Due to convenience, as well as its security, facial recognition is fast becoming an important component of multi-factor authentication (MFA) for biometric authentication, especially banking. So, while centralizing the training of face recognition models presents privacy risks because large stores of sensitive facial data become vulnerable to leaks, today’s use cases are best served by the centralized approach. In this paper, we propose a facial recognition system based on federated learning for MFA that protects user privacy by keeping user biometrics on device. To extract robust face features, we train in a federated manner by using a deep residual network (ResNet 100) backbone across distributed clients without sharing raw images. These liveness detection capabilities are incorporated into, and evaluated against, presentation attacks using the CelebASpoof face anti spoofing dataset (625,537 images, 10,177 subjects). We show experimental results demonstrating that our proposed federated model can attain 98.2 % authentication accuracy with 1.3% Equal Error Rate (EER), which exceeds that of both a trained centralized CNN (95.6% accuracy and 3.4% EER) and a cloud based FaceNet baseline. Importantly, our method does not come at the expense of accuracy as we manage to reduce privacy risks by orders of magnitude. Based on this work we conclude that, by using federated learning, we can achieve highly accurate and privacy preserving face recognition for secure banking authentication.