The SFO’s first DPA in five years: a messy test of exemplary cooperation

The deal is the first since the SFO overhauled its Corporate Co-operation Guidance in April 2025. It reinforces the defence and aerospace sector as a live enforcement priority. And it shows how a post-acquisition compliance reset can repair a damaged relationship with the prosecutor.

It is also a difficult case for the SFO to present as a clean success story. The original self-report was made in 2018. The relevant conduct was older still. DPA negotiations previously collapsed. The judgment approving the DPA reflects that awkwardness: Hilliard J accepted that Ultra's pre-acquisition cooperation could not properly be described as truly “exemplary” because of the late disclosure of issues in Oman, but still approved a 45% discount rather than the 50% usually associated with exemplary cooperation. In practical terms, the difference was limited.

Context and background

The DPA concerns three public-sector opportunities pursued through agents, joint ventures and consortium arrangements.

The first was a project for airports in Oman, worth around £150 million to £200 million. Ultra's bid was successful, but the Statement of Facts describes discussions about an OMR 800,000 payment (approximately £1.3 million at the time) for a “third man” or “fixer” who could help secure the award. That payment was later made through Golden Way, an Omani company, with payments directed into a personal bank account. The project was Ultra's largest by value at the time, but ultimately loss-making, with UEH reporting a £31.8 million loss through its joint venture share.

The two Algerian projects were unsuccessful. One concerned IT and e-commerce solutions at Houari Boumediene Airport in Algiers. The other concerned public key infrastructure for the Algerian Ministry of Post and Information and Communication Technology. In the airport project, the Statement of Facts describes consultancy and sales representative agreements involving commission payments of up to 30% of the net contract value, arrangements involving an Apple iPhone provided after receipt of tender material outside the standard process, proposed consultancy fees of USD 4 million and USD 1.5 million, and steps to open overseas bank accounts supported by false employment documents.

Ultra reported suspected corruption relating to Algeria in March 2018. The SFO opened an investigation shortly afterwards and conducted searches in April 2018. Ultra carried out an internal investigation and provided the SFO with a detailed factual report in January 2019. In February 2021, the SFO invited Ultra to enter DPA negotiations in relation to the Algerian projects.

The difficulty is that Oman was not disclosed until July 2022, late in those negotiations. The SFO did not accept the earlier conclusion that the Oman material did not identify bribery and corruption issues, and withdrew from DPA negotiations in November 2022. The investigation was then expanded to Oman in December 2022, to other jurisdictions including China in January 2024, and to Ultra's historic conduct across all jurisdictions in August 2024.

Analysis

Ultra exposes a tension in the SFO's current self-reporting message. The April 2025 Corporate Co-operation Guidance is designed to encourage early engagement by offering companies a clearer route to a DPA if they self-report and cooperate fully. But Ultra shows how forgiving that model may be in practice.

The company did self-report the Algerian conduct promptly. It also cooperated extensively after the acquisition, including through new management, new lawyers, further internal investigations, extensive disclosure, factual narrative reports, limited privilege waivers and major remediation.

But the eventual description of post-acquisition cooperation as “exemplary” is striking. This was not a straightforward case of early, complete disclosure followed by a smooth route to resolution. There was an incomplete initial picture, a failed earlier internal assessment of the Oman material and a collapsed first DPA process.

The SFO wants companies to come forward early, preserve evidence and provide a candid account of what happened. Yet Ultra may be read as suggesting that the decisive question is not whether the company got it right at the start, but whether it can later offer enough remediation, management change and cooperation to make a DPA attractive. Late or incomplete disclosure may reduce credit, but it will not necessarily close off a negotiated outcome. That is consistent with aspects of previous DPA practice, but it risks weakening the practical incentive to speak early and fully.

The post-acquisition element is equally important. This was not a case where historic issues were uncovered only after completion. The buyer acquired a business already facing an SFO investigation, with the cooperation narrative under strain, and then helped repair the position.

That matters for M&A. The judgment records that although the SFO investigation had been announced four years before the acquisition, the new owners had very limited knowledge of the historical misconduct. The DPA negotiations were well advanced at the time of acquisition, but were not disclosed during the acquisition process because of confidentiality restrictions. The SFO was also satisfied, after investigation, that no discount had been applied to the acquisition price for either the Oman misconduct, of which the new owners had no knowledge, or the SFO investigation more generally. That is a useful reminder that anti-bribery and corruption diligence is not just about identifying legal risk. It is about pricing enforcement exposure, remediation costs and the practical burden of post-closing cooperation.

The SFO will look closely at what the new owner does after completion: whether it investigates properly, preserves evidence, strengthens controls and supports engagement with authorities. In Ultra, that support was formalised through the Cobham Ultra Limited parent company undertaking, including assurance that UEH would remain a valid legal entity, registered at Companies House, not dissolved or struck off, and within Cobham Ultra Limited’s would remain under the parent’s ownership and control throughout the DPA term.

The compliance failures are also worth spelling out. Ultra accepted that it did not have adequate procedures at the relevant time. The Statement of Facts identifies the absence of formal bribery and corruption risk assessments covering jurisdictions, agents, intermediaries, joint ventures, teaming agreements and consortiums; inadequate joint venture policies; inconsistent or retrospective bid approval; weak agent controls; limited training records; and insufficient oversight of joint venture activity. One practical example stands out: after Transparency International changed its index scoring methodology from a 10-point to a 100-point scale, Ultra failed to update its policy, meaning some higher-risk jurisdictions, including Algeria, were incorrectly treated as low risk.

The financial outcome raises a separate concern. The penalty of just over £10 million and costs of £4.8 million are explicable by reference to the structure of the case. The Algerian projects were not won. The Oman project, although successful, was ultimately significantly loss-making. The DPA records that no profits were ultimately retained from the conduct. On orthodox sentencing principles, that limits disgorgement and affects the overall financial package.

Even so, the outcome may feel light when set against the seriousness of the alleged facts: a major defence and aerospace group, public-sector contracts, high-risk jurisdictions, intermediaries, joint venture structures, alleged payments routed through agents, and weak controls over a prolonged period. The difficulty is not simply with the SFO's exercise of discretion. It reflects a broader weakness in the way corporate bribery penalties are calculated. Where a corrupt strategy fails, or where the resulting contract is loss-making, the financial penalty can look modest even if the control failure was serious.

The judgment gives some insight into why prosecution was treated as potentially disproportionate. Ultra holds substantial multi-year defence contracts with the UK and other Western Five Eyes governments. It supplies mission-critical electronics, sensors and control systems for aircraft, ships and vehicles, and some Ultra entities carry out work classified as SECRET and TOP SECRET in support of sensitive capabilities. Ultra also argued that a bribery conviction could affect its ability to trade in core jurisdictions, including through public procurement debarment. That helps explain the public-interest case for a DPA, but it also exposes an important policy question: the more strategically important the company, the stronger the practical pull towards a negotiated outcome.

Practical takeaways

• Do initial fact-gathering before self-reporting. Ultra suggests that boards are unlikely to be penalised simply for taking time to understand the facts before approaching the SFO. In many cases, that may be the better course than immediately self-reporting on an incomplete picture.
• Consider carefully what to self-report. Ultra suggests that a company does not necessarily need to disclose everything at the outset for a DPA to remain available later, provided it can later show substantial remediation, disclosure and cooperation.
• Analyse the financial benefit early. Where a company is in trouble, a careful analysis of the benefit obtained from the wrongdoing – including whether profits were retained, lost or never realised – will be a useful guide to the likely financial penalty.
• Do not skimp on ABC due diligence in M&A. Ultra shows why buyers need as full a picture as possible before completion. Proper anti-bribery and corruption diligence helps price enforcement risk, remediation costs and the scale of any post-closing compliance uplift.
• Third-party controls remain central. Ultra again shows the exposure created by agents, intermediaries, joint ventures and consortium structures in public-sector contracting.

Conclusion

Ultra is not a ringing endorsement of the DPA model. The case shows that a company can recover from a damaged cooperation narrative, but only with substantial remedial work, new leadership and enforceable parent support. It also shows the limits of the SFO's agenda focused on pace: an eight-year investigation cannot easily be reconciled with a promise of quicker decisions.

For businesses, the message is more complicated than “self-report and receive a DPA”. Early engagement still matters, but Ultra suggests that late correction may also be enough if the eventual cooperation package is sufficiently strong. For the SFO, the next test will be whether future cases can deliver the same clarity without the same delay – and whether “exemplary cooperation” continues to mean something more than a label applied when a DPA is the preferred outcome.

Authored by Reuben Vandercruyssen, Liam Naidoo, Claire Lipworth and Olga Tocewicz.