Visa and its competitors cannot back away from the sanctions at will, as they are ordered by the US federal government. As such, Visa et co. are caught between a rock (US ordered sanctions) and a hard place (this Russian law saying "don't dare apply those sanctions to Russian citizens").

That new law seems to address this: "... and require them to base their processing center in Russia". How would sanctions work with a local subsidiary that does the processing?

The same way the USA has been taking control of the rest of the financial system. They say to American VISA/MC executives, "we require any transactions processed by your subsidiary to comply with US sanctions, or else we're going to tell the whole world that you're a bunch of financial terrorists and throw you in jail".

Then the US executives say, OK, then we won't process payments in Russia. And then Russia says ....

Feels similar to FATCA requirements: report all transactions that involve even the remotest link to an "American person or company" or you're sancioned from operating in the US and with any "American person or company".