Should you cite somebody's Transfer Report? (Confirmation Report)
If it is published somewhere, then you should feel free to cite it. However, if it's not, then you have a challenge. You might cite it as, more or less, "Author. Title. Transfer Report, University, Year. (unpublished personal communication)" Which indicates that you friend or colleague gave you a copy in which you first found the information you are referencing. 

I think such an approach gives your colleague credit and gives readers at least some hope of being able to track down a copy if they want to verify your claims about what it says.