TL;DR
The Netherlands blocked IBM spinoff Kyndryl from acquiring Dutch cloud provider Solvinity, which owns the DigiD digital identity system. This is the first US purchase ever banned by the Dutch Investment Probation Office.
The Dutch governmenttotal ban” about the acquisition of Dutch cloud provider Solvinity by Kyndryl, an American IT infrastructure company that split from IBM in 2021. The deal, worth about 100 million euros, would give the US-based central firm control over DigiD, a digital identity system, a platform used by the Dutch government, healthcare and services of millions of citizens.
Dutch Minister for Digital Economy Willemijn Aerdts announced the decision in a letter to parliament on Monday. The government said the purchase posed a possible “risk to the public interest,” based on a recommendation by the Netherlands’ Investment Screening Bureau, which evaluated the deal as part of its foreign investment screening.
It is the first time the bureau has blocked a U.S. purchase since its inception. The decision was not close. The review body recommended a complete ban instead of imposing conditions.
Solvinity doesn’t just host DigiD. The company also manages the infrastructure behind MijnOverheid, the government’s citizen communications portal, and Digipoort, the gateway for business-to-government digital services. Together, these platforms form the core layer of the Dutch public digital infrastructure. Solvinity manages them from a government data center under strict security requirements.
The concern is with the US CLOUD Act. The 2018 law gives American law enforcement and intelligence agencies the power to compel US-headquartered companies to hand over data stored on their servers anywhere in the world, regardless of the host country’s data protection laws. If Kyndryl owned Solvinity, the Dutch government’s digital identity data would theoretically fall into the hands of US authorities.
Kyndryl told Politico, which first reported the decision, that she was “extremely disappointed.” The company announced the deal in November 2025 and framed it as a way expand sovereign cloud capabilities for regulated European customers. The Dutch competition authority ACM cleared the deal on antitrust grounds in February 2026. However, a separate investment review process came to a different conclusion.
The decision sits within a broader European push to reduce dependence on American technology providers. Trump-era tariffs and sanctions they accelerated the slide. AWS, Microsoft Azure and Google Cloud together control more than half of the European cloud market. The European Commission is expected to present its Technical Sovereignty Package on May 27, a day after the Dutch decision, with proposals that could limit the use of US cloud platforms for sensitive government data within the EU.
The EU has already started putting money behind the strategy. Brussels has signed a sovereign cloud contract worth 180 million euros In April, four European provider groups close a procurement process that will allow EU institutions to purchase sovereign cloud services for up to six years. S3NS, one of the four winners, is a joint venture between Thales and Google Cloud, highlighting how difficult it is to build a truly independent infrastructure.
Holland has a form about it. In October 2025, the Dutch government invoked the Cold War-era law Take control of NexperiaA semiconductor manufacturer owned by China’s Wingtech, based on threats to Europe’s economic security. This case was related to hardware. The Solvinity block covers the data. The principle is the same: The Netherlands is ready to intervene when foreign ownership of critical infrastructure poses a national security risk, regardless of the recipient’s country of origin.
Block for Kyndryl is a commercial failure. The company, which generated $15.1 billion in revenue in its most recent fiscal year, is looking to grow its European cloud and managed services business. Solvinity’s government contracts and security filings made it an attractive target. Without the contract, Kyndryl loses its place in the Dutch public sector.
The calculation for the Netherlands is that the risk of controlling the platform behind the US company’s national digital identification system outweighs the commercial benefits of the purchase. DigiD is used for everything from filing taxes to accessing medical records. The data it controls is among the most sensitive any government has. Giving it to a company A risk subject to the CLOUD Act the Dutch government decided it would not take.
The decision will be followed throughout Europe. If the EU’s Tech Sovereignty Package continues to restrict US cloud platforms for government data, the Dutch block on Kyndryl-Solvinity will look less like an outlier and more like a preview of what’s to come for every American tech company doing business with European government agencies.
