At no point should any information (as you have done and said) be given to anyone until ICANN and WIPO are involved, a Lawyer can sit there and moan as much as he wants and send as many letters as they want.
Also, make sure you get everything they want in writing by letter (signed for) or by fax on their letterhead.
Please understand, if your customer has been silly enough to register something say like viagra.com, just hand the domain over as by the time you or the customer start to fight it, WIPO will be involved and something as well known like that would mean you loose. BUT, if it is not well known or doesn't have an implied copyright by use, then yeah, sit back and wait for them to get UDRP initiated. At that point it would be taken out of your hands anyway.
Registrar has to lock domain, and block any transfer attempt until the WIPO proceedings have gone through, at which time, your registrar, will tell you/customer whats what.