Yes, but only in the case that the information about the registrant of a domain name is invalid and the registrar is unable to verify the registrant's identity. If the registrar is unable to verify the identity of the registrant and thus unable to verify that the person is authorized, the authorization code must not be provided.