The Find Familiar spell (PHB p240):
Your familiar acts independently of you, but it always obeys your commands. In combat, it rolls its own initiative and acts on its own turn. A familiar can’t attack, but it can take other actions as normal.
It states that a familiar can't attack — not that it can't attack on its action, but that it can't attack at all, even as an opportunity attack. The only exception to this is when the caster uses the familiar to deliver a touch attack using the familiar's reaction:
[...] it must use its reaction to deliver the spell when you cast it. If the spell requires an attack roll, you use your attack modifier for the roll.
Expanding on the comment below (please vote it up!) the Pact of the Chain Warlock class feature also has another exception (PHB p.107):
Additionally, when you take the Attack action, you can forgo one of your own attacks to allow your familiar to make one attack of its own.
This means the Warlock forgoes an attack it would get from taking the attack action on it's turn (they may have more than one, e.g. from multi-classing with fighter and getting extra attack), and instead the familiar attacks. The familiar attacks immediately, on the warlock's initiative, using the familiar's reaction.
This still does not allow the familiar to make opportunity attacks.
