The TL;DR
The Netherlands has blocked IBM spinoff Kyndryl from acquiring Solvinity, the cloud provider that hosts the Dutch DigiD digital identity system. It is the first US acquisition the Dutch Investment Screening Bureau has ever rejected.
The Dutch government has placed a “complete ban” on the acquisition of Solvinity, a Dutch cloud provider, by Kyndryl, an American IT infrastructure company spun off from IBM in 2021. The deal, worth around 100 million euros, would have given the US-headquartered company firm control over the Idisgid digital platform used by millions of Dutch residents. access to tax, health care, pensions, and government services.
Willemijn Aerdts, the Dutch minister for the digital economy, announced the decision on Monday in a letter to parliament. The government said the acquisition posed a “risk to the public interest” based on the recommendation of the Bureau for Investment Screening, which assessed the deal under the Netherlands’ foreign investment screening framework.
It is the first time the bureau has blocked US imports since it took effect. The decision was not close. The review body recommended a blanket ban rather than imposing conditions.
TNW City Coworking Space – Where your best work happens
A workplace designed for growth, collaboration, and endless networking opportunities at the heart of technology.
Solvinity doesn’t just hold DigiD. The company also operates the infrastructure behind MijnOverheid, a government citizen communications portal, and Digipoort, a business-to-government digital services gateway. Together, these platforms form the foundational layer of the Netherlands’ public digital infrastructure. Solvinity runs them from a government data center under strict security requirements.
The concern is the US Cloud Act. A 2018 law gives US law enforcement and intelligence agencies the authority to compel US-headquartered companies to hand over data stored on their servers anywhere in the world, regardless of the host country’s data protection laws. Had Kyndryl owned Solvinity, the Dutch government’s digital identity data would have fallen within the reach of US authorities.
Kyndryl told Politico, which first reported the decision, that she was “deeply disappointed.” The company had announced the deal in November 2025 and pitched it as a way to expand its private cloud capabilities to regulated European customers. The Dutch competition authority, ACM, canceled the deal on antitrust grounds in February 2026. But the investment evaluation process, conducted separately, reached a different conclusion.
The decision is part of a broader European push to reduce dependence on American technology suppliers. Trump-era taxes and sanctions have accelerated the change. AWS, Microsoft Azure, and Google Cloud together control more than half of the European cloud market. The European Commission is expected to present its Tech Sovereignty Package on May 27, the day after the Dutch decision, with proposals that would limit the use of US cloud platforms for sensitive government data across the EU.
The EU has already started putting money behind the strategy. Brussels awarded a €180 million cloud contract to four European provider groups in April, closing a procurement process that will allow EU institutions to buy private cloud services for up to six years. One of the four winners, S3NS, a joint venture between Thales and Google Cloud, underlines how difficult it is to build a truly independent infrastructure.
The Netherlands have form this time around. In October 2025, the Dutch government used Cold War-era legislation to seize control of Nexperia, a semiconductor company owned by China’s Wingtech, citing threats to European economic security. That case involved hardware. Solvinity block includes data. The principle is the same: The Netherlands is willing to intervene when foreign ownership of critical infrastructure creates a national security risk, regardless of the country of origin of the acquirer.
For Kyndryl, the block is a reverse trade. The company, which reported $15.1 billion in revenue in its most recent fiscal year, has been trying to grow its European cloud business and managed services business. Solvinity’s government contracts and security credentials have made it very popular. Without the agreement, Kyndryl loses its place in the Dutch public sector.
In the Netherlands, the calculation is that the risk of a US company controlling the platform behind the national digital identity system outweighs the commercial benefits of the acquisition. DigiD is used for everything from filing taxes to accessing medical records. The data it handles is among the most sensitive information any government has. Giving that to a company under the CLOUD Act is a risk the Dutch government has decided not to take.
The decision will be watched across Europe. If the EU’s Tech Sovereignty Package follows through on limiting US cloud platforms for government data, the Dutch block on Kyndryl-Solvinity will look less foreign and more like a preview of what’s to come for every American tech company doing business with European public institutions.
