Dutch Competition Regulator Approves US Takeover of DigiD Infrastructure Provider

The Dutch Authority for Consumers and Markets (ACM) has approved the acquisition of IT services provider Solvinity by American firm Kyndryl, concluding the deal poses no competition problems. The decision clears one regulatory hurdle for a transaction that has sparked months of parliamentary debate and public protest over whether critical Dutch digital infrastructure should fall under US ownership.

Solvinity manages the infrastructure platform that keeps DigiD running, the national digital identity system used by 16.5 million Dutch citizens to access government services including tax returns, healthcare records, pension funds and municipal administration. The system processed 645 million authentications in 2025, growing 10 to 15 percent annually.

The ACM emphasised that its assessment focused narrowly on market competition rather than the broader concerns about digital autonomy that have dominated political discussion. Customers including Logius, the government agency that owns and operates DigiD itself, retain sufficient choice among Dutch and European providers of similar services, the regulator found. The combined market share of Solvinity and Kyndryl in IT services remains limited.

Public sector customers organised in the Taskforce Continuïteit ICT Dienstverlening, part of the Ministry of Interior Affairs, raised concerns during the ACM investigation that US ownership could expose vital government IT services to American legal jurisdiction. They fear the US government could compel access to data or threaten to disable services under legislation including the Cloud Act.

The ACM acknowledged these concerns but stated they do not stem from reduced competition. Only when an acquisition significantly restricts competition can the regulator block it. The authority shared its findings with the Bureau Toetsing Investeringen (BTI), the government body assessing whether the takeover poses national security risks.

The BTI investigation remains ongoing and must be completed before the acquisition can proceed. The bureau is examining the deal under the Wet ongewenste zeggenschap telecommunicatie, legislation governing undesirable control over telecommunications infrastructure. BTI can recommend conditions to mitigate risks or advise the Minister of Economic Affairs to block the transaction entirely.

In 2024, BTI assessed 52 foreign acquisitions, imposing conditions in three cases and blocking one outright.

A parliamentary majority has instructed the government to exhaust all options to prevent DigiD data from falling under American control. GroenLinks-PvdA parliamentarian Barbara Kathmann, who submitted the original motion, was unequivocal: "We simply do not want this to end up in American hands. Period."

Experts appearing before the Tweede Kamer's Digital Affairs Committee identified two main risks. Under the US Cloud Act of 2018, American authorities can demand data held by US companies even when stored outside the United States. More immediately concerning to some experts is US sanctions legislation, which allows the president to unilaterally restrict services to designated persons or organisations without judicial oversight.

Evelyn Austin, director of digital rights organisation Bits of Freedom, made the threat concrete during parliamentary testimony. She noted that nine employees of the International Criminal Court currently cannot receive American services due to presidential decree. "That's not just inconvenient, it's genuinely life-disrupting. And those are only nine people. With DigiD, it could happen on the scale of an entire society."

Kyndryl, a four-year-old spin-off from IBM operating in 60 countries, has offered multiple safeguards. The company pledges that data will remain in the Netherlands, services will continue to be provided within the EU, and access to data will only be possible on EU territory. A Dutch board of directors and independent supervisory board consisting of Dutch citizens would lead Kyndryl Netherlands.

The company also promised to appoint a Europe-based data guardian with authority over access requests and committed to seeking Dutch court rulings if American headquarters attempted to force access or disable services in violation of Dutch or EU law.

Rob Bravenboer, Kyndryl's managing director for the Netherlands, stated the company would refer any government request, including from American authorities, to the end customer. Kyndryl's transparency reports indicate it has never received a request from a foreign government for EU customer data.

These assurances failed to satisfy parliament. D66 MP Sarah El Boujdaini raised the issue of American gag orders, which could require Kyndryl to hand over data without informing customers. "That risk remains, even though you've taken all these mitigating measures," she observed.

The case exposed tensions in European procurement rules. Amsterdam had explicitly included digital autonomy as a criterion when selecting Solvinity for cloud management services. "And Solvinity came out on top," said deputy mayor Alexander Scholtes. "We thought: a nice Dutch company, even an Amsterdam company, that can help us become more digitally autonomous."

The city signed a €14 million contract with Solvinity shortly before the takeover was announced. Scholtes described learning of the acquisition as "an unpleasant surprise," noting that procurement rules prohibit steering on ownership structures. "So you can look at requirements around knowledge to develop services in the field of digital autonomy. You can look at flexibility. But my point is that with the current requirements, you can't sufficiently steer towards digital autonomy."

Solvinity was already 60 percent owned by British private equity firm Vitruvium Partners before the Kyndryl deal emerged.

Beyond DigiD, Solvinity provides infrastructure for MijnOverheid, the government's citizen communication portal, Digipoort, the business services gateway, systems for the Central Judicial Collection Agency, and private clouds for the Gaming Authority and the General Intelligence and Security Service (AIVD).

The proposed takeover prompted a 140,000-signature petition and urgent parliamentary briefings. A group of prominent Dutch experts, journalists and privacy advocates including Maxim Februari, Felienne Hermans and Eric Smit have filed legal action demanding transparency about the BTI review process.

Logius director Bert Voorbraak told parliament the ultimate goal is developing a Dutch government cloud eliminating dependence on commercial parties. The current DigiD contract with Solvinity runs until August 2028, providing time to transition to an alternative provider if the government chooses to act.

The incoming home affairs minister Heleen Herbert, who takes office later this month, will inherit the decision on how to respond once all reviews are complete.