but you need a letter of authorisation