From their TOS (source https://xapo.com/terms/ )
Quote
Xapo is incorporated in Hong Kong , has an office in Palo Alto, California and operates Worldwide.... ...If you are using our Services in the United States, you are engaging not with Xapo Limited but with Xapo, Inc., a Delaware corporation and a wholly-owned subsidiary of Xapo Holdings Limited
so using their service from EU i still feel legal 
Xapo, Inc is NOT registered as money transmitter in Delaware nor in any other stare, so it is operating illegally.
Source 
it's not how you feel, it's about how they are. Even in Hong Kong, they need a financial license to operate with Bitcoin. They have not.
Xapo, Inc is NOT registered as money transmitter in Delaware nor in any other stare. You can check that with Delaware's Office of State Banking Commissioner.
Xapo is illegal.