Netherlands prevents US company from acquiring DigiD cloud hosting provider.

      The Netherlands has blocked Kyndryl, an IBM spinoff, from acquiring Solvinity, the cloud provider responsible for hosting the Dutch digital identity system DigiD. This marks the first prohibition of a US acquisition by the Dutch Investment Screening Bureau.

      The Dutch government has enacted a “complete prohibition” on Kyndryl's acquisition of Solvinity, which is based in the Netherlands. Valued at approximately €100 million, this deal would have allowed a US firm to manage the platform crucial for DigiD, utilized by millions of Dutch citizens for accessing various services such as tax and healthcare.

      Willemijn Aerdts, the Dutch minister for digital economy, announced the decision in a parliamentary letter on Monday. The government identified the acquisition as a potential “risk to the public interest,” following guidance from the Bureau for Investment Screening, which reviewed the deal under the Netherlands’ foreign investment screening laws.

      This is the first time the bureau has thwarted a US acquisition since its establishment. The decision was not marginal, as the screening agency advocated for a complete prohibition instead of conditional terms.

      In addition to hosting DigiD, Solvinity manages critical infrastructure for MijnOverheid, the government’s citizen communications platform, and Digipoort, which facilitates business-to-government digital services. These systems are essential components of the Netherlands’ public digital infrastructure, operated from a government data center under stringent security measures.

      The main concern lies with the US CLOUD Act, which allows American law enforcement and intelligence to compel US companies to provide data stored globally, regardless of local data protection laws. If Kyndryl were to acquire Solvinity, the data associated with the Dutch government’s digital identity could theoretically be accessed by US authorities.

      Kyndryl expressed “extreme disappointment” to Politico, which first reported on the ruling. The company had announced the acquisition in November 2025, positioning it as a means to enhance its sovereign cloud services for regulated European customers. The Dutch competition authority, ACM, had cleared the deal in February 2026 from an antitrust perspective, but the investment screening process yielded a different outcome.

      This decision is part of a larger European initiative to lessen reliance on American technology providers. Factors such as tariffs and sanctions from the Trump administration have furthered this shift. Major players like AWS, Microsoft Azure, and Google Cloud dominate over half of Europe’s cloud market. The European Commission is projected to unveil its Tech Sovereignty Package on 27 May, following the Dutch decision, which may propose limitations on the use of US cloud platforms for sensitive government data within the EU.

      The EU has also begun investing in this strategy, with Brussels awarding a €180 million sovereign cloud contract to four European provider groups in April, enabling EU institutions to procure sovereign cloud services for up to six years. Among the winners, S3NS, a joint venture between Thales and Google Cloud, highlights the challenge of creating truly independent infrastructure.

      The Netherlands has a history of taking similar actions. In October 2025, it invoked a Cold War-era law to take control of Nexperia, a Chinese semiconductor manufacturer, citing threats to European economic security. While that case involved hardware, the Solvinity block pertains to data, reflecting a consistent stance: the Netherlands will act when foreign control over critical infrastructure presents a national security risk, regardless of the owner's country.

      For Kyndryl, this block represents a significant commercial obstacle. With reported revenues of $15.1 billion in its last fiscal year, the company aimed to expand its presence in the European cloud and managed services market. Solvinity’s government contracts and security credentials made it a compelling target, and without this acquisition, Kyndryl loses a foothold in the Dutch public sector.

      The Dutch government's assessment is that the risk of a US entity controlling the platform hosting the national digital identity system outweighs the potential commercial advantages. DigiD handles highly sensitive data related to various essential services, and entrusting that to a company governed by the CLOUD Act is a risk the Dutch authorities have opted to avoid.

      This decision will be closely monitored throughout Europe. If the EU’s Tech Sovereignty Package indeed restricts US cloud platforms for government data, the Dutch rejection of the Kyndryl-Solvinity deal may not appear as an isolated case but rather as an indication of future trends for American tech companies engaging with European public institutions.