The Epp code is a secret authorisation code issued by a registrar managing a domain, so when you transfer a domain, the registrant (person who owns the domain) is given the Epp code by the managing registrar who then gives the Epp code to the new registrar.
The new registrar can then prove to the existing registrar that the transfer is being done at the behest of the registrant.