SEC fines Merrill Lynch $7.5M after a risk-score threshold kept potentially suspicious activity from reaching human investigators for review.