He needs to get the Authorization Code and then email it to you. It’s a long string of letters of numbers. That’s what you need before you can initiate a transfer. He also needs to make sure that the domain is unlocked and it’s not using anonymous WHOIS information, like a Privacy Guard.
Here’s the link again that was posted above: