money to the strategy. Brussels wins sovereign cloud contract worth €180 million to four European vendor groups in April, closing a procurement process that will allow EU institutions to purchase sovereign cloud services for up to six years. One of the four winners, S3NS, is a joint venture between Thales and Google Cloud, underscoring how difficult it is to build genuinely independent infrastructure.
The Netherlands is in good shape in this regard. In October 2025, the Dutch government invoked a Cold War-era law to take control of Nexperiaa semiconductor manufacturer owned by China’s Wingtech, citing threats to European economic security. That case involved hardware. The Solvinity block involves data. The principle is the same: the Netherlands is ready to intervene when foreign ownership of critical infrastructure creates a national security risk, regardless of the acquirer’s country of origin.
For Kyndryl, the blockade represents a commercial setback. The company, which reported $15.1 billion in revenue in its most recent fiscal year, has been trying to grow its European cloud and managed services business. Solvinity’s government contracts and security credentials made it an attractive target. Without the agreement, Kyndryl loses a foothold in the Dutch public sector.
For the Netherlands, the calculation is that the risk of a US company controlling the platform behind the national digital identity system outweighs the commercial benefits of the acquisition. DigiD is used for everything from filing taxes to accessing medical records. The data it handles is among the most sensitive that any government possesses. Deliver that to a company Being subject to the CLOUD Act is a risk that the Dutch government has decided it will not take.
The decision will be observed throughout Europe. If the EU Tech Sovereignty Package goes ahead with restricting US cloud platforms for government data, the Dutch block on Kyndryl-Solvinity will look less like an outlier and more like a preview of what awaits every US tech company that does business with European public institutions.
