The EPP or Auth code for a domain is simply an authorization code that gives you access to transfer the domain name. If you are transferring a domain name to us, you will need the EPP code or Auth code from your current domain registrar. If you are transferring a domain name from us to another registrar, you will need that code from us to provide to your new registrar.
This is required to complete a domain name transfer. It is a security mechanism to make sure that nobody can steal your domain name. These rules are set forth by the central registry, not by us.
As one additional protection, you also need to unlock your domain in order to transfer it. Once it is transferred, you should then lock it once again.
It's important to note that an EPP code is only required to transfer a domain name - it is NOT required to transfer only the web hosting for a domain.