From their TOS (source https://xapo.com/terms/ )
Quote
Xapo is incorporated in Hong Kong , has an office in Palo Alto, California and operates Worldwide.... ...If you are using our Services in the United States, you are engaging not with Xapo Limited but with Xapo, Inc., a Delaware corporation and a wholly-owned subsidiary of Xapo Holdings Limited
so using their service from EU i still feel legal 
Xapo, Inc is NOT registered as money transmitter in Delaware nor in any other stare, so it is operating illegally.
Source 