There's no reason to believe that Visa/MC would simply use 'America' as a based to host dumb, encrypted data which enters and leaves the the US fully opaque. That would be pointless. Visa/MS are using services hosted in the US which will process customer data.
2) Statement #2 is also false. There is no arbitrary way for the US to snoop on data that doesn't flow through the US. For a whole variety of reasons - legal, operational, technical, political, cost etc.. Surely it can be done in a limited way, but at a level nowhere near the domestic capability.
3) Finally, you're statement on "geographizing" is also false.
Data, encrypted or not - falls under legal jurisdiction of the 'nation / geography' it's in, and this has many significant consequences. It makes a corporation subject to local laws, regulations, liabilities etc..
The internet is very geographic in nature.
1. If it's encrypted, it doesn't matter where it's stored.
2. If it's not encrypted, it can be easily stored in country X, processed in country X, but routed via SnoopHub in country Y. Country Y loves surveilling and is very happy about this state of affairs.
>I have absolutely no doubt that financial, legal and health records should simply not leave the local legal jurisdiction without consent and a few more things.
A very common attitude, usually held by people who "geographize" that which is not geographic in nature - the Internet.