A Citigroup business unit agreed to pay $5 million to settle Securities and Exchange Commission charges that the company failed to protect the confidential trading data of its subscribers. The settlement with LavaFlow Inc. includes a $2.85 million penalty, the agency’s largest-ever penalty against an alternative trading system.