Yes, you are required to get client permission before you use their names but NEWSFLASH some of your competitors
make blanket permission a simple tick - box when the client first instructs them... Take a look: some of your competitors have their clients» names all over their website.