Who can peer-review articles?
Anyone competent enough to be asked in the first place.
For conferences (e.g., in engineering or computer science), peer-review is conducted by a Programme Committee. To be invited to be part of a Programme Committee (typically done by Chairs or Senior Programme Committee in larger conferences), you need to have a reasonable track record of research and a solid reputation in the area in question. I have seen PCs of reputable conferences in CS with many senior PhDs (I was in PCs myself as a PhD student).
For journals, you are invited to review by a member of the Editorial Board. They would weigh your experience and track-record accordingly. Again, you may get asked to review journal papers as a PhD student (I was also asked to review various journal papers as a PhD student).
Last but not least, you may be delegated a peer-review by someone who was asked to do a review (where that person was asked by the EB of a journal or as part of a PC for a conference). In that case, however, the responsibility for the quality of the review lies squarely with the delegator. In this case, a junior PhD student might be given a peer-review but with the idea that the delegator will check over it and discuss before submitting. (This is a good way to learn the process of peer-reviewing.)
I was unable to find any information online about this. I asked a colleague who told me that there are no restrictions on who may review an article, although he thought it was very unlikely that an un-published person may be asked to review.
I agree with your colleague. The delegation of peer-review is left to the judgement of the EB/PC/Chairs. They will take into account seniority and research track record in their judgement. Formal restrictions would only serve to rule out qualified reviewers from an often already too narrow field.
I am submitting an engineering research paper in the near future and the submission process requires that I suggest at least three reviewers. One of the reviewers I would like to suggest has not yet completed their PhD, although they have three publications that are closely related to mine. I know that it will be up to the editor to decide whether to contact this person, but it made me wonder if there are any specific criteria that reviewers have to meet.
I suggest submitting the name of the supervisor of the PhD student you think would be a good reviewer. The supervisor offers the editor a more senior name, should be knowledgeable in the area and if not, can solicit the advice of the PhD student in question or delegate the review entirely if appropriate.
As per my comment (and as a side note since it is not directly asked about) I find the practice of suggesting reviewers for your own paper a little strange (though I have seen it before on occasion). First there's the obvious possibility of selecting one's friends or of prior deal-making (assuming the suggestions were taken into account ... otherwise why would they ask?). Aside from that, if I'm submitting to a journal in my area, I expect the editorial board to have some members that would be sufficiently knowledgeable about my topic to get the paper in good hands. Having to suggest reviewers calls into question (slightly) the competence of the EB and/or the relevance of the journal. In any case, if the journal is otherwise reputable, this should not hold you back from submitting.