Authors: Lodewick Prompers, Stephanie Coleman
In May 2026, the Dutch government made headlines by blocking the acquisition of cloud services provider Solvinity by US-based Kyndryl — a technology services company spun out of IBM’s managed infrastructure division.
Solvinity is not just any tech company: it operates the digital backbone behind services millions of Dutch residents rely on every day — from tax, healthcare and pension portals to the government’s own citizen communications platform and business-to-government transaction gateway.
So, what does this decision tell us? Here are our key takeaways from the decision:
- First time for everything: The decision marks the first time the Dutch Investment Screening Authority (BTI) has issued a final block since it was established in 2020. A 2024 prohibition of an (unnamed) investment was initially blocked too — but it was ultimately approved subject to conditions after new facts emerged on appeal.
- Public interest as the legal basis: The transaction was blocked under the telco-specific FDI regime (Wet Ongewenste Zeggenschap Telecommunicatie) rather than the general FDI regime (Wet Vifo). The test under the telco regime is broader than under the general regime; it considers not only the impact on national security but also the public interest. It was in fact the latter ground that formed the basis for the decision of the BTI.
- Data and digital sovereignty and autonomy as the driver: This prohibition comes amid a broader EU policy shift that treats data sovereignty and digital autonomy as core pillars of economic security and strategic autonomy. While the BTI’s full reasoning remains confidential, there has been public speculation that US legislation, such as the CLOUD Act — which empowers American law enforcement and intelligence agencies to compel US-headquartered companies to hand over data stored anywhere in the world, regardless of local data protection laws — may have played a role. Had Kyndryl acquired Solvinity, sensitive governmental data could theoretically have become accessible to US authorities: a risk the Dutch government — and likely other EU governments watching closely — may not have been willing to accept.
- Remedies are not always available: The BTI has previously cleared deals subject to mitigating measures. However, this may not always suffice. The decision indicates that remedies were discussed, but that they were ultimately set aside as insufficient to address the identified public-interest concerns.
- No investor is safe: The decision is also a stark reminder that FDI concerns can arise even in relation to investors from allied nations — in this case, the US. Following the prohibition, the Dutch government stressed that its review was “country-neutral, risk-based and proportionate”. The US Ambassador to the Netherlands and the American Chamber of Commerce have both expressed concern about the uncertainty this creates for US investors, particularly given the lengthy and opaque procedure, and the absence of any public reasoned decision. Adding an interesting twist: Solvinity has been majority-owned since 2014 by UK private equity firm Vitruvian, i.e. it was already in non-EU hands. However, the Dutch FDI regime only entered into force in 2023, and the telco-specific FDI regime in 2020.
- The exception rather than the rule: Prohibitions will remain exceptional and will only be used as a last resort when no adequate remedy is available. The Solvinity decision is therefore an unusual outcome. The transaction was controversial from the outset and generated significant press coverage in the Netherlands.
- Competition clearance doesn’t mean there won’t be government enforcement: The Dutch competition authority (ACM) cleared the deal in February 2026, on antitrust grounds, noting that any concerns regarding digital autonomy were not the result of competition problems.
- Dutch government becoming more interventionist: The Solvinity decision does not arise in a vacuum. The earlier Nexperia episode in the Netherlands (whereby the Dutch government intervened to effectively take control of Nexperia amid concerns its Chinese owners were moving activities to China — albeit this was ultimately withdrawn) signalled a more assertive Dutch approach towards foreign ownership of strategically sensitive companies. By contrast, CFIUS (the US foreign investment screening authority) has historically cleared analogous transactions involving sensitive digital identity and security infrastructure, including the acquisition of Gemalto, a Dutch digital security company with significant US operations (2018) and the acquisition of biometric identity company L-1 Identity Solutions by the Morpho subsidiary of France’s Safran (2011). Nevertheless, given the geopolitical shifts seen since these older decisions, it is doubtful whether CFIUS (or any government) would clear such transactions today without placing substantial conditions on the transaction, though that appears not to have been an acceptable option for the Dutch regulator in this case.
Looking ahead…
The decision to block the Solvinity acquisition was politically sensitive, but it also shows a willingness (which is not unique to the Netherlands) to use FDI screening tools more assertively, particularly where critical digital infrastructure and data sovereignty are at stake.
With the EU’s revised foreign investment screening framework on the way, all Member States will soon be required to screen deals across a range of sensitive sectors, including critical digital infrastructure. This decision therefore provides an insight of things to come across the EU, particularly if a similar fact pattern arises.
While an appeal of this decision is not out of the question, it is a timely reminder to investors to think carefully about foreign investments into highly sensitive sectors — especially if local legislation would allow for sensitive information to be accessed by the investor’s national government.