Dutch government blocks Kyndryl's Solvinity deal over security concerns

The Dutch government has blocked Kyndryl’s planned purchase of Solvinity, turning a routine cloud acquisition into a test of how far Europe is willing to let foreign ownership reach into sensitive digital infrastructure. The deal, worth about 100 million euros, would have put a U.S. software company in control of a provider that hosts DigiD, the identity system millions of Dutch residents use to reach medical, insurance and tax records.

Officials said the review was carried out under the WOZT, the Insufficient Controls of Telecommunications Act, and that the Investment Screening Bureau concluded the takeover could pose a risk to the public interest. Junior Economic Affairs Minister Willemijn Aerdts told parliament that the screening body advised a complete prohibition. The government said the review was country-neutral, risk-based and proportionate, but lawmakers had already raised the sharper political question: whether U.S. ownership could expose sensitive Dutch data to disclosure under American law, including the CLOUD Act.

The case has moved through several layers of Dutch oversight. Solvinity announced the planned acquisition on Nov. 7, 2025. Dutch regulators cleared it in February 2026, only for the government to later intervene and stop it. In April, members of the Tweede Kamer backed a motion urging that Solvinity’s DigiD contract not be renewed in 2028 if the takeover proceeded, underscoring how quickly a corporate transaction became a sovereignty debate in The Hague. In early May, a Dutch judge rejected an attempt to terminate the DigiD contract immediately, saying a responsible transition would take six to eight months and warning that ending the arrangement too abruptly would create unacceptable risks for essential government services.

Kyndryl said it was “extremely disappointed” and argued the process had been politicized. Solvinity chief executive Daniëlle Schuur said the company would continue to support Dutch customers, even as the ministry said it remained in contact with Solvinity and its current owner on next steps. The dispute now reaches beyond one company and one contract. Solvinity also manages infrastructure for MijnOverheid, another core public platform, which makes the government’s decision a signal that cloud systems tied to identity and civic administration are being treated more like telecom networks or energy assets than ordinary IT purchases.

That shift matters well beyond the Netherlands. As cloud services sit closer to passports, tax filings and benefits administration, allied governments are becoming more willing to block cross-border tech deals once viewed as routine. The Solvinity case shows that in the cloud era, control of code and data can carry the same strategic weight as control of ports, cables or power grids.