Kraken is also well known to be fully compliant and extremely careful about that (and about security) so I guess this model is possible too right ?
Kraken is well known to have made a huge marketing effort to make people believe they are compliant. The reality is that they just have two banks accounts:
1) OPERATIONAL EXPENSES ACCOUNT (this is where the money to pay for company's expenses sit)
2) DEPOSITS ACCOUNT (this is where customer's money sit)
They say the never mix the funds, which is better from a practical POV (Bitstamp mixes everything on a single account, which is simply suicidal), but
legally it is exactly the same as having a single bank account: both accounts are ON KRAKEN'S NAME, which means that if regulators need to go after a Kraken customer, they will just freeze the whole account because legally it is a property of Kraken. They do not have a banking license and when they are questioned about HOW can they say they are compliant if they are not compliant with the european Directive for Payment Services, they respond with a vague
"we are operating under Fidor's banking license" which is NOT true - Fidor has no responsibility on none of their accounts, in fact they are "lending" their banking license to Bitcoin.de but NOT to Kraken.
As per Bitcoin.de legal disclaimer:
Notice pursuant to § 2 Section 10 of the Banking Act:
The Bitcoin Deutschland AG is acting as tied agent of the FIDOR Bank AG within the meaning of § 2 Section 10 of the Banking Act and provides the system or the completion of financial instruments in accordance with §1 Section 1a Sentence 2 No. 1 und No. 2 of the Banking Act exclusively in the name and for the account of the FIDOR Bank AG.
Now read the aforementioned sections of the Banking Act and you will see that it is very clear: if you are a financial intermediary/investment broker, etc. (which means holding/managing funds on behalf of third parties) you need to be either a bank, or a tied agent of a bank, which means that the bank is supervising and controlling the customers funds, which are NOT sitting on an account on your name. This is true for Bitcoin.de, NOT true for Kraken. Kraken is NOT a tied agent of Fidor, if they were they would NEED to state that clearly on their ToS. Fidor has no control nor supervision on neither of Kraken's accounts, you can call them and ask yourself (and then ask the same question on Bitcoin.de to see the difference).