Netherlands rejects Kyndryl’s Solvinity acquisition over sovereignty concerns

The Dutch government has moved to block Kyndryl‘s planned acquisition of Solvinity, a Dutch cloud and managed services provider that hosts DigiD, the national digital identity system millions of Dutch citizens use to access tax records, health data, insurance information, and government services. Junior Economic Affairs Minister Willemijn Aerdts disclosed the decision to parliament, citing public-interest risks tied to foreign control over critical digital infrastructure.

Kyndryl, which IBM spun out as an independent company and which maintains its headquarters in the United States, described its reaction as one of extreme disappointment. Furthermore, the company argued the process had grown political despite its engagement with Dutch authorities and its existing track record managing mission-critical systems in the Netherlands.

The Dutch government, however, was not persuaded. The concern at the center of the decision is straightforward: if a US-headquartered company owned the infrastructure running DigiD, could Washington gain legal access to sensitive Dutch citizen data through extraterritorial access laws? That question has no comfortable answer, and as a result, the Dutch government chose not to test it.

Solvinity is not a generic cloud provider. Instead, it sits inside the administrative infrastructure of a European state. That distinction is exactly what made this deal politically impossible, regardless of Kyndryl‘s technical competence or commercial track record.

For cloud providers and investors eyeing acquisitions in Europe, the implications extend well beyond the Netherlands. In particular, ownership of cloud assets that touch national identity systems, healthcare platforms, tax infrastructure, or defense-adjacent workloads now carries political risk that due diligence processes have not historically priced in. Consequently, change-of-control clauses, data residency requirements, and jurisdictional exposure are no longer secondary legal considerations. They sit closer to the top of the evaluation.

For US-based technology companies specifically, the friction around European expansion through acquisition is growing. Each blocked deal or sovereign cloud restriction adds complexity without necessarily displacing existing relationships. It does, nevertheless, narrow the options available to foreign acquirers targeting regulated domestic cloud providers.

Solvinity still needs a path forward, and meanwhile the Dutch ministry says discussions with the company and its current owner continue. The harder question underneath all of this, though, remains unanswered: who exactly qualifies as an acceptable owner of cloud infrastructure carrying a European country’s digital identity layer?