Dutch Lawmakers Question Kyndryl’s Solvinity Deal Over DigiD Security

Close-up of a computer circuit board with a ghostly white skull icon displayed amidst glowing blue digital overlays and red data points, representing cybersecurity threats or malware detection technology.

Dutch lawmakers are raising national security concerns about U.S. IT services firm Kyndryl’s planned acquisition of Solvinity, a provider of secure cloud services used by government systems including DigiD, according to DutchNews.nl.

The transaction is under review by the Netherlands’ investment screening office, Bureau Toetsing Investeringen (BTI), which assesses whether certain foreign investments could pose national security risks. DutchNews.nl reported that a BTI national security assessment is the formal path that could be used to stop the takeover if risks are substantiated.

BTI officials told lawmakers that the review will take several months before a recommendation is delivered to the Minister for Economic Affairs, DutchNews.nl reported. The article described DigiD as critical infrastructure used to access a broad range of public services, from tax administration and municipalities to health insurance and pension funds.

NL Times has also reported on the political debate around the deal. In a November 2025 report, NL Times said the cabinet had raised concerns about U.S. ownership of a company tied to DigiD infrastructure, citing sovereignty and data access risks and pointing to potential exposure under the U.S. CLOUD Act. The report also noted concerns from municipalities about reliance on U.S. technology providers for essential government services.

The BTI review is expected to advise the Minister for Economic Affairs on whether the acquisition should proceed. With the investigation likely to extend for months, the outcome could shape how the Netherlands applies investment screening rules to providers involved in government authentication systems and other sensitive digital services.

The Solvinity debate reflects broader questions about operational control as national digital identity systems move deeper into cloud-based delivery. For public-sector authentication, who hosts and manages infrastructure can be as consequential as the applications that sit on top of it.

For Dutch policymakers, the review is a test case for foreign ownership scrutiny in the identity and government cloud space. DutchNews.nl reported that lawmakers were briefed on the BTI process, and a VVD lawmaker said his concerns had increased after that briefing.

The questions come amid wider activity in the Dutch and European identity ecosystem, including the iDIN digital identification scheme and growth in local verification providers such as Amsterdam-based Ver.iD.

Sources: DutchNews.nl, NL Times

By the Mobile ID World Editorial Team