I work for a company that has an older website. We hired a firm to update our web site and index it properly. I have control of the actual domain name. I created an FTP site for them to use, but they are also asking for my registrar account and password. The only explanation I have gotten so far is that they need it for "indexing" the site to search engines. Is this a valid reason, or is their any valid reason they would need my registration information?
I know for a fact that Google Webmaster Tools only requires you to put a file on your site to prove that you are in control of it. Which having FTP access will let you know. I highly doubt any other search engine would require anything regarding your registration information.
Do not give them your username and password. If they push for it ask for a specific defined reason for why they need it. If they do not give you one then they are obviously lying. If they do give you a reason question it extensively. If this company is trying to pull one on you and your company now is the time to figure it out. I would consider any work they do or claim they will do for you suspect if they don't back down on requesting that information and more or less apologize right away.
There's nothing in DNS/Whois that is going to make a difference in terms of indexing a site. Getting pages indexed is as simple of notifying the search engines that the page exists. This can be done through a HTML sitemap, XML site map, or regular internal links.
The only possible explanation I can think of for needing this access is to register the domain for 10 years. Some people speculate since Google patented the idea that domain name registration length can be used in ranking algorithms that a 10 year domain registration must help search rankings. Besides the fact that there is no evidence that is true, if they were going to do this they would have simply said so.
Like I said in my comment, this sounds very shady. I'd mention it to someone and have them look into it further if I were you.
Possible reasons for needing control:
Adding, managing sub-domains and mirrors.
If you're running an email server, you'll have to appease email service providers' demands to legitimize your email communications, which may involve tweaking dns records.
If you don't have a static IP, someone has to keep on top of updating dns records every time your ISP switches your server's IP address.
Keeping on top of registration renewals.
Publishing website support and complaint contact information, and otherwise keeping in compliance with ICANN rules.
Your registrar should be able to provide you with the means to add a sub-user account, which lacks transfer ability and missing some other key permissions. Set this up for them instead. But for added security, you may instead want to have this consultant supply you with a list of changes needed, and you personally make these changes or otherwise open a support case with your registrar to make it happen.
Do not, under any circumstances, do such a thing.
However, if you are with a registrar that allows you to delegate only certain rights (i.e. if you're with NameCheap - I'm sure others support this but I don't know which), if they really only care about the right to change DNS servers or other such, by all means, if that is an acceptable thing to you. Maybe they just want to change the info to a private registration for G-d knows what reason, or they want to extend the registration period as part of looking better for Google.
Sidenote: I manage about fifty client domains and I have their registrar passwords or even their domains in my registrar accounts, but only because some would forget to renew their domains and I have contracts with them guaranteeing their ownership and transfer upon signed request, as well as my (albeit limited) liability in case I am too much of an idiot and actually forget to renew them myself.
The only reason I would need someone's account with a registrar is to change the DNS settings (name server .. etc). But this has nothing to do with the site being indexed by search engines. Besides this can be used to initiate a domain name transfer (= you get your domain name stolen). If I were you, I'd never give such information to them.