MESA ROYALTY TRUST/TX

​

the operations of the affected wells. The creditors or debtor-in-possession may not be able to contract with a replacement operator on favorable terms or within a reasonable period of time. Any financial distress of a Working Interest Owner could adversely affect operations of the underlying properties and could reduce Net Proceeds available to the Trust.

Financial information of the Trust is not prepared in accordance with U.S. GAAP.

The financial statements of the Trust are prepared on a modified cash basis of accounting, which is a comprehensive basis of accounting other than U.S. generally accepted accounting principles (“U.S. GAAP”). Although this basis of accounting is permitted for royalty trusts by the SEC, the financial statements of the Trust differ from U.S. GAAP financial statements, because net profits income is not accrued in the month of production, expenses are not recognized when incurred, and cash reserves may be established for certain contingencies that would not be recorded in U.S. GAAP financial statements.

Working Interest Owners may estimate the revenue or expense components of Net Proceeds, which may result in future adjustments and may adversely affect future distributions to unitholders.

Each Working Interest Owner has its own system of tracking revenues and expenses related to production from its respective Royalty Properties. From time to time, the Working Interests Owners may not be in a position to ascertain actual revenue or expense amounts for a given period due to technological factors or because of a transition period in which a new Working Interest Owner begins operating a Royalty Property. During periods in which actual revenue or expense amounts cannot be ascertained, the Working Interest Owners may instead calculate amounts due to the Trust based on estimated revenue or expense amounts using historical data. Such estimates may be materially inaccurate and result in overpayments or underpayments to the Trust during a given period. The amounts of Net Proceeds reported by a Working Interest Owner for any period may not be representative of Net Proceeds that will be received by the Trust in future periods. Net Proceeds received by the Trust are subject to significant variability from period to period.

For example, following Hilcorp’s acquisition of ConocoPhillips’ and XTO’s interests in the San Juan Basin — New Mexico Properties, there was a transition period to transfer historical information, knowledge and processes from one Working Interest Owner to another. During this transition period, Hilcorp recorded estimates of revenues and expenses and made payments to the Trust based on historical amounts previously paid by ConocoPhillips, and Hilcorp made estimated monthly payments to the Trust for approximately two years. Payments received by the Trust were then adjusted as actual amounts of production and costs were determined by Hilcorp, and in some periods these adjustments resulted in a decrease in Net Proceeds.

Pursuant to the Trust Indenture, the Trust is not required to pay to Working Interest Owners any amounts that could be owed if estimated revenues exceed actual revenue amounts or estimated expenses were less than actual expense amounts in past periods. However, a Working Interest Owner may recover such amounts by withholding a portion or all of the Net Proceeds that would otherwise be payable to the Trust in subsequent periods. This could result in a decrease in Net Proceeds paid to the Trust and could result in future material reductions in distributions to the Trust’s unitholders.

With the assistance of a third party consultant, the Trust may periodically review reconciliation calculations by Working Interest Owners and any amounts of Net Proceeds calculated and paid based upon estimated revenue or expenses.

Item 1B. Unresolved Staff Comments.

None.

Item 1C. Cybersecurity

The Trust has no directors or executive officers. The affairs of the Trust are managed by the Trustee. The Trust falls under the cybersecurity program of The Bank of New York Mellon Corporation (“BNY Mellon”), the parent corporation of The Bank of New York Mellon Trust Company, N.A. As further described in its 2024 Annual Report, BNY Mellon maintains a broad range of defenses aimed at remaining abreast of and responding to evolving cybersecurity threats impacting it, its operations, its clients, its third-party service providers and the broader financial services sector.

Risk Management Strategy and Procedures

BNY Mellon has implemented policies and procedures designed to detect, prevent and respond to malicious and accidental disruptions to the delivery of critical technology services. BNY Mellon’s cybersecurity risk management program is embedded in its three lines of defense model.

As part of its first line of defense, BNY Mellon maintains a dedicated Information Security Division (“ISD”), led by the Chief Information Security Officer (the “CISO”), that is responsible for the day-to-day management of risks from cybersecurity threats. ISD’s responsibilities include cybersecurity threat intelligence, incident response and other cybersecurity operations aimed at enabling BNY Mellon to identify, assess and manage existing and emerging cybersecurity threats. ISD monitors for potential threats and communicates relevant risks to the CISO and other members of executive management. Additionally, ISD maintains a cybersecurity incident response and reporting process pursuant to which cybersecurity incidents are classified according to their severity based upon an assessment of multiple factors. Certain cybersecurity incidents may activate enterprise-wide resiliency processes, which include, among other things, escalation through the management and Board committee structures described below. In addition, BNY Mellon maintains a preparedness program designed to reinforce cybersecurity risk management practices and compliance with BNY Mellon’s policies and procedures. The preparedness program includes mandatory training for all employees, contractors and consultants, enhanced training for those in roles presenting higher risk, calibrated phishing email simulations, distribution of information security awareness materials and cybersecurity event simulation exercises. In addition, BNY Mellon leverages both internal and external assessments and engages with third-party assessors, consultants and auditors to evaluate and test its cybersecurity controls and provide guidance on potential improvements, including design and operating effectiveness. BNY Mellon has standing arrangements with third parties to assist BNY Mellon in identifying, assessing and managing cybersecurity threats, including in connection with risk assessments, penetration testing, legal advice and other aspects of BNY Mellon’s cybersecurity risk management and incident response processes.

BNY Mellon has a defined third-party governance framework to help manage the risk posed to it by the use of third-party service providers. BNY Mellon evaluates the risk posed by third-party service engagements based on multiple factors. BNY Mellon has protocols that seek to mitigate cybersecurity risks associated with third-party service providers based on the risk level assigned to such third party, which may include mandatory contractual obligations or the implementation of additional controls by BNY Mellon and/or the applicable service provider.

ISD is subject to ongoing review and challenge from Technology Risk Management, which is a part of the independent second line of defense risk function. Technology Risk Management, together with the broader Risk & Compliance group, is responsible for and manages BNY Mellon’s risk management framework and establishes guidance for ISD and management designed to help identify, assess and manage cybersecurity risk.

BNY Mellon’s Internal Audit function serves as the third line of defense and provides an independent view on how effectively the organization as a whole manages cybersecurity risk.

Risk Management Oversight and Governance

BNY Mellon’s management is responsible for assessing and managing BNY Mellon’s material risks from cybersecurity threats with oversight provided by its Board of Directors (the “Board”) and the Board committees. The Risk Committee of the Board has primary responsibility for oversight of the overall operation of BNY Mellon’s risk management framework, including policies and practices addressing cybersecurity risk, and is responsible for the oversight of the second line of defense with respect to its cybersecurity risk management responsibilities. The Technology Committee of the Board and the full Board regularly receive reports and briefings from management concerning cybersecurity matters, including any significant changes to BNY Mellon’s cybersecurity program. BNY Mellon also has protocols for escalating cybersecurity threats and incidents to the Technology Committee of the Board and the full Board. In addition, the Audit