You should either "push" (transfer) the domain to a new account in the name of the purchaser, or they should request a transfer to a different registrar.
If you give him access to your account, it means you can't use it for any other domains and you will possibly be giving them sensitive information about you.